diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index d478bd2a75..a97c666469 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -21,6 +21,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS EKS service metadata to new format [(#8890)](https://github.com/prowler-cloud/prowler/pull/8890) - Update AWS Elastic Beanstalk service metadata to new format [(#8934)](https://github.com/prowler-cloud/prowler/pull/8934) - Update AWS ElastiCache service metadata to new format [(#8933)](https://github.com/prowler-cloud/prowler/pull/8933) +- Update GCP Artifact Registry service metadata to new format [(#9088)](https://github.com/prowler-cloud/prowler/pull/9088) - Update AWS EFS service metadata to new format [(#8889)](https://github.com/prowler-cloud/prowler/pull/8889) - Update AWS EventBridge service metadata to new format [(#9003)](https://github.com/prowler-cloud/prowler/pull/9003) - Update AWS Firehose service metadata to new format [(#9004)](https://github.com/prowler-cloud/prowler/pull/9004) diff --git a/prowler/providers/gcp/services/artifacts/artifacts_container_analysis_enabled/artifacts_container_analysis_enabled.metadata.json b/prowler/providers/gcp/services/artifacts/artifacts_container_analysis_enabled/artifacts_container_analysis_enabled.metadata.json index 78b8f9de91..68ed17be63 100644 --- a/prowler/providers/gcp/services/artifacts/artifacts_container_analysis_enabled/artifacts_container_analysis_enabled.metadata.json +++ b/prowler/providers/gcp/services/artifacts/artifacts_container_analysis_enabled/artifacts_container_analysis_enabled.metadata.json @@ -1,29 +1,30 @@ { "Provider": "gcp", "CheckID": "artifacts_container_analysis_enabled", - "CheckTitle": "Ensure Image Vulnerability Analysis using AR Container Analysis or a third-party provider", - "CheckType": [ - "Security", - "Configuration" - ], + "CheckTitle": "GCP project has Artifact Registry Container Analysis API enabled", + "CheckType": [], "ServiceName": "artifacts", - "SubServiceName": "Container Analysis", + "SubServiceName": "", "ResourceIdTemplate": "", "Severity": "medium", - "ResourceType": "Service", - "Description": "Scan images stored in Google Container Registry (GCR) for vulnerabilities using AR Container Analysis or a third-party provider. This helps identify and mitigate security risks associated with known vulnerabilities in container images.", - "Risk": "Without image vulnerability scanning, container images stored in Artifact Registry may contain known vulnerabilities, increasing the risk of exploitation by malicious actors.", - "RelatedUrl": "https://cloud.google.com/artifact-analysis/docs", + "ResourceType": "serviceusage.googleapis.com/Service", + "Description": "Evaluates whether **Artifact Analysis** (`containeranalysis.googleapis.com`) is enabled at the project level to support **vulnerability scanning** and metadata for container images in Artifact Registry or Container Registry.", + "Risk": "Absent this service, images aren't continuously scanned, leaving known CVEs unnoticed. Attackers can run vulnerable containers, gain code execution, move laterally, and exfiltrate data, eroding the **integrity** and **confidentiality** of workloads and the software supply chain.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://cloud.google.com/artifact-analysis/docs", + "https://cloud.google.com/artifact-analysis/docs/container-scanning-overview" + ], "Remediation": { "Code": { - "CLI": "gcloud services enable containeranalysis.googleapis.com", + "CLI": "gcloud services enable containeranalysis.googleapis.com --project ", "NativeIaC": "", - "Other": "", - "Terraform": "" + "Other": "1. In Google Cloud Console, ensure the correct project is selected\n2. Go to APIs & Services > Library\n3. Search for \"Container Analysis API\"\n4. Click the API, then click \"Enable\"", + "Terraform": "```hcl\nresource \"google_project_service\" \"\" {\n project = \"\"\n service = \"containeranalysis.googleapis.com\" # Enables Artifact Analysis (Container Analysis) API to pass the check\n}\n```" }, "Recommendation": { - "Text": "Enable vulnerability scanning for images stored in Artifact Registry using AR Container Analysis or a third-party provider.", - "Url": "https://cloud.google.com/artifact-analysis/docs/container-scanning-overview" + "Text": "Enable **Artifact Analysis** (`containeranalysis.googleapis.com`) for projects hosting container images. Integrate scan results into CI/CD policy gates, apply **least privilege** to findings access, and rebuild images promptly to maintain **defense in depth**.", + "Url": "https://hub.prowler.com/check/artifacts_container_analysis_enabled" } }, "Categories": [],