Question

A company runs microservices on Cloud Run. The security team wants to guarantee that only container images built by the organization's trusted Cloud Build pipeline and stored in a specific Artifact Registry repository can be deployed to production Cloud Run services. Developers must not be able to deploy arbitrary public images. What is the most effective way to enforce this deployment control?

Accepted Answer

Enable Binary Authorization for Cloud Run and configure a policy requiring attestations from an attestor tied to the trusted build pipeline before any image can be deployed

Answer

Grant developers only the Cloud Run Viewer role so they cannot initiate deployments of untrusted images

Answer

Apply an organization policy constraint that restricts which external IP addresses Cloud Run services can egress to

Answer

Enable Artifact Registry vulnerability scanning and block deployment of any image with a CRITICAL CVE finding