이미지가 SHA256 해시 없이 Cloud Deploy의 아티팩트 탭에 표시되면 해당 이미지를 다시 빌드해야 할 수 있습니다.
취약점 스캔 사용 설정
보안 통계 패널에 표시된 정보는 Artifact Analysis 및 잠재적으로 Cloud Build에서 가져온 것입니다.
Artifact Analysis는 기본 컨테이너 이미지, Maven, 컨테이너의 Go 패키지 및 컨테이너화되지 않은 Maven 패키지에 대한 통합 주문형 또는 자동 스캔을 제공하는 서비스입니다.
Cloud Deploy에서 보안 통계를 보려면 여기에 설명된 IAM 역할 또는 이에 상응하는 권한이 있는 역할이 필요합니다. Artifact Registry와 Artifact Analysis가 서로 다른 프로젝트에서 실행 중인 경우에는 Artifact Analysis가 실행 중인 프로젝트에 Artifact Analysis 어커런스 뷰어 역할이나 이에 상응하는 권한을 추가해야 합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThe \u003cstrong\u003eSecurity insights\u003c/strong\u003e side panel in Google Cloud console provides a comprehensive overview of security metrics for deployed container images, helping users identify and address potential risks.\u003c/p\u003e\n"],["\u003cp\u003eSecurity insights include the SLSA build level, vulnerabilities, VEX status, SBOM, and build details, allowing for a detailed examination of the security posture of the artifacts.\u003c/p\u003e\n"],["\u003cp\u003eTo access security insights, container images must meet certain requirements, including having vulnerability scanning enabled, the appropriate IAM roles granted, and using SHA-qualified image names.\u003c/p\u003e\n"],["\u003cp\u003eEnabling vulnerability scanning, which is facilitated by Artifact Analysis and Cloud Build, is crucial for receiving all available security insights, as it automatically scans build artifacts for potential vulnerabilities.\u003c/p\u003e\n"],["\u003cp\u003eViewing security insights is accessible via the \u003cstrong\u003eView\u003c/strong\u003e link in the \u003cstrong\u003eSecurity insights\u003c/strong\u003e column within the \u003cstrong\u003eArtifacts\u003c/strong\u003e tab of a release's details page in the Cloud Deploy delivery pipeline, after navigating through the projects, delivery pipelines and the associated release.\u003c/p\u003e\n"]]],[],null,["# View security insights in Cloud Deploy\n\nThis page explains how to view security information about the container images\nyou deploy. You can view this information in the **Security insights** side\npanel for Cloud Deploy in Google Cloud console.\n\nThe **Security insights** side panel provides a high-level overview of multiple\nsecurity metrics. You can use this panel to identify and mitigate risks in\nthe images you deploy.\n\nThis panel displays the following information:\n\n- SLSA build level\n\n Identifies the maturity level of your software build process in accordance\n with the\n [Supply-chain Levels for Software Artifacts (SLSA) specification](https://slsa.dev).\n- Vulnerabilities\n\n Lists any vulnerabilities found in your artifact or artifacts.\n- VEX status\n\n [Vulnerability Exploitability eXchange(VEX) status](/artifact-analysis/docs/upload-view-vex-statements)\n for the build artifacts.\n- SBOM\n\n [**Software bill of materials (SBOM)**](/artifact-analysis/docs/sbom-overview)\n for the build artifacts.\n- Build details\n\n Includes information about the build.\n\nRequirements\n------------\n\nSecurity insights are available only for container images that meet the\nfollowing requirements:\n\n- Vulnerability scanning must be [enabled](#enable_vulnerability_scanning).\n\n- The required Identity and Access Management\n [roles must be granted](#grant_permissions_to_view_insights), in\n the project where Artifact Analysis is running.\n\n- The name of the image, as part of [release creation](/sdk/gcloud/reference/deploy/releases/create#--images),\n must be [SHA qualified](/kubernetes-engine/docs/concepts/about-container-images).\n\n If the image is shown in the **Artifacts** tab in Cloud Deploy\n without the SHA256 hash, you might need to rebuild that image.\n\nEnable vulnerability scanning\n-----------------------------\n\nThe information shown in the **Security Insights** panel comes from\n[Artifact Analysis](/container-analysis/docs/container-analysis) and\npotentially from [Cloud Build](/build/docs/overview).\nArtifact Analysis is a service that provides integrated\non-demand or automated scanning for base container images, Maven, and Go\npackages in containers, and for non-containerized Maven packages.\n\nTo receive all of the security insights available, you must enable vulnerability\nscanning:\n\n1. To turn on vulnerability scanning, enable the required APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=containerscanning.googleapis.com,cloudbuild.googleapis.com,artifactregistry.googleapis.com,containersecurity.googleapis.com)\n\n \u003cbr /\u003e\n\n2. Build your container image, and\n [store it in Artifact Registry](/build/docs/building/store-artifacts-in-artifact-registry).\n Artifact Analysis automatically scans the build artifacts.\n\n Vulnerability scanning may take a few minutes, depending on the size of your\n container image.\n\nFor more information on vulnerability scanning, see\n[On-push scanning](/container-analysis/docs/scanning-types#on-push_scanning).\n\nThere is a cost for scanning. See the [Pricing page](/container-analysis/pricing)\nfor pricing information.\n\nGrant permissions to view insights\n----------------------------------\n\nTo view security insights in Cloud Deploy, you need the IAM\nroles described here, or a role with equivalent permissions. If Artifact Registry and\nArtifact Analysis are running in different projects, you must\nadd the Artifact Analysis Occurrences Viewer role, or\nequivalent permissions, in the project where Artifact Analysis\nis running.\n\n- [Cloud Build Viewer](/iam/docs/understanding-roles#cloudbuild.builds.viewer)\n (`roles/cloudbuild.builds.viewer`)\n\n View insights for a build.\n- [Artifact Analysis Viewer](/iam/docs/understanding-roles#containeranalysis.occurrences.viewer)\n (`roles/containeranalysis.occurrences.viewer`)\n\n View vulnerabilities and other dependency information.\n\nView security insights in Cloud Deploy\n--------------------------------------\n\n1. Open the Cloud Deploy **Delivery pipelines** page in the\n Google Cloud console:\n\n [Open the delivery pipelines page](https://console.cloud.google.com/deploy)\n2. If necessary, select the project that includes the pipeline and release that\n delivered the container image for which you want to view security insights.\n\n3. Click the name of the delivery pipeline.\n\n The delivery pipeline details are shown.\n4. From the Delivery pipeline details page, select a release that delivered the\n container image.\n\n5. On the Release details page, select the **Artifacts** tab.\n\n Containers that were delivered by the selected release are listed under\n **Build artifacts** . For each container, the **Security insights** column\n includes a **View** link.\n | **Note:** If security insights are not available for a given container image, the **View** link is disabled. The **View** link is disabled if the container doesn't satisfy all requirements for it to have been scanned.\n\n6. Click the **View** link next to the name of the artifact whose security\n details you want to view.\n\n The **Security insights** panel is displayed, showing available security\n information for this artifact. The following sections describe this\n information in more detail.\n\n### SLSA level\n\nSLSA is an industry-standard set security guidelines for producers and consumers\nof software. This standard establishes\n[four levels](https://slsa.dev/spec/v0.1/levels) of confidence in the security\nof your software.\n\n### Vulnerabilities\n\nThe **Vulnerabilities** card shows the vulnerability occurrences,\navailable fixes, and VEX status for the build artifacts.\n\n[Artifact Analysis](/artifact-analysis/docs/scanning-types#automated)\nsupports scanning for container images pushed to\n[Artifact Registry](/artifact-registry/docs/overview). The scans detect\nvulnerabilities in operating system packages, and in application packages\ncreated in Python, Node.js, Java (Maven), or Go.\n\nScanning results are organized by [severity\nlevel](/artifact-analysis/docs/os-overview#severity_levels_for_vulnerabilities).\nThe severity level is a qualitative assessment based on exploitability, scope,\nimpact, and maturity of the vulnerability.\n\nClick the image name to see the artifacts that have been scanned for\nvulnerabilities.\n\nFor every container image pushed to Artifact Registry, Artifact Analysis\ncan store an associated VEX statement. VEX is a type of security advisory that\nindicates whether a product is affected by a known vulnerability.\n\nEach VEX statement provides:\n\n- The publisher of the VEX Statement\n- The artifact for which the statement is written\n- The vulnerability assessment (VEX status) for any CVEs\n\nDependencies\n------------\n\nThe **Dependencies** card displays a list of SBOMs that include a list of\ndependencies.\n\nWhen you build a container image using Cloud Build and push\nit to Artifact Registry, Artifact Analysis can generate SBOM records for\nthe pushed images.\n\nAn SBOM is a full inventory of an application, identifying the packages your\nsoftware relies on. The contents can include third-party software from vendors,\ninternal artifacts, and open source libraries.\n\n### Build details\n\nThe build details include the following:\n\n- A link to the Cloud Build logs\n\n- The name of the builder that built the image\n\n- The build date/time\n\n- Build provenance, in JSON format\n\nWhat's next\n-----------\n\n- Try the quickstart [Deploy an app to GKE and view security insights](/software-supply-chain-security/docs/sds/deploy-gke-view-security-insights)\n\n- Try the quickstart [Deploy an app to Cloud Run and view security insights](/software-supply-chain-security/docs/sds/deploy-run-view-security-insights)\n\n- Learn [software supply chain security best practices](/software-supply-chain-security/docs/overview).\n\n- Learn how to [store and view build logs](/build/docs/securing-builds/store-view-build-logs)."]]
