Professional Cloud DevOps Engineer
To protect the software supply chain, administrators implement tight security controls around Artifact Registry. Fine-grained IAM roles, such as the Artifact Registry Reader and Artifact Registry Writer roles, restrict user and service account access to only the necessary permissions at the repository level. To prevent data from leaving trusted networks, VPC Service Controls establish a secure perimeter around the registry service. Additionally, organizations can configure repositories to use Customer-Managed Encryption Keys (CMEK) instead of default Google-managed keys to maintain full control over the encryption of their stored artifacts.
Vulnerability scanning helps secure artifacts before they reach production runtimes. The service depends on Artifact Analysis to run automatic scanning whenever a developer or pipeline pushes a new container image. For earlier pipeline checks, the On-Demand Scanning API allows teams to manually scan local images during the build phase. Developers can configure Cloud Build to check these scan results and block the upload of any image that contains vulnerabilities exceeding a set threshold, such as critical or high severity.
Scanning results feed directly into Binary Authorization, which acts as a final gatekeeper before deployment. This policy engine evaluates the image and blocks runtime environments from deploying containers that fail vulnerability checks or lack a valid cryptographic signature. Adopting this shift left approach ensures that security issues are caught early in the software development lifecycle. To further minimize risk and control costs, administrators should periodically delete older, unused container images to reduce the overall attack surface.
Designing a robust repository structure in Artifact Registry involves combining three distinct repository modes to optimize dependency resolution. Administrators use standard repositories to store private, internally built artifacts, while remote repositories act as proxy caches for external upstream sources like Docker Hub or PyPI. To simplify access, virtual repositories consolidate multiple standard and remote upstream repositories behind a single search endpoint. This unified entry point mitigates dependency confusion attacks by prioritizing local private packages over public ones with the same name.
Secure pipeline integration requires robust authentication methods for both internal and external environments. When a remote repository connects to a private external upstream, the Artifact Registry service agent retrieves the required credentials from Secret Manager using its assigned Secret Manager Secret Accessor role. For local developer machines and build tools, credential helpers like the Maven wagon or Gradle plugin securely fetch temporary access tokens. This design eliminates the need to hardcode sensitive credentials in project configuration files.
Administrators manage these multi-format repositories using infrastructure-as-code tools like Terraform or the gcloud CLI. To control costs and performance, you can configure automated cleanup policies and safely test them using a dry run execution. These policies delete or keep packages based on specific conditions, such as retaining only the most recent versions. To ensure security, Artifact Analysis continuously scans both language packages and container images within these repositories, while fine-grained IAM roles enforce the principle of least privilege.
Artifact lifecycle management uses automated cleanup policies to control storage costs and remove outdated software. Administrators define rules based on criteria such as tag status, artifact age, and version limits to automatically purge unnecessary files. For example, a policy might delete untagged images older than thirty days while keeping the five most recent tagged versions. These automated rules run in the background, ensuring the registry contains only the active artifacts needed for operations.
Safe deployment pipelines rely on structured artifact promotion workflows that transition builds across isolated environments. Organizations typically provision separate registries for development, testing, and production stages to enforce strict operational boundaries. A validated container image must pass Artifact Analysis vulnerability scans and meet compliance rules before promotional tools copy it to the next environment's repository. Binary Authorization validates these transitions at the production boundary, ensuring that only fully vetted artifacts run in live environments.
Securing the software supply chain during promotion also depends on consistent version management practices. Developers use version pinning and lock files to lock dependencies to specific versions, guaranteeing reproducible builds across all environments. However, pinning introduces a tradeoff, as it can exclude critical security updates if dependencies are not regularly reviewed. To verify that external dependencies remain unchanged, remote repositories cache public assets, and build pipelines verify cryptographic signatures and hashes to guarantee artifact integrity.
Prepare and test your skills
Prepare and test your skills
A virtual repository consolidates multiple standard and remote upstream repositories behind a single search endpoint, providing a unified entry point that prioritizes local private packages over public ones with the same name to mitigate dependency confusion attacks.
Binary Authorization acts as a final gatekeeper before deployment by evaluating the image and blocking runtime environments from deploying containers that fail vulnerability checks or lack a valid cryptographic signature.
For local developer machines and build tools, credential helpers like the Maven wagon or Gradle plugin securely fetch temporary access tokens. For remote repositories connecting to a private external upstream, the Artifact Registry service agent retrieves credentials from Secret Manager.
Automated cleanup policies can use criteria such as tag status, artifact age, and version limits, for example deleting untagged images older than thirty days while keeping the five most recent tagged versions.
Define a single DELETE policy with multiple condition blocks combining tagState ANY, keepCount 10, and olderThan 30d, while omitting any KEEP policies.
Define two KEEP policies (one with mostRecentVersions keepCount set to 10, and one with tagState TAGGED and tagPrefixes ["prod-"]) and two DELETE policies (one with tagState UNTAGGED and olderThan 14d, and one with tagState TAGGED, tagPrefixes ["feat-"], and olderThan 30d).
Define four DELETE policies with negative regex match patterns that explicitly exclude tagPrefixes prod-* and version indices 1 through 10.
Create a Cloud Scheduler job targeting Cloud Functions to query the Artifact Registry API every night and execute gcloud artifacts docker images delete for non-matching tags.
Your team manages automated CI/CD artifact lifecycles across development and production environments using Google Cloud Artifact Registry. Frequent automated pipeline runs are rapidly inflating cloud storage costs with intermediate untagged layers and expired preview builds.
You need to configure automated repository cleanup policies to enforce the following governance and retention criteria:
StudyCerts
StudyCertsprod- prefix from deletion indefinitely.feat- prefix that are older than 30 days.Which cleanup policy configuration should you implement in Artifact Registry?