Self-Hosted Trivy Scanner on GCP VM

The Problem and Why It Mattered

I deployed a persistent, self-hosted Trivy vulnerability scanner on a dedicated GCP VM — running scheduled scans against all Artifact Registry images and IaC configs, with centralised reporting and CVE trend analysis in BigQuery. The relevant technical and business risk is the cost of leaving this workflow, control, or product boundary unclear, manual, insecure, or difficult to operate. The case study focuses on the decisions used to make that risk manageable.

Objectives and Success Criteria

• Deliver the capability described in the project objective using a maintainable technical design.
• Make the main workflow, control boundary, and operational responsibilities explicit.
• Produce reviewable implementation evidence without publishing confidential values or customer data.

Requirements and Constraints

The delivery design had to be repeatable across environments, minimise direct production access, and retain enough evidence to investigate and roll back change safely.

My Role and Ownership

I owned the technical design and implementation described in this portfolio record, including the technology choices, core system boundaries, and the documentation of the resulting approach. Related organisational decisions, vendor operations, and formal certification decisions remain outside the scope of this technical case study unless stated explicitly.

Solution Overview

The solution is built around Trivy, Compute Engine, Cloud Scheduler. Its implementation is organised as the components below so that the architecture, control points, and operating model can be evaluated separately rather than treated as a list of tools.

Architecture and System Design

The public architecture description follows the path from the initiating user, workload, or operator action through the relevant devsecops components. Access boundaries, data or state handling, and operational controls are described at a safe level; secrets, private addresses, and client-sensitive implementation details are intentionally omitted.

Technology Decisions and Trade-Offs

I selected Trivy, Compute Engine, Cloud Scheduler because they support the project objective and make the critical engineering boundaries explicit. The trade-off is operational and platform complexity: the design depends on documented configuration, controlled access, and ongoing review rather than assuming that a managed service or framework removes engineering responsibility.

Implementation Walkthrough

The following implementation notes describe the components that matter most to the project outcome. They are intentionally focused on technical decisions and operating behaviour instead of reproducing entire source files or sensitive configuration.

Implementation: VM Setup & Hardening

Dedicated e2-small Compute Engine VM in a private subnet — no external IP, no SSH from the internet. Access through IAP TCP tunnelling only. Dedicated service account with minimal IAM permissions. No service account key — Workload Identity throughout.

Implementation: Scheduled Artifact Registry Scanning

A Python script runs on Cloud Scheduler every 6 hours, enumerates all image repositories and tags, and calls trivy image --format json for each. Results are written to Cloud Storage organised by date and image digest. A change-detection layer flags new CVEs even on unchanged images.

Implementation: Filesystem & IaC Scanning

A nightly Bash script clones the infrastructure repository, runs trivy fs against the repository root, and runs trivy config against the Terraform directory to audit IaC for misconfigurations.

Implementation: Reporting Pipeline

Scan results are processed by a Python Cloud Function triggered by the Storage write event. The function filters for HIGH and CRITICAL findings and posts a formatted summary to Slack, sends an email digest, and writes a structured summary record to BigQuery.

Implementation: Vulnerability Trend Dashboard

BigQuery scan records power a Looker Studio dashboard: total vulnerabilities by severity over time, top 10 images by CVE count, new CVEs in the last 7 days, and CVEs present for more than 30 days without remediation.

Implementation: Results

Caught 3 critical CVEs in production images within the first week — disclosed after image build, missed by CI scanning. Reduced mean time to CVE awareness from 'next build' to 6 hours maximum.

Challenges, Failures and Corrections

This portfolio record does not invent deployment failures, client incidents, or corrective actions that are not supported by the published project evidence. Where operational details are confidential or were not captured for public release, the case study documents the design boundary and lesson instead of presenting an unsupported narrative.

Security, Compliance and Risk

The public record avoids secrets, customer data, and private infrastructure details. The relevant security controls, access boundaries, and operational risks are addressed in the implementation notes where they are material to the project.

Testing, Validation and Evidence

The evidence published for this project is the documented implementation, its stated architecture and controls, and the portfolio record. Caught 3 critical CVEs in production images within the first week — disclosed after image build, missed by CI scanning. Reduced mean time to CVE awareness from 'next build' to 6 hours maximum. Claims are limited to the implementation details and outcomes documented in this case study.

Results and Evidence

Caught 3 critical CVEs in production images within the first week — disclosed after image build, missed by CI scanning. Reduced mean time to CVE awareness from 'next build' to 6 hours maximum.

What I Learned

This project reinforced that devsecops work is not a technology checklist. The durable value comes from making boundaries, trade-offs, ownership, and evidence clear enough for another engineer or stakeholder to review and operate the system responsibly.

What I Would Improve Next

• Expand automated validation around the most important workflow and control boundaries.
• Add or deepen operational evidence, such as dashboards, test artefacts, or an architecture diagram where it is safe to publish one.
• Review the design against the next expected scale, reliability, and governance requirement before extending the system.

Final Takeaway

This devops and platform engineering case study addresses a defined technical problem through Trivy, Compute Engine, Cloud Scheduler. It demonstrates my ability to turn requirements into an explainable design, implement the important controls, and document outcomes and limitations without overstating what the evidence proves.