A security engineer is designing an automated image maintenance pipeline in Google Cloud to ensure base container images are continuously patched against newly disclosed vulnerabilities and dependencies remain up to date. The solution must meet the following requirements: Automatically rebuild base container images on a recurring daily schedule to incorporate upstream operating system patches and library updates. Store rebuilt container images in a private Artifact Registry Docker repository and automatically scan them for vulnerabilities. Trigger the build pipeline programmatically on a cron schedule using native Google Cloud services while adhering to least-privilege access control. Which architecture and configuration should the engineer implement?

Create a Cloud Build manual trigger pointing to the Git repository configuration. Configure a Cloud Scheduler HTTP job on a daily cron schedule targeting the Cloud Build trigger REST API endpoint, authenticated with an OAuth service account assigned the Cloud Build Editor (`roles/cloudbuild.builds.editor`) role. Grant the Cloud Build service account the Artifact Registry Writer (`roles/artifactregistry.writer`) role and enable the Container Scanning API.: ### What the solution is This architecture establishes an automated, serverless image rebuild and vulnerability scanning pipeline using **Cloud Scheduler**, **Cloud Build**, and **Artifact Registry** alongside **Artifact Analysis (Container Scanning)**. ### How it meets the requirements - **Scheduled automated rebuilds**: **Cloud Scheduler** runs on a defined cron schedule (such as daily at `0 1 * * *`) to invoke the **Cloud Build API** REST endpoint (`.../triggers/$TRIGGER_ID:run`), initiating an automated rebuild from source configurations to pull down updated base packages. - **Artifact Registry storage and scanning**: **Artifact Registry** securely stores the built container images, while enabling the **Container Scanning API** ensures all pushed container image layers and OS packages are automatically scanned for CVEs and known vulnerabilities. - **Least-privilege service authentication**: The **Cloud Scheduler** job authenticates directly via an OAuth token mapped to a dedicated service account with **Cloud Build Editor** (`roles/cloudbuild.builds.editor`), and the **Cloud Build** service account is granted the scoped **Artifact Registry Writer** (`roles/artifactregistry.writer`) role to push images without administrative over-privileging. ### Key advantages and capabilities - **Zero infrastructure management**: Operates completely on serverless GCP services without maintaining cron servers, VM daemons, or long-lived credentials. - **Automated security posture**: Daily rebuilds systematically remediate zero-day and patched vulnerabilities in base operating systems. - **Granular IAM boundaries**: Separates trigger invocation rights from container repository write rights using dedicated service accounts. - **Native vulnerability reporting**: Surfaces vulnerability severity ratings directly within the Google Cloud console and Security Command Center. ### Why this is optimal This approach aligns with Google Cloud security best practices by utilizing native REST integrations between Cloud Scheduler and Cloud Build, eliminating the operational overhead, credential management risks, and maintenance complexity of intermediary functions or virtual machines.

Automated Container Image Rebuild Scheduler Build Artifact | Professional Cloud Security Engineer

Automated Container Image Rebuild Scheduler Build Artifact

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is designing an automated image maintenance pipeline in Google Cloud to ensure base container images are continuously patched against newly disclosed vulnerabilities and dependencies remain up to date.

The solution must meet the following requirements:

Automatically rebuild base container images on a recurring daily schedule to incorporate upstream operating system patches and library updates.
Store rebuilt container images in a private Artifact Registry Docker repository and automatically scan them for vulnerabilities.
Trigger the build pipeline programmatically on a cron schedule using native Google Cloud services while adhering to least-privilege access control.

Which architecture and configuration should the engineer implement?

Create a Cloud Build webhook trigger configured for branch commits. Deploy a Cloud Functions instance triggered by Cloud Scheduler via Pub/Sub that runs gcloud builds submit using a service account assigned the basic Owner (roles/owner) role, and configure Artifact Registry with automated cross-region repository replication.

Provision a Compute Engine virtual machine running a Linux cron job that executes gcloud builds submit using a downloaded service account key assigned the Service Account User (roles/iam.serviceAccountUser) role, storing built images in Cloud Storage buckets before manually copying them to Artifact Registry.

Create a Cloud Build manual trigger pointing to the Git repository configuration. Configure a Cloud Scheduler HTTP job on a daily cron schedule targeting the Cloud Build trigger REST API endpoint, authenticated with an OAuth service account assigned the Cloud Build Editor (roles/cloudbuild.builds.editor) role. Grant the Cloud Build service account the Artifact Registry Writer (roles/artifactregistry.writer) role and enable the Container Scanning API.

Configure a Cloud Run Job executing a Docker daemon container daily, authenticated with the Cloud Build Service Agent role to compile images locally, and configure Artifact Registry with an external sync policy to pull updated base images from third-party public registries.

Professional Cloud Security Engineer

Automated Container Image Rebuild Scheduler Build Artifact

Related questions