Setup
I turned on the Workload scanning capability but nothing is being scanned. Why?
The capability grants Plerion read access to workload metadata. Scanning also needs the scanning project, which the access command creates only when run with--enable-workload-scanning. If your organization turned the capability on before the scanning project existed, open Capabilities > Edit, confirm the workload settings, save, and re-run the command from Update Plerion access. The Scan project setup checklist in the same panel tells you which piece is missing. See Getting started.
The script stopped with a billing account error. What do I need?
Whoever runs the script needs Billing Account User on the billing account you entered. If the script can’t read the account at all, it stops before creating anything and names the roles it needs. If it can read the account but can’t link it, the failure comes at the link step as aPERMISSION_DENIED from gcloud. Ask your billing administrator for the role, then re-run the same command. See Prerequisites.
The script says my organization blocks external IPs. What now?
Your organization enforcesconstraints/compute.vmExternalIpAccess, so the default networking mode can’t work. In the Capabilities panel choose Cloud NAT, select the regions to provision it in, save, and re-run the generated command. It now carries --nat --workload-regions <r1,r2,...>. Cloud NAT is a standing cost per region. See Organization policies.
Do I need to set up each project separately?
No. The GCP organization integration already discovers every project in the organization, and workload scanning covers any project the integration covers. Use Manage projects to exclude projects, or a project’s own Capabilities panel to narrow what is scanned there.When does the first scan run, and can I trigger one?
Workload scanning runs after each project’s posture scan completes, so the first workload findings appear within one posture scan interval, up to 24 hours on the default daily schedule. To start one sooner, open the project and clickScan now. The posture scan runs first and the workload scan follows it. See When scans run.
Where do I see workload scan results?
Open a project under the organization integration. Its Workload scans tab lists each run with its status, the assets covered, and an error message for any asset that couldn’t be scanned. The Scanners tab lists the scanner VMs and jobs. Findings appear against the scanned asset in Plerion’s findings views. If a project’s workload scanning is turned off, its page shows Workload scanning is turned off for this project. Results below are from earlier scans.Coverage and results
Why does one of my projects have findings but no vulnerabilities?
Posture findings come from posture scanning, which is unaffected by any of the reasons below, so a project can have findings and no workload findings at once. Check, in order:- The project has no workloads of a type that is turned on, or workload scanning is turned off for that project in its own Capabilities panel.
- The project has never enabled
compute.googleapis.com, so Plerion can’t list its instances, images, or groups. - Its workloads are outside your Workload regions.
- Its workloads fall into a skipped category: suspended instances, Local SSD-only instances, Confidential VMs, disks encrypted with a customer-supplied encryption key (CSEK), or GKE Autopilot nodes.
- An organization policy check blocked the run for that project. In that case the run shows as failed on the project’s Workload scans tab.
Why does a Cloud Functions (1st gen) scan show zero vulnerability findings?
Dependency scanning needs pinned versions or a lockfile in the deployed source. An unpinned manifest (for examplefunctions-framework==3.*) still gets a completed scan with secrets findings, but no dependency findings, because the scanner can’t tell which version is deployed. See Cloud Functions (1st gen): dependency findings need pinned versions.
Why does Plerion scan custom images nothing has booted from?
A custom image is usually a golden image your fleet is built from, so scanning it only after something boots from it would defeat the purpose. Plerion scans everyREADY custom image a project owns. See Compute Engine custom images.
Why does Plerion rescan an image or workload that hasn’t changed?
The vulnerability data changes even when the workload doesn’t. New Common Vulnerabilities and Exposures (CVEs) against already-installed packages appear constantly, so every workload is rescanned each cycle. A completed scan with no findings is a real result, not a skipped scan.Does the PlerionAccess: Denied tag stop Plerion scanning a project?
Not on its own. When custom image scanning is on, the tag excludes the project’s images from PlerionWorkloadScanImageRead. The project’s other workloads are still scanned, including instances with CMEK-encrypted disks, because Plerion holds no access to your keys and doesn’t need it to scan. To stop scanning a project entirely, exclude it under Manage projects. Excluding an onboarded project deletes its findings and scan history. See CMEK-encrypted disks for how the tag interacts with customer-managed encryption keys (CMEK).
Are GKE nodes covered?
GKE Standard nodes are Compute Engine instances and are scanned like any other instance. Managed instance groups owned by GKE node pools are skipped at the group level, since their nodes are already scanned individually. GKE Autopilot nodes aren’t visible in the Compute Engine API and can’t be scanned. Kubernetes objects running on the nodes are covered by the Kubernetes integration.Security
Does scanning touch the production disk or slow the workload?
No. Compute Engine scanning works from a snapshot, a crash-consistent point-in-time copy taken out of band. The running instance isn’t paused, and the scan disk is a separate disk in the scanning project.Can our security team inspect a scan while it runs?
Yes. Scanner VMs and Cloud Run job executions run in the scanning project in your own organization, so they’re visible in your console like any other resource, with their logs.What happens if a scanner VM is compromised?
An attacker would get the contents of the one scan disk attached to it and a token that can only upload scan results. The scanner VM’s service account holds no IAM roles, so it can’t call a GCP API to read, change, or pivot to anything else. See The identities involved.Why does Plerion need compute.snapshots.delete?
To delete the snapshots it creates once a scan finishes. The permission is bound under an IAM condition limiting it to snapshots named with the plerion-scan- prefix, so it can’t delete a snapshot you created. See Access and permissions.
Can Plerion read all our container images and function source?
While Cloud Run or Cloud Functions (2nd gen) is on, the artifact-scanner service account can pull any image in your organization. While Cloud Functions (1st gen) is on, the source-scanner service account can download any 1st gen function’s deployed source. Each is a dedicated identity with that one role and nothing else, and each is removed when you turn the type off and re-run the access command. See Organization-level roles gated by workload type.Are image pulls and source downloads in our audit logs?
Only if you’ve enabled Data Access audit logging forartifactregistry.googleapis.com and cloudfunctions.googleapis.com, which Google Cloud doesn’t enable by default. Turn them on if you want every pull and download, including Plerion’s, recorded.
Who can redirect the scan jobs, and what could they do?
Anyone holdingrun.jobs.runWithOverrides on the scanning project can point the image scan job at any image the artifact-scanner identity can read, or the source scan job at any 1st gen function. The standing jobs are inert, so plain run.jobs.run does nothing. Each execution’s upload token is also bound to the digest or function it was launched for, so a redirected execution can’t upload results. Treat that permission on the scanning project as organization-wide image and source read. See Scanning project role.
Do secrets findings include my source or file contents?
A secrets finding reports the file path, the location in the file, the rule that matched, and the matched value with the secret itself masked. Plerion strips the surrounding lines of code before results are uploaded, so the finding doesn’t carry a fragment of your source or file beyond the matched line.How do we revoke Plerion’s access entirely?
Delete the workload identity pool (plerion) in your Plerion service project. That ends all federated access for the organization, including workload scanning, immediately. To remove only the scanning project and its billed resources, see Removing workload scanning entirely.