Configure Zero-Touch Snapshot-based Scan for GCP

Use Zero-Touch Snapshot-based Scan for Google Cloud Platform (GCP) to assess your Compute Engine instances for operating system (OS) vulnerabilities and Software Composition Analysis (SCA) without installing agents.

• Qualys automatically creates snapshots of your VM disks in the target project.
• A temporary scanner VM is launched in a dedicated GCP project to mount those snapshots and perform the scans.
• Temporary resources (snapshots, disks, scan VMs) are cleaned up automatically by the service.

This topic explains what you need in your GCP environment, which GCP services are created, and how to enable the feature, similar to the AWS snapshot-based scan workflow.

Prerequisites for Snapshot-based Scan on GCP

Before you enable snapshot-based scanning for GCP, ensure the following:

Subscription and Feature Enablement

• You have an active Qualys Enterprise TruRisk Platform subscription with TotalCloud.
• The Zero-Touch Snapshot-based Scan for GCP feature is enabled for your subscription. If not, contact Qualys Support.
• You have the required entitlements for OS and SCA scanning. (Secret Detection is optional and may not be available in all environments.)

GCP Connectors and Projects

• At least one GCP connector is configured as the Service Account project. This project hosts the shared scan infrastructure.
• One or more GCP connectors are configured as Target Account projects. These projects host the Compute Engine VMs to be scanned.

Permissions in GCP

The service account used by the Qualys connector must be able to:

• Create and delete Compute Engine snapshots and disks.
• Launch and terminate Compute Engine instances (scan VMs).
• Read and write to a Cloud Storage bucket used for scan results and logs.
• Use a Cloud KMS key (CMEK) if you choose to encrypt scan disks and snapshots with a customer-managed key.
• Deploy the publicly invokable Cloud Run Service that is used to route the requests/responses between Qualys backend and private scanner VM.

GCP Rate Limits and Recommendations

Snapshot-based scanning uses your GCP quotas. For a smooth experience:

• Compute Engine quotas
  • Ensure you have enough quota for:
    • Snapshot operations per project/region.
    • Disk create/delete operations.
    • A small pool of temporary scan VMs in the service project.
• Cloud Storage quotas
  • Ensure sufficient storage and throughput for scan results and logs stored in the Qualys bucket.
• Cloud KMS quotas (if using CMEK)
  • Verify that your KMS key has enough capacity for the expected number of encrypt/decrypt operations.

Feature Support Matrix

The following table summarizes which scan types are supported for GCP snapshot-based scan in this release.

Resource Type	OS Scan	SwCA Scan	Secrets Scan	On-Demand Scan
Linux-based instances	Yes	Yes	No	No
Windows-based instances	No	No	No	No
Linux-based machine images	No	No	No	No
Windows-based machine images	No	No	No	No

OS Compatibility

Snapshot-based Scan for GCP uses the same operating system support matrix as other snapshot-based assessments. For the up-to-date list of supported operating systems and distributions, see:

GCP Scan OS Compatibility

GCP Services Created for Snapshot-based Scan

When you deploy the Qualys assets for GCP, the service provisions resources in both your Service Account project and your Target Account projects.

Service Account Project (Central Scan Infrastructure)

The Service Account project typically contains:

• Scan VMs
  • Temporary Compute Engine instances that:
    • Mount disks created from snapshots of your target VMs.
    • Run the Qualys scanner to perform OS and SCA assessments.
  • Scan VMs are tagged and labeled so they are easy to identify and monitor.
• Networking
  • A VPC network and subnet (or existing networking you choose) used by the scan VMs.
  • Firewall rules to allow secure outbound connectivity from scan VMs to Qualys cloud and required GCP APIs.
• Cloud Storage bucket
  • A GCS bucket used to store:
    • Scan results (OS/SCA data).
    • Logs from the scan VM.
• Cloud KMS key (optional but recommended)
  • A customer-managed encryption key (CMEK) used to encrypt:
    • The boot disk of the scan VM.
    • Disks created from snapshots.
• Control plane components
  • Internal services used by Qualys to:
    • Submit scan requests.
    • Poll scan status.
    • Coordinate cleanup of snapshots and temporary resources.

Target Account Projects (Workload Projects)

In each target project where your workloads run, Qualys uses:

• Snapshots of VM disks
  • Snapshots are created for each eligible disk attached to your Compute Engine VMs.
  • Snapshots may use your configured CMEK when applicable.
• Temporary disks and attachments
  • Disks created from snapshots are attached to the scan VM in the service project for assessment.
  • These disks are deleted automatically after the scan and result upload are complete.

Configure Snapshot-based Scanning

Step 1: Activate the Snapshot-based Scan Checkbox

To enable snapshot-based scanning for GCP, you must first activate it on the GCP connector.

1. Create or edit a GCP connector
   • Sign in to the Qualys portal and go to TotalCloud → Connectors → GCP.
   • Create a new connector or edit an existing one for your GCP environment.
2. Go to the Tags and Activation (or Scan Settings) step
   • Locate the option Enable Zero-Touch Snapshot-based Scan for GCP.
   • Select this checkbox to turn on snapshot-based assessment for that connector.
   • (Optional) Select additional options such as OS Scan, SCA Scan, and Secret Detection, depending on what you want to enable.
3. If the checkbox is greyed out
   • The checkbox remains disabled in these cases:
     • Snapshot-based scan for GCP has not yet been enabled on your subscription.
     • No Service Account project has been registered for GCP snapshot-based scanning.
   • In this case, complete the Service/Target Account deployment steps below, or contact Qualys Support.

Step 2: Deploy the Service and Target Account Projects

To fully enable snapshot-based scanning on GCP you will:

1. Provision the GCP Service Account project using Terraform.
2. Register the created connector as a Service Account using the FlexScan API.
3. Configure scan settings for the Service Account.
4. Configure scan settings for individual Target Accounts.
5. Verify setup and state using Get APIs.
6. Deregister the Service Account when decommissioning.

All FlexScan APIs are exposed under the FlexScan API base path:

• https://<qualys_base_url>/flexscan-api/rest/v1/...

Use the same Authorization header you use for other Qualys APIs (for example, a bearer token or session JWT).

1. Set Up the GCP Service Account Project with Terraform

Start by deploying the Qualys Terraform configuration for GCP. At a high level, this will:

• Create or reuse a Qualys service account in your chosen service project.
• Enable required GCP APIs on the service project (Compute Engine, Cloud Storage, KMS, Cloud Run, IAM, etc.).
• Create custom IAM roles for FlexScan (scanner and coordinator roles).
• Grant snapshot, KMS, and organization/folder/project-level permissions so FlexScan can:
  • Discover target projects.
  • Create snapshots of Compute Engine disks.
  • Use a Cloud KMS key (CMEK) for encryption.

Typical high-level steps:

1. Choose a GCP project to act as the Service Account project.
2. Prepare Terraform variables such as:
   • service_account_project_id (required)
   • organization_id (required)
   • deploy_flexscan = true to enable FlexScan in addition to CSPM
   • Optional scoping variables (folders or project IDs) if you do not want org-wide bindings
3. Run terraform init, terraform plan, and terraform apply from your Terraform environment.
4. After Terraform completes:
   • The service project has the necessary IAM roles and API enablement.
   • The Qualys service account has org/folder/project-level access to take snapshots and use KMS.

2. Register the GCP Connector as a Service Account (Register API)

Once Terraform has completed and the connector exists in Qualys, register that connector as a Service Account.

Endpoint: POST /flexscan-api/rest/v1/service-accounts/register

Headers

Header	Value	Required
Authorization	Bearer <token> (or equivalent Qualys auth)	Yes
Content-Type	application/json	Yes
Accept	application/json	Yes

Request body

{
  "accountId": "my-gcp-project",
  "cloudType": "GCP"
}

Fields

Field	Type	Required	Allowed Values	Description
accountId	String	Yes	–	The GCP project ID that you want to use as the Service Account project. This must match the connector account ID in Qualys.
cloudType	String	Yes	GCP, AWS, AZURE (case-insensitive)	Cloud provider type. Use GCP for Google Cloud.

If the account is already registered with another project, the API may return 304 Not Modified with status ALREADY_REGISTERED.

3. Configure Service Account Scan Settings (Service Account Setup API)

After registration, configure scan settings for the Service Account. These settings act as defaults for all child target accounts.

Endpoint: POST /flexscan-api/rest/v1/service-accounts/setup

Headers: Same as Register Service Account.

Request body (ScanConfigRequest)

{
  "accountId": "my-gcp-project",
  "regions": ["us-east1", "us-west1"],
  "scanInterval": 24,
  "resourceTypes": ["vm"],
  "vmScanTypes": ["os", "sca"],
  "mustHaveTags": ["env=production"],
  "atLeastOneTag": ["team=platform"],
  "noneOfTheTag": ["ignore=true"]
}

Fields

Field	Type	Required	Default	Allowed Values	Description
accountId	String	Yes	–	–	Service account ID (GCP project ID registered in the previous step).
regions	String[]	Yes	–	GCP regions (for example, us-east1, us-west1)	Regions where snapshot-based scanning should run.
scanInterval	Integer	No	24	24–720	Scan interval in hours. Minimum 24 hours.
resourceTypes	String[]	No	["vm"]	For this release: "vm" only	Resource types to scan. For GCP snapshot-based scan, only VMs are supported.
vmScanTypes	String[]	No	["os"]	"os", "sca", "secret"	VM scan types. For GCP snapshot-based scan, use "os" or "os" + "sca". "secret" is not supported in this release.
imageScanTypes	String[]	No	["os"]	"os", "sca", "secret"	Reserved for future image scanning. Typically not needed for GCP snapshot-based scan.
mustHaveTags	String[]	No	–	–	Tags that must all be present on a VM (AND logic).
atLeastOneTag	String[]	No	–	–	At least one of these tags must be present (OR logic).
noneOfTheTag	String[]	No	–	–	VMs with any of these tags are excluded from scanning.

These settings are stored on the Service Account and will be used as the baseline scan configuration for all child target accounts.

4. Configure Target Account Scan Settings (Target Account Setup API)

Once the Service Account is configured, you can override scan settings on a per-target-project basis.

Endpoint: POST /flexscan-api/rest/v1/target-accounts/setup

Headers: Same as Service Account Setup.

Request body (ScanConfigRequest)

{
  "accountId": "my-target-project",
  "regions": ["us-east1"],
  "scanInterval": 24,
  "resourceTypes": ["vm"],
  "vmScanTypes": ["os", "sca"],
  "mustHaveTags": ["env=production"],
  "atLeastOneTag": [],
  "noneOfTheTag": []
}

Fields

Same schema as Service Account Setup, with two additional rules:

• Regions subset rule – Target account regions must be a subset of its parent Service Account regions.
• Scan types subset rule – Target account vmScanTypes and imageScanTypes must be a subset of the parent Service Account's configured types.

5. Verify Service Account Configuration and State

After Terraform and the setup APIs have completed, you can verify that the Service Account is healthy and that regions are configured correctly.

5.1 Get Service Account

Endpoint: GET /flexscan-api/rest/v1/service-accounts/{accountId}

Path parameter

Name	Type	Required	Description
accountId	String	Yes	Service account ID (for example, GCP project ID).

This API returns detailed configuration, including regions, scan interval, and tag filters.

5.2 Get Service Account State

Endpoint: GET /flexscan-api/rest/v1/service-accounts/{accountId}/state

Path parameter

Name	Type	Required	Description
accountId	String	Yes	Service account ID.

The response includes:

• state – one of: PENDING, REGISTERED, SUCCESS, PARTIAL_SUCCESS, DISABLED, FAILED.
• cloudInfo – basic information about the underlying GCP project.

Use this to confirm that all regions from the Service Account setup are in SUCCESS or equivalent healthy state before relying on snapshot-based scans.

6. Deregister the Service Account (Before Deleting the Connector)

Endpoint: DELETE /flexscan-api/rest/v1/service-accounts/deregister

Headers: Same as Register Service Account.

Request body

{
  "accountId": "my-gcp-project",
  "cloudType": "GCP"
}

This call:

• Informs the external connector snapshot service that the Service Account is no longer active.
• Prepares the environment so you can safely delete the connector and, if desired, tear down infrastructure (for example, via a separate "destroy" workflow).

7. Verify Target Account State

Similar to the Service Account state API, you can verify the state of each Target Account.

Endpoint: GET /flexscan-api/rest/v1/target-accounts/{accountId}/state

Path parameter

Name	Type	Required	Description
accountId	String	Yes	Target account ID (for example, GCP project ID of the workload project).

The response includes:

• The current state of the associated Service Account (since Target Accounts inherit state from their parent).
• Per-region cloudInfo that indicates which regions are fully set up and synchronized.

Use this API to verify that each target project is properly attached to the Service Account and ready for snapshot-based scanning.

View OS/SCA Findings in TotalCloud

After a successful Snapshot-based scan execution, all findings are available for your view in the TotalCloud application.

You can navigate to the CSAM inventory and click on an instance scanned by this FlexScan technique to view its details. Under the Security tab, you can find Vulnerabilities and Software Composition Analysis. Depending on your scan configurations, these findings are available for your analysis.

Here are a few examples below.

Vulnerabilities

Software Composition Analysis (SCA)

Installed Software