Creating Secure Container Repositories

Introduction and Lesson Goals

Welcome to the second lesson in our course on working with container registries . In the previous lesson, you explored Google Artifact Registry and verified your environment through the gcloud CLI. Now it's time to create your first Artifact Registry repository with security best practices built in from day one. Rather than creating a basic repository and adding security later, you'll learn to configure security settings during the initial creation. This lesson focuses on critical security features: Container Analysis API for automatic vulnerability detection and IAM-based access controls for deployment consistency. By the end of this lesson, you'll run the gcloud artifacts repositories create command with the appropriate configuration and verify your settings using gcloud artifacts repositories list and gcloud artifacts repositories describe .

Why Security by Default in Google Artifact Registry

Security in container registries goes beyond access control — it's about ensuring the integrity and safety of your stored images. Google Artifact Registry integrates with Google Cloud's security infrastructure to provide comprehensive protection for your container images. Container Analysis API automatically analyzes container images for known security vulnerabilities. When enabled for your project, it scans images stored in Artifact Registry and provides detailed vulnerability reports. The API uses continuously updated vulnerability databases to identify potential issues in image layers, including OS packages and application dependencies. Scans provide severity ratings (CRITICAL, HIGH, MEDIUM, LOW) to help you prioritize remediation efforts. IAM-based access controls provide fine-grained permissions for repository operations. Google Cloud uses role-based access control to determine who can push, pull, or modify images. This approach offers flexibility while maintaining security through proper permission management. Key roles include artifactregistry.writer for pushing images, artifactregistry.reader for pulling images, and artifactregistry.repoAdmin for repository management. Key Benefits: Container Analysis API : Comprehensive vulnerability scanning with detailed reports. IAM roles : Granular control over repository operations and image management. Automated security : Integration with Google Cloud's security ecosystem. Continuous monitoring : Ongoing vulnerability detection as new threats are discovered. Consider a real-world scenario: With proper IAM configuration, you can grant your CI/CD pipeline write access while restricting production deployments to read-only access. Development teams can push images, but only authorized release managers can promote images to production repositories. This separation of concerns maintains deployment consistency and prevents unauthorized modifications.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Managing IAM Permissions with Policy Bindings

After creating a repository, you'll need to apply IAM policy bindings to grant specific users or service accounts access to your repository. Artifact Registry also supports cleanup policies for automated image retention management, which you'll explore in detail in a later lesson.

While IAM roles provide project-level permissions, you often need to grant access to specific repositories. The gcloud artifacts repositories add-iam-policy-binding command assigns roles to users or service accounts for individual repositories.

Command Structure:

Shell

gcloud artifacts repositories add-iam-policy-binding REPOSITORY \
  --location=LOCATION \
  --member=MEMBER \
  --role=ROLE

gcloud artifacts repositories add-iam-policy-binding REPOSITORY \
  --location=LOCATION \
  --member=MEMBER \
  --role=ROLE

Example: Grant a service account write access:

Shell

gcloud artifacts repositories add-iam-policy-binding my-web-app \
  --location=us-central1 \
  --member=serviceAccount:ci-pipeline@project-id.iam.gserviceaccount.com \
  --role=roles/artifactregistry.writer

gcloud artifacts repositories add-iam-policy-binding my-web-app \
  --location=us-central1 \
  --member=serviceAccount:ci-pipeline@project-id.iam.gserviceaccount.com \
  --role=roles/artifactregistry.writer

This grants the CI/CD service account permission to push images to the my-web-app repository.

Common member formats:

user:email@example.com: Individual user
serviceAccount:sa-name@project-id.iam.gserviceaccount.com: Service account
group:team@example.com: Google Group

Frequently used roles:

roles/artifactregistry.reader: Pull images only
roles/artifactregistry.writer: Push and pull images
roles/artifactregistry.repoAdmin: Full repository management

Verify IAM bindings:

Shell

gcloud artifacts repositories get-iam-policy my-web-app \
  --location=us-central1

gcloud artifacts repositories get-iam-policy my-web-app \
  --location=us-central1

This displays all IAM bindings currently applied to the repository, showing which members have which roles.

Introduction and Lesson Goals

Why Security by Default in Google Artifact Registry

Join the 1M+ learners on CodeSignal

Prerequisites and Setup Checks

Command Anatomy: create repository

Execute: Create a Secure Repository

Managing IAM Permissions with Policy Bindings

Verify and Inspect

Common Pitfalls and Quick Fixes

Summary and What's Next