GCP public-facing (external) regional load balancer using HTTP protocol misconfiguration detected in

Rule Details

Cortex AppSec Rule ID	APPSEC2_GCP_37
Category	Networking
Provider	GCP
Severity	MEDIUM
Framework	Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	c53fa2b3-af35-44b4-a9ff-da1d3dd81c17

Impact

This rule identifies GCP public-facing (external) regional load balancers that are using HTTP protocol.

Using the HTTP protocol with a GCP external load balancer transmits data in plaintext, making it vulnerable to eavesdropping, interception, and modification by malicious actors. This lack of encryption exposes sensitive information, increases the risk of man-in-the-middle attacks, and compromises the overall security and privacy of the data exchanged between clients and servers.

It is recommended to use HTTPS protocol with external-facing load balancers.

How to Fix

To fix the issue, ensure that the forwarding rule associated with your load balancer does not utilize HTTP proxies. Instead, you should set the load_balancing_scheme to EXTERNAL with a backend that does not rely on HTTP proxy configurations. Make sure that your forwarding rules effectively utilize the appropriate backend service while complying with this requirement. [source,go]

resource "google_compute_forwarding_rule" "example" { ... load_balancing_scheme = "EXTERNAL"

• target = "https://www.googleapis.com/compute/v1/projects/my-project/global/targetHttpProxies/my-target-proxy"
• target = "https://www.googleapis.com/compute/v1/projects/my-project/global/targetSslProxies/my-target-proxy" ... }

---