A global media streaming platform hosts microservices on Google Kubernetes Engine (GKE) and stores build artifacts in Artifact Registry. The security engineering team must establish an automated security monitoring baseline that continuously scans container images for software vulnerabilities upon push and detects kernel-level runtime threats (such as reverse shells or execution of unmanaged binaries) on GKE nodes without installing third-party agent software. Which GCP security architecture meets these requirements?
- Enable Security Command Center Premium Edition with Container Threat Detection (CTD) enabled for GKE, and configure Artifact Registry Automatic Vulnerability Scanning.Answer
- BGrant the GKE node service account the primitive Owner role (`roles/owner`) to allow native security agents complete access to scan container image layers and inspect host memory.
- CGrant the deployment service account the Service Account Admin role (`roles/iam.serviceAccountAdmin`) so that CI/CD pipelines can inspect container memory and trigger runtime threat alerts.
- DConfigure a VPC Service Controls perimeter around GKE nodes and Artifact Registry to automatically detect memory-based kernel runtime threats and scan images for vulnerabilities.
Answer
Enable Security Command Center Premium Edition with Container Threat Detection (CTD) enabled for GKE, and configure Artifact Registry Automatic Vulnerability Scanning.
Combining Security Command Center Premium's Container Threat Detection with Artifact Registry's automatic vulnerability scanning satisfies both requirements agentlessly and natively within Google Cloud.
Step-by-Step Solution
Key Concept
Container Security and Threat Detection in Google Cloud