Google Artifact Analysis

What Google Artifact Analysis is

Google Artifact Analysis provides software composition analysis and structured metadata storage and retrieval. It automatically scans container images pushed to Artifact Registry, then updates vulnerability information as new vulnerabilities are discovered. Package scanning checks Java, Python, and Node.js packages for vulnerabilities, malicious software, secrets, dependencies, and licenses in open-source dependencies. Scans cover packages with 100 or fewer files. Findings and metadata are available in the Google Cloud console, with gcloud CLI, or through the Artifact Analysis API using gRPC or REST/JSON. Metadata can record release activities such as integration tests and vulnerability scans, and can support Binary Authorization policies for compliant images from trusted registries. Detection points are built into products including Artifact Registry and Google Kubernetes Engine. Security Command Center can aggregate Artifact Registry scan findings across projects and export them to BigQuery. Automatic scanning and on-demand scanning each cost $0.26, paid once. Scanned images and packages receive metadata updates while pulled within the last 30 days; results become stale after that. Vulnerability scanning is not supported in Artifact Registry virtual repositories. Google Cloud says it undergoes independent verification and achieves certifications, attestations, and audit reports to help demonstrate compliance.

Who it suits

Artifact Analysis suits teams that need to scan container images and supported language packages or store metadata about release activities. It also fits Google Cloud users who want to access findings through the console, CLI, or API.

Limits

Package scanning is limited to packages with 100 or fewer files. Scanned images and packages receive metadata updates while pulled within the last 30 days; afterward, results become stale. Vulnerability scanning is unavailable in Artifact Registry virtual repositories.

Getting started

1. Visit https://cloud.google.com/artifact-analysis.
2. Use the Google Cloud console, gcloud CLI, or Artifact Analysis API.
3. Choose automatic scanning or on-demand scanning at $0.26, paid once.
4. Push a new image to Artifact Registry for automatic scanning, or request a manual image scan.

Verdict

Artifact Analysis combines package and image scanning with metadata storage and access through Google Cloud interfaces. Account for the package-size and repository limits, and note that scan plans are priced at $0.26, paid once.