Cloud Build Binary Authorization Attestation Pipeline

What the Automated Attestation Workflow Is

This workflow integrates Artifact Analysis On-Demand Scanning API, Cloud Key Management Service (Cloud KMS), and Binary Authorization directly into a Cloud Build pipeline to enforce shift-left security and cryptographic provenance across the software supply chain.

How It Meets the Security Requirements

• Pre-Push Vulnerability Gate: The pipeline builds the container locally and triggers an on-demand scan with gcloud artifacts docker images scan. It inspects vulnerability.effectiveSeverity with gcloud artifacts docker images list-vulnerabilities, parsing findings with an exit code condition (grep -Exq 'CRITICAL|HIGH') that terminates the build before pushing unauthorized artifacts to Artifact Registry.
• Immutable Digest Referencing: By calculating and pinning the container's cryptographic digest (sha256), the pipeline guarantees that the attestation and the deployed artifact are immutably linked, eliminating time-of-check to time-of-use (TOCTOU) tag mutation risks.
• Cryptographic Attestation Generation: Using gcloud beta container binauthz attestations sign-and-create, Cloud Build invokes an asymmetric signing key in Cloud KMS to sign the image digest payload and records the signed attestation as an occurrence under the attestor's Artifact Analysis Note.
• Deploy-Time Enforcement: GKE's admission controller intercepts deployment manifests, checks Binary Authorization policy rules requiring the specific attestor authority, validates the Cloud KMS signature against the attestor's registered public key, and admits the pod.

Key Advantages and Capabilities

• Fail-Closed Security: Images containing unapproved vulnerabilities are never pushed to production repositories.
• Tamper-Proof Verification: Signatures are anchored in hardware-backed or managed Cloud KMS keys without exposing private key material to local developers.
• Separation of Concerns: Cryptographic attestor identities remain distinct across pipeline stages (e.g., build verification, security scanning, QA testing).
• Auditability and Traceability: Detailed attestation occurrences in Artifact Analysis maintain historical records of exactly which build job signed which image digest.

Why This Is Optimal

This architecture establishes a strict gatekeeper mechanism inside CI/CD, preventing vulnerable or non-compliant containers from reaching deployment targets by cryptographically binding policy compliance to immutable image digests.