Scan Google Cloud Instances Using Snapshots

cnspec can assess the security of a Google Cloud Compute Engine instance without affecting your production workload. It snapshots the instance's disk, scans the snapshot from a dedicated scanner VM, and cleans up automatically.

To run a snapshot scan, you need a VM instance with adequate permissions to create and attach snapshots.

Prerequisites

Create a custom role and service account

In the Google Cloud console, create a role named cnspec-snapshot-scanner with the permissions listed below. To learn how, read Create and manage custom roles in the Google Cloud documentation.

Then create a service account and assign it these roles:

• cnspec-snapshot-scanner
• Service Account User

Create a VM for scanning

In the Google Cloud console, create a VM instance using the service account you created above. To learn how, read Create a VM that uses a user-managed service account in the Google Cloud documentation.

Then install cnspec on the VM. This is the scanner VM that attaches and scans the snapshots.

Scan an instance using a snapshot

Connect to the scanner VM you created above and run:

cnspec scan gcp instance INSTANCE-NAME --project-id PROJECT-ID --zone INSTANCE-ZONE

For example:

cnspec scan gcp instance lunalectric-rover --project-id rover-123 --zone us-central1-a

Scan an existing snapshot

You can also scan a specific, existing snapshot to assess the instance's state at a particular point in time:

cnspec scan gcp snapshot SNAPSHOT-NAME --project-id PROJECT-ID

For example:

cnspec scan gcp snapshot suse12 --project-id rover-123

To learn how to read the scan report, including scores and remediation guidance, see Understand cnspec Results.

Next steps

• Snapshots in a different project? Read Cross-Project Snapshot Scanning.
• For build-time scanning, learn how to Build Secure VM Images with Packer.
• For other Google Cloud scan targets, see the Google Cloud overview.