This topic contains the following sections.
Container Registry Support
Google Container Registry (GCR) integrations support:
- Auto polling - polling occurs every 15 minutes
- On-demand scans via the API
Integrate GCR with Lacework
To integrate GCR with Lacework, follow these steps:
- Log in to the Lacework Console with an account with admin permissions.
- Navigate to Settings > Integrations > Container Registries.
- Click + Create New.
- From the Registry Type drop-down, select the appropriate registry and click Next.
- Complete the required settings and click Next.
- Complete any optional settings and click Save. The integration status displays Integration Successful only after its first assessment completes.
Verify that assessments have started by viewing the table in Vulnerability > Container.
After an image is assessed, Lacework reports its results in the table. Select the Last 24 hours option above the table to view the assessment results.
Settings
| Setting Name | Description |
|---|---|
| Registry Type | Specify the registry type selected from the drop-down, in this case, select Google Container Registry (GCR). |
| Name | Specify a unique name for the container registry in the Lacework Console. |
| Client ID | Specify a Client ID for the service account that has been granted the storage.objectViewer role for access to the Google project that contains the Google Container Registry (GCR). The storage.objectViewer role can be granted at the project level or the bucket level. If granting the storage.objectViewer role at the bucket level, you must grant the storage.objectViewer role to the default bucket called artifacts.YourProjectID.appspot.com. Additionally, the following must be enabled: Cloud Resource Manager API, Google Container Registry API (client requires access as well), and billing. |
| Private Key ID | Specify the Private Key ID for the service account that has granted storage.objectViewer role for access to the Google project that contains the Google Container Registry (GCR). |
| Client Email | Specify the Client email associated with the service account that has granted storage.objectViewer role for access to the Google project that contains the Google Container Registry (GCR). |
| Private Key | Specify the Private Key for the specified Private Key ID. You cannot just copy the private key from the editor because of an issue copying the new line characters. You must copy a raw version of the key using the “jq” utility as described in the next steps. 1) To view the private key raw text, enter the following command, where YourFileName.json is the name of the file downloaded when you created the GCP Service Account. $ cat YourFileName.json | jq -r '.private_key' 2) Copy all text displayed in the output including the BEGIN and END lines.  |
| Registry Domain | From the drop-down, select one of the supported GCP regions: 1) gcr.io 2) us.gcr.io 3) eu.gcr.io 4) asia.gcr.io For more information, see Container Registry Pushing and pulling images. NOTE: Do not prefix the URL with https://. |
| Limit Number of Images per Repo | Select the maximum number of newest container images to discover/assess per repository. |
| Scan only these repositories | If you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period. |
| Scan only these image tags | If you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND. |
| Scan only images with these labels | If you do not want to assess all images in this registry, specify key:value pairs so that only images with matching label key:value pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: key:value. If you specify tag and label limits, they function as an AND. |
Create a GCR Integration Using Terraform
For organizations using Terraform to manage their environments, Lacework maintains the Terraform Provider for Lacework, which enables integrating supported container registries with Lacework using automation.
If you are new to the Lacework Terraform Provider, or Lacework Terraform Modules, read the Terraform for Lacework Overview to learn the basics on how to configure the provider and more.
terraform {
required_providers {
lacework = {
source = "lacework/lacework"
}
}
}
provider "lacework" {}
provider "google" {}
module "lacework_gcr" {
source = "lacework/gcr/gcp"
version = "~> 1.0"
# Supported domains are gcr.io, us.gcr.io, eu.gcr.io, or asia.gcr.io
registry_domain = "us.gcr.io"
# Optionally, a project ID can be specified with the input 'project_id'
}
Additional information on the lacework/gcr/gcp module can be found on the Terraform Registry.
Validate the Integration
After Terraform finishes applying changes, you can use the Lacework CLI to validate the integration is working.
Open a Terminal and trigger an on-demand container vulnerability scan of one of your repositories that lives in the GCR registry you just integrated:
lacework vuln ctr scan YourGoogleRegistryDomain YourRepository YourTagOrImageDigest --poll
NOTE: To list all container registries configured in your account run lacework vuln ctr registries
You should see the vulnerability assessment of your repository.
$ lacework vulnerability container scan us.gcr.io lw-test latest --poll
A new vulnerability scan has been requested. (request_id: da123491-89f3-123d-a93b-d3a1980ee80a)
CONTAINER IMAGE DETAILS VULNERABILITIES
------------------------------------------------------------------------------------------+---------------------------------
ID sha256:48706bcd2b97520266df3cb0b3f42c3aaccf8b7819c1356c02b0609c4ec2dd98 SEVERITY COUNT FIXABLE
Digest sha256:7b4c7ae1c8c91759449f7c0c62c4b90330443ed08f5ed761d4a2bf4331504bae -----------+-------+----------
Registry us.gcr.io Critical 2 1
Repository lw-test High 32 8
Size 144.8 MB Medium 127 33
Created At 2021-03-03T23:28:46.220Z Low 140 6
Tags latest Info 377 5
Try adding '--details' to increase details shown about the vulnerability assessment.