Assess vulnerabilities for Cloud Run

Vulnerability Assessment for Google Cloud in Security Command Center lets you continuously detect software vulnerabilities and exposed secrets in your running Cloud Run workloads.

Before you begin

To use Vulnerability Assessment for Google Cloud, you must meet the following requirements:

  • Enable the Container Scanning API (containerscanning.googleapis.com) to activate Artifact Analysis container scanning on the projects hosting your Artifact Registry repositories. Enabling the Container Scanning API also enables the Artifact Analysis API (containeranalysis.googleapis.com).

    Roles required to enable APIs

    To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

    Enable the API

    Enabling Vulnerability Assessment for Google Cloud doesn't activate Artifact Analysis container scanning on your image repositories. If you don't enable the Container Scanning API on the projects where you host your container images, Vulnerability Assessment for Google Cloud can't generate vulnerability or exposed secret findings for your Cloud Run resources.

  • Activate Security Command Center for your organization or project. The Premium and Enterprise tiers enable Vulnerability Assessment for Google Cloud by default. On the Standard tier, you must manually enable Vulnerability Assessment for Google Cloud at the organization, folder, or project level.

  • Store your container images in an Artifact Registry repository within the same Google Cloud organization as your Cloud Run workload. Images from external organizations aren't scanned, except for verified public Google container mirrors.

How Vulnerability Assessment for Google Cloud works

To assess vulnerabilities and exposed secrets in Cloud Run workloads, two features work together:

  • Artifact Analysis container scanning: Scans container images stored in Artifact Registry for known Common Vulnerabilities and Exposures (CVEs) and exposed secrets, and records the scan results as occurrences in Artifact Analysis.
  • Vulnerability Assessment for Google Cloud: Correlates the vulnerability and secret occurrences from Artifact Analysis with active Cloud Run resources.

Unlike static container image scanning, which reports findings on container images in Artifact Registry, Vulnerability Assessment for Google Cloud attaches findings directly to your running Cloud Run workloads. Vulnerability Assessment for Google Cloud performs the following actions:

  • Correlates runtime metadata: Matches the container image digest to the active Cloud Run service, job, or worker pool.
  • Identifies revisions and sidecars: Identifies the active revisions serving traffic or running instances and the containers or multi-container sidecars that contain the vulnerability or secret.
  • Manages finding lifecycle: Keeps the finding ACTIVE as long as an active revision or executed job references the vulnerable image. When you deploy a patched revision and shift traffic or instances away from the vulnerable revision, the finding automatically transitions to INACTIVE.

Supported resources

Vulnerability Assessment for Google Cloud discovers vulnerabilities and exposed secrets in the following Cloud Run resources:

  • Cloud Run services (run.googleapis.com/Service): Monitors active revisions serving traffic. Findings list the full resource names of up to five active revisions that are running the vulnerable image.
  • Cloud Run jobs (run.googleapis.com/Job): Evaluates batch jobs based on the container image that was used in the latest execution that started successfully within the past 14 days. Jobs that have never been executed or that failed during initialization aren't scanned.
  • Cloud Run worker pools (run.googleapis.com/WorkerPool): Monitors active revisions running instances. Findings list the full resource names of all active revisions that are running the vulnerable image.

Limitations

If a Cloud Run service or worker pool runs for more than 30 days without an image pull, a new revision deployment, or an instance cold start, Artifact Analysis pauses scanning for new CVEs until a new pull or deployment occurs. Existing ACTIVE findings remain ACTIVE and subject to Security Command Center data retention policies.

Findings appear only when Artifact Analysis scans or re-analyzes an image. Deploying an image that was pushed to Artifact Registry earlier doesn't trigger a scan, so findings for that workload appear after the next re-analysis, within about 4 hours.

View vulnerability and secret findings

To view vulnerability and secret findings for Cloud Run in the Google Cloud console, follow these steps:

  1. In the Google Cloud console, go to the Findings page in Security Command Center:

    Go to Findings

  2. In the project selector, select your organization, folder, or project.

  3. In the Quick filters panel, in the Resource type section, select run.googleapis.com/Service, run.googleapis.com/Job, or run.googleapis.com/WorkerPool.

  4. Click a finding to view its details, including the affected container name, image digest, and active revision URIs.

Remediate vulnerability and secret findings

To remediate a vulnerability or secret finding, follow these steps:

  1. Update your application dependencies or base image to a version that patches the vulnerability, or remove exposed secrets from your container image file system, Dockerfile, or source code.
  2. Build and push the new container image to Artifact Registry.
  3. Deploy a new revision of your service, or update your job or worker pool.
  4. If you use traffic splitting or instance splitting, route all traffic or allocate all instances to the patched revision. After the old revision no longer serves traffic or runs instances, Vulnerability Assessment for Google Cloud marks the finding as INACTIVE.

What's next