# Ensure Image Vulnerability Analysis Using AR Container Analysis or a Third-Party Provider

- Source: https://support.icompaas.com/support/solutions/articles/62000235318-ensure-image-vulnerability-analysis-using-ar-container-analysis-or-a-third-party-provider
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

-   **Level 2**
    

### **Description****:**

Container images deployed in **Google Cloud** or any other cloud environment should be analyzed for vulnerabilities to ensure they do not contain known security issues. This can be achieved using **AR Container Analysis** or a third-party **vulnerability scanning provider**.

### **Rationale****:**

Container vulnerability analysis helps in identifying security risks in container images before they are deployed to production environments. This process ensures that only secure and trusted images are running in your cloud infrastructure. By leveraging **AR Container Analysis** or third-party providers, you can automate the detection of vulnerabilities within your **container images** during development, making it easier to detect, assess, and mitigate risks early.

### **Impact****:**

-   **Security**: Identifying and fixing vulnerabilities in container images ensures the images are **secure** before deployment, reducing the risk of **security breaches**.
    
-   **Operational Overhead**: Setting up **AR Container Analysis** or a third-party provider might require initial configuration and integration into the **CI/CD pipeline**.
    
-   **Compliance**: Helps meet compliance requirements for **secure software practices** such as **PCI-DSS**, **HIPAA**, and **SOC 2** by ensuring vulnerability scanning is part of the development lifecycle.
    

### **Default Value****:**

-   By default, **AR Container Analysis** or third-party tools may not be integrated with container images. Vulnerability analysis needs to be enabled and configured.
    

### **Test Plan****:**

#### **Using Google Cloud Console (AR Container Analysis):**

1.  **Navigate to AR Container Analysis**: Go to **Container Analysis** in Google Cloud Console.
    
2.  **Verify Vulnerability Scanning**:
    
    -   Ensure that **AR Container Analysis** is enabled for your **container registry**.
        
    -   Review the **vulnerability report** for each image stored in **Container Registry** or **Artifact Registry**.
        
3.  **Repeat for All Repositories**: Ensure **all container image repositories** have vulnerability scanning enabled.
    

#### **Using Google Cloud CLI:**

1.  **List All Images in the Registry**:
    
    gcloud container images list --repository=gcr.io/\[PROJECT\_ID\]
    
2.  **Check Vulnerability Analysis for an Image**:  
    To check the vulnerability report for a specific image:
    
    gcloud container images describe gcr.io/\[PROJECT\_ID\]/\[IMAGE\] --format="json" | jq '.vulnerabilityReport'
    
    -   Ensure that the **vulnerability report** for the image is available.
        

### **Remediation Steps****:**

#### **Using Google Cloud Console (AR Container Analysis):**

1.  **Enable AR Container Analysis**:
    
    -   Go to **Artifact Registry** and **Container Registry** under **Cloud Storage**.
        
    -   Ensure that **vulnerability scanning** is enabled in the **Security** settings for your image repositories.
        
2.  **Configure CI/CD Pipeline for Vulnerability Scanning**:
    
    -   If using **Cloud Build**, configure the pipeline to scan images during the build process and before deployment.
        
3.  **Integrate Vulnerability Alerts**:
    
    -   Integrate with **Cloud Security Command Center** for monitoring and alerting based on vulnerability reports.
        

#### **Using Google Cloud CLI:**

1.  **Enable AR Container Analysis**:  
    Enable the **Container Analysis API**:
    
    gcloud services enable containeranalysis.googleapis.com
    
2.  **Trigger Image Scanning**:  
    Trigger the vulnerability scan for a container image:
    
    gcloud container images scan gcr.io/\[PROJECT\_ID\]/\[IMAGE\]
    
    -   Review the **vulnerability report** for detected issues.
        

### **Backout Plan****:**

1.  **Disable Vulnerability Scanning**:  
    If needed, disable **AR Container Analysis** for your container repositories by running the following
    
    gcloud services disable containeranalysis.googleapis.com
    
2.  **Verify No Vulnerability Scanning**: Ensure that no vulnerability reports are being generated after disabling the scanning.
    
3.  **Test Image Deployment**: Ensure that images are still being deployed and running successfully without vulnerability scanning.
    
4.  **Notify Stakeholders**: Communicate to the **security team** and other stakeholders about the changes to the vulnerability scanning process.
    

### **References:**

-   AR Container Analysis Documentation
    
-   Container Vulnerability Scanning with Google Cloud
    
-   Container Analysis API Setup
    

### **CIS Controls:**

| 
**Control**

 | 

**Description**

 | 

**IG 1**

 | 

**IG 2**

 | 

**IG 3**

 |
| --- | --- | --- | --- | --- |
| 

**3.11**

 | 

Encrypt sensitive data at rest using strong encryption algorithms and keys

 | 

✅

 | 

✅

 | 

✅

 |
| 

**14.5**

 | 

Ensure systems are configured with appropriate security patches

 | 

✅

 | 

✅

 | 

✅

 |
| 

**8.5**

 | 

Implement application security testing, including **vulnerability scanning**

 | 

✅

 | 

✅

 | 

✅

 |

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.