Skip to main content

Cloud CDN Backend Buckets Should Cache Only Static Content

More Info:​

Ensure Cloud CDN backend buckets cache only static content for better caching performance.

Risk Level​

Medium

Address​

Operational Maturity, Reliability, Security

Compliance Standards​

  • Cloudanix Best Practice

Triage and Remediation​

Remediation​

Using Console

Sure, here are the step-by-step instructions to remediate the issue of Cloud CDN Backend Buckets caching only static content in GCP using GCP Console:

  1. Open the GCP Console and navigate to the Cloud Storage section.
  2. Click on the checkbox next to the name of the bucket that you want to configure.
  3. Click on the "Edit bucket permissions" button at the top of the page.
  4. Under the "Bucket Policy Only" section, click on the "Add members" button.
  5. In the "New members" field, enter the email address of the service account that you want to use for your Cloud CDN backend bucket.
  6. In the "Select a role" drop-down menu, select "Storage Object Viewer".
  7. Click on the "Add" button to add the service account to the bucket's IAM policy.
  8. Navigate to the Cloud CDN section of the GCP Console.
  9. Click on the checkbox next to the name of the Cloud CDN backend bucket that you want to configure.
  10. Click on the "Edit" button at the top of the page.
  11. Under the "Cache settings" section, select the "Cache everything" option.
  12. Under the "Cache control" section, select the "Override" option.
  13. Under the "Static content caching" section, select the "Custom" option.
  14. In the "Static content caching" field, enter the file extensions for the static content that you want to cache (e.g., .html, .css, .js, .jpg, .png).
  15. Click on the "Save" button to save the changes.

After following these steps, your Cloud CDN backend bucket will cache only static content as required.

Using CLI

To remediate the misconfiguration "Cloud CDN Backend Buckets Should Cache Only Static Content" for GCP using GCP CLI, follow the below steps:

  1. Open the GCP console and navigate to the Cloud Storage page.
  2. Select the bucket that you want to configure for static content caching.
  3. Click on the "Edit bucket permissions" button.
  4. In the "Add members" section, add the Cloud CDN service account by typing "cloud-cdn@google.com".
  5. Select the "Storage Object Viewer" role from the dropdown list.
  6. Click on the "Add" button to save the changes.
  7. Open the Cloud CDN page and select the CDN resource that is associated with the bucket.
  8. Click on the "Edit" button to open the configuration page.
  9. In the "Backend configuration" section, click on the "Edit backend" button.
  10. In the "Backend bucket" section, select the bucket that you want to configure for static content caching.
  11. Scroll down to the "Cache settings" section and select the "Static content only" option.
  12. Click on the "Save" button to apply the changes.

By following these steps, you have successfully remediated the misconfiguration "Cloud CDN Backend Buckets Should Cache Only Static Content" for GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Cloud CDN Backend Buckets Should Cache Only Static Content" for GCP using Python, you can follow the below steps:

Step 1: Install the required Python libraries

!pip install google-cloud-storage google-auth google-auth-oauthlib google-auth-httplib2

Step 2: Authenticate to GCP

from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file('path/to/service_account.json')

Step 3: Import the required libraries

from google.cloud import storage

Step 4: Create a function to check if an object in the bucket is static or not

def is_static_object(bucket_name, object_name):
    """Check if an object in the bucket is static or not"""
    static_extensions = ['.html', '.css', '.js', '.png', '.jpg', '.jpeg', '.gif', '.bmp', '.ico', '.pdf', '.svg', '.woff', '.woff2', '.ttf', '.eot', '.json']
    extension = object_name.split('.')[-1]
    if extension in static_extensions:
        return True
    else:
        return False

Step 5: Create a function to update the bucket's default cache control policy

def update_cache_control_policy(bucket_name):
    """Update the bucket's default cache control policy"""
    storage_client = storage.Client(credentials=credentials)
    bucket = storage_client.get_bucket(bucket_name)
    bucket.default_object_acl.loaded = False
    bucket.default_object_acl.save()
    for blob in bucket.list_blobs():
        if is_static_object(bucket_name, blob.name):
            blob.cache_control = 'public, max-age=31536000'
        else:
            blob.cache_control = 'no-cache, no-store, must-revalidate'
        blob.patch()

Step 6: Call the function to update the cache control policy for the bucket

update_cache_control_policy('your-bucket-name')

Note: Replace 'your-bucket-name' with the name of your GCP bucket.

Using Terraform
resource "google_compute_backend_bucket" "STATIC_CDN_BACKEND_BUCKET" {
  name        = "STATIC_CDN_BACKEND_BUCKET_NAME"   # replace with your backend bucket name
  bucket_name = "GCS_BUCKET_NAME"                  # replace with your Cloud Storage bucket name

  enable_cdn = true

  cdn_policy {
    # Ensure Cloud CDN caches only static content based on file extension and response headers
    cache_mode = "CACHE_ALL_STATIC"

    # (Optional but recommended) fine-tune TTLs for static content
    default_ttl = 3600        # adjust as needed (in seconds)
    max_ttl     = 86400       # adjust as needed (in seconds)
    client_ttl  = 3600        # adjust as needed (in seconds)
  }
}

Changing only cache_mode on an existing google_compute_backend_bucket updates in place and does not force replacement.

Verification: terraform plan should show an in-place update to google_compute_backend_bucket.STATIC_CDN_BACKEND_BUCKET with cdn_policy.cache_mode changing from its previous value to "CACHE_ALL_STATIC", and no -/+ replacement.

Additional Reading:​