diff --git a/modules/artifact-registry/README.md b/modules/artifact-registry/README.md
index f38217a25..90853ab19 100644
--- a/modules/artifact-registry/README.md
+++ b/modules/artifact-registry/README.md
@@ -300,18 +300,19 @@ module "additive_iam" {
| name | description | type | required | default |
|---|---|:---:|:---:|:---:|
| [cleanup_policies](variables.tf#L17) | Object containing details about the cleanup policies for an Artifact Registry repository. | map(object({…default = null | ✓ | |
-| [format](variables.tf#L56) | Repository format. | object({…}) | ✓ | |
-| [location](variables.tf#L206) | Registry location. Use `gcloud beta artifacts locations list' to get valid values. | string | ✓ | |
-| [name](variables.tf#L211) | Registry name. | string | ✓ | |
-| [project_id](variables.tf#L216) | Registry project id. | string | ✓ | |
+| [format](variables.tf#L63) | Repository format. | object({…}) | ✓ | |
+| [location](variables.tf#L213) | Registry location. Use `gcloud beta artifacts locations list' to get valid values. | string | ✓ | |
+| [name](variables.tf#L218) | Registry name. | string | ✓ | |
+| [project_id](variables.tf#L223) | Registry project id. | string | ✓ | |
| [cleanup_policy_dry_run](variables.tf#L38) | If true, the cleanup pipeline is prevented from deleting versions in this repository. | bool | | null |
| [description](variables.tf#L44) | An optional description for the repository. | string | | "Terraform-managed registry" |
-| [encryption_key](variables.tf#L50) | The KMS key name to use for encryption at rest. | string | | null |
+| [enable_vulnerability_scanning](variables.tf#L50) | Whether vulnerability scanning should be enabled in the repository. | bool | | true |
+| [encryption_key](variables.tf#L57) | The KMS key name to use for encryption at rest. | string | | null |
| [iam](variables-iam.tf#L36) | IAM bindings in {ROLE => [MEMBERS]} format. | map(list(string)) | | {} |
| [iam_bindings](variables-iam.tf#L43) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | map(object({…})) | | {} |
| [iam_bindings_additive](variables-iam.tf#L58) | Individual additive IAM bindings. Keys are arbitrary. | map(object({…})) | | {} |
| [iam_by_principals](variables-iam.tf#L73) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | map(list(string)) | | {} |
-| [labels](variables.tf#L200) | Labels to be attached to the registry. | map(string) | | {} |
+| [labels](variables.tf#L207) | Labels to be attached to the registry. | map(string) | | {} |
## Outputs
diff --git a/modules/artifact-registry/main.tf b/modules/artifact-registry/main.tf
index a9ac681e3..665b85602 100644
--- a/modules/artifact-registry/main.tf
+++ b/modules/artifact-registry/main.tf
@@ -21,17 +21,21 @@ locals {
}
resource "google_artifact_registry_repository" "registry" {
- provider = google-beta
- project = var.project_id
- location = var.location
- description = var.description
- format = upper(local.format_string)
- labels = var.labels
- repository_id = var.name
- mode = "${upper(local.mode_string)}_REPOSITORY"
- kms_key_name = var.encryption_key
-
+ provider = google-beta
+ project = var.project_id
+ location = var.location
+ description = var.description
+ format = upper(local.format_string)
+ labels = var.labels
+ repository_id = var.name
+ mode = "${upper(local.mode_string)}_REPOSITORY"
+ kms_key_name = var.encryption_key
cleanup_policy_dry_run = var.cleanup_policy_dry_run
+
+ vulnerability_scanning_config {
+ enablement_config = var.enable_vulnerability_scanning ? "INHERITED" : "DISABLED"
+ }
+
dynamic "cleanup_policies" {
for_each = var.cleanup_policies == null ? {} : var.cleanup_policies
content {
diff --git a/modules/artifact-registry/variables.tf b/modules/artifact-registry/variables.tf
index 23b194a39..88c47215d 100644
--- a/modules/artifact-registry/variables.tf
+++ b/modules/artifact-registry/variables.tf
@@ -47,6 +47,13 @@ variable "description" {
default = "Terraform-managed registry"
}
+variable "enable_vulnerability_scanning" {
+ description = "Whether vulnerability scanning should be enabled in the repository."
+ type = bool
+ default = true
+ nullable = false
+}
+
variable "encryption_key" {
description = "The KMS key name to use for encryption at rest."
type = string