docs(cloud-security): container image vulnerabilities on GCP and Azure - #333
Draft
maximelb wants to merge 2 commits into
Draft
docs(cloud-security): container image vulnerabilities on GCP and Azure#333maximelb wants to merge 2 commits into
maximelb wants to merge 2 commits into
Conversation
The V1 container lanes ship the scopes they need, so the setup pages have to carry them (parity contract §4.6 — a collector that 403s in the field is worse than no collector). GCP: `roles/containeranalysis.occurrences.viewer` joins the optional-roles table and the grant loop, `containeranalysis.googleapis.com` joins the API enable list, and a note states the three limits honestly — images are not inventoried, an enabled verdict is about the API rather than every repository, and a registry over the per-project ingestion budget is skipped WHOLE rather than truncated. Azure: the distinction that will actually generate support tickets is that this one is a PLAN, not a permission — Reader already grants the read, but the Defender for Containers plan must be on Standard, and Defender for Kubernetes is a different product that scans no images. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y3AnxeGmcGA9scrsRZFtg9
lcbill
previously approved these changes
Aug 2, 2026
…udget limit The registry lookup is NOT separately probed, and the earlier text said it was. It cannot be: Azure Resource Graph filters by RBAC rather than refusing, so a credential that cannot see registries gets 200 and an empty list — a probe that cannot fail for the reason it exists reports a pass. The grant it needs is subscription Reader, which the arm_reader check already proves. Also states the per-subscription ingestion budget, matching the GCP page. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y3AnxeGmcGA9scrsRZFtg9
lcbill
approved these changes
Aug 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was asked
Roadmap V1 residual — GCP Artifact Analysis + Azure Defender for Containers vulnerability
ingestion. Parity contract §4.6 requires the onboarding scopes to land with the collector, so
this is the docs half. Collectors:
legion_cloudsec_host; coverage vocabulary:go-cloudsec.What was done
provider-setup/gcp.mdroles/containeranalysis.occurrences.vieweradded to the optional-roles table (preflightcheck
artifact_analysis) and to the grant loop.containeranalysis.googleapis.comadded to the API enable list.images are reported by digest (one image is one thing to triage across clouds), images
are not inventoried yet, an enabled verdict is about the API rather than every
repository, and a project over the per-project ingestion budget reports none of its
image findings rather than an arbitrary subset. That last one is not hypothetical — the
reference estate's own build project is over it — and it is the case a customer would most
expect results from, so it is stated rather than buried.
provider-setup/azure.mddefender_vulnrow and its troubleshooting entry now say the check covers bothserver and container-image assessments, and that it also probes the registry lookup that
gives each image its region (a different Resource Graph table, and the half that fails
independently).
not a permission. Reader already grants the read; what is needed is Defender for
Containers (or the retired standalone Container Registry plan) on Standard. And
Defender for Kubernetes does not count — it buys runtime protection and scans no images.
Testing
Documentation only. Rendered as MkDocs tables/admonitions consistent with the surrounding
page; no code or config touched. No internal identifiers, customer names, or private-repo
references (this repo is public).
🤖 Generated with Claude Code
https://claude.ai/code/session_01Y3AnxeGmcGA9scrsRZFtg9