GCP HTTPS Load balancer is set with SSL policy having TLS version 1.1 or lower misconfiguration dete

Rule Details

Cortex AppSec Rule ID	APPSEC_GCP_4
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	GCP
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. SSL policies control the features of SSL in Google Cloud SSL proxy load balancer and external HTTP(S) load balancers. By default, HTTP(S) Load Balancing and SSL Proxy Load Balancing use a set of SSL features that provides good security and wide compatibility. To prevent usage of insecure features, SSL policies should use one of the following three options:

. At least TLS 1.2 with the MODERN profile; + or

. The RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; + or

. A CUSTOM profile that does not support any of the following features: +

• TLS_RSA_WITH_AES_128_GCM_SHA256
• TLS_RSA_WITH_AES_256_GCM_SHA384
• TLS_RSA_WITH_AES_128_CBC_SHA
• TLS_RSA_WITH_AES_256_CBC_SHA
• TLS_RSA_WITH_3DES_EDE_CBC_SHA

Load balancers are used to efficiently distribute traffic across multiple servers. + Both SSL proxy and HTTPS load balancers are external load balancers: they distribute traffic from the Internet to a GCP network. + GCP customers can configure load balancer SSL policies with a minimum TLS version (1.0, 1.1, or 1.2) that clients can use to establish a connection, along with a profile (Compatible, Modern, Restricted, or Custom) that specifies permissible and insecure cipher suites. + It is easy for customers to configure a load balancer without knowing they are permitting outdated cipher suites. + It is possible to define SSL policies to control the features of SSL that your load balancer negotiates with clients. + An SSL policy can be configured to determine the minimum TLS version and SSL features that are enabled in the load balancer. + We recommend you select TLS 1.2 as the minimum TLS version supported.

How to Fix

Resource: google_compute_ssl_policy

• Arguments: profile = MODERN
• Resource: google_compute_ssl_policy
• Arguments: profile = CUSTOM custom_features = [] //Option 1 [source,go]

---

resource "google_compute_ssl_policy" "modern-profile" { name = "nonprod-ssl-policy"

• profile = "MODERN"
• min_tls_version = "TLS_1_2" }

//Option 2 resource "google_compute_ssl_policy" "custom-profile" { name = "custom-ssl-policy"

• profile = "CUSTOM" min_tls_version = "TLS_1_2"
• custom_features = ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"] }

---