Google Registries Scanning with Container Inspection

^{Last Updated: 2021-02-05}

Purpose

This article describes how to create access for Google Cloud Platform portal from a HIAB.

Introduction

Outpost24’s Google Registries Scanning with Container Inspection allows you to discover and assess container images stored in Google Container Registry through a HIAB appliance. By configuring GCP APIs and a service account with appropriate access, the platform can pull images via OAuth tokens and analyze them for vulnerabilities. This integration brings container-level visibility into your security program while leveraging existing infrastructure and standardized authentication.

Requirements

To use Google API, you need to ensure that the Cloud API are enabled.

1. Login to your Google Cloud Account open the left menu and select APIS & Services > Library entry.

   
   

   

   
   
   

2. Enter Cloud Resource Manager API in the search bar.
   
   

   

   
   
   

3. Select the Cloud Resource Manager API to ensure it is enabled.
   
   

   

Configuring Google Container Registry

To run Container Inspection on an Google container registry, the Google registry must be configured to provide access that later can be configured on the Outpost24 HIAB.

1. Enter Google Cloud Platform console and open IAM & Admin > Service Accounts console by clicking on the entry on the top left menu.
   
   

   

   
   
   

2. Create a service account with access to the Google Container Registry by clicking on the CREATE SERVICE ACCOUNT button on the top.
   
   

   

   
   
   

3. Fill the different settings for the service account and then click on CREATE button.
   
   

   

   
   
   

4. Grant access Container Registry access and then click DONE button.
   
   

   

   
   
   

5. Once the Service Account is created, create a Key as follow.
   
   

   

   
   
   

6. Choose JSON format to generate the credentials and save them locally (they will be needed later on while configuring GCP credentials in OUTPOST24 software).
   
   

   

   
   
   

7. Once you have created the service account with JSON key type, you need to then create an authentication token as described in Google documentation here: https://cloud.google.com/container-registry/docs/advanced-authentication#token

8. You need to install gcloud client and then run the following command line by replacing:

• the <ACCOUNT> with your account name with following format [USERNAME]@[PROJECT-ID].iam.gserviceaccount.com (this is the email parameter in the JSON key file)

• the <KEY_FILE> with the JSON key file you created in previous step

Google gcloud command to generate an access token

gcloud auth activate-service-account <ACCOUNT> --key-file=<KEY_FILE>
gcloud auth print-access-token

Examples

Example of the gcloud command output:

Example of the OUTPOST24 software configuration.

Example of a Docker Discovery scan.

Reference

• https://cloud.google.com/container-registry/docs/pushing-and-pulling

• https://cloud.google.com/container-registry/docs/advanced-authentication#console

• https://cloud.google.com/container-registry/docs/advanced-authentication#token