> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud CDN Backend Buckets Should Cache Only Static Content

### More Info:

Ensure Cloud CDN backend buckets cache only static content for better caching performance.

### Risk Level

Medium

### Address

Operational Maturity, Reliability, Security

### Compliance Standards

CBP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step-by-step instructions to remediate the issue of Cloud CDN Backend Buckets caching only static content in GCP using GCP Console:

        1. Open the GCP Console and navigate to the Cloud Storage section.
        2. Click on the checkbox next to the name of the bucket that you want to configure.
        3. Click on the "Edit bucket permissions" button at the top of the page.
        4. Under the "Bucket Policy Only" section, click on the "Add members" button.
        5. In the "New members" field, enter the email address of the service account that you want to use for your Cloud CDN backend bucket.
        6. In the "Select a role" drop-down menu, select "Storage Object Viewer".
        7. Click on the "Add" button to add the service account to the bucket's IAM policy.
        8. Navigate to the Cloud CDN section of the GCP Console.
        9. Click on the checkbox next to the name of the Cloud CDN backend bucket that you want to configure.
        10. Click on the "Edit" button at the top of the page.
        11. Under the "Cache settings" section, select the "Cache everything" option.
        12. Under the "Cache control" section, select the "Override" option.
        13. Under the "Static content caching" section, select the "Custom" option.
        14. In the "Static content caching" field, enter the file extensions for the static content that you want to cache (e.g., .html, .css, .js, .jpg, .png).
        15. Click on the "Save" button to save the changes.

        After following these steps, your Cloud CDN backend bucket will cache only static content as required.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Cloud CDN Backend Buckets Should Cache Only Static Content" for GCP using GCP CLI, follow the below steps:

        1. Open the GCP console and navigate to the Cloud Storage page.
        2. Select the bucket that you want to configure for static content caching.
        3. Click on the "Edit bucket permissions" button.
        4. In the "Add members" section, add the Cloud CDN service account by typing "[cloud-cdn@google.com](mailto:cloud-cdn@google.com)".
        5. Select the "Storage Object Viewer" role from the dropdown list.
        6. Click on the "Add" button to save the changes.
        7. Open the Cloud CDN page and select the CDN resource that is associated with the bucket.
        8. Click on the "Edit" button to open the configuration page.
        9. In the "Backend configuration" section, click on the "Edit backend" button.
        10. In the "Backend bucket" section, select the bucket that you want to configure for static content caching.
        11. Scroll down to the "Cache settings" section and select the "Static content only" option.
        12. Click on the "Save" button to apply the changes.

        By following these steps, you have successfully remediated the misconfiguration "Cloud CDN Backend Buckets Should Cache Only Static Content" for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Cloud CDN Backend Buckets Should Cache Only Static Content" for GCP using Python, you can follow the below steps:

        Step 1: Install the required Python libraries

        ```python theme={null}
        !pip install google-cloud-storage google-auth google-auth-oauthlib google-auth-httplib2
        ```

        Step 2: Authenticate to GCP

        ```python theme={null}
        from google.oauth2 import service_account

        credentials = service_account.Credentials.from_service_account_file('path/to/service_account.json')
        ```

        Step 3: Import the required libraries

        ```python theme={null}
        from google.cloud import storage
        ```

        Step 4: Create a function to check if an object in the bucket is static or not

        ```python theme={null}
        def is_static_object(bucket_name, object_name):
            """Check if an object in the bucket is static or not"""
            static_extensions = ['.html', '.css', '.js', '.png', '.jpg', '.jpeg', '.gif', '.bmp', '.ico', '.pdf', '.svg', '.woff', '.woff2', '.ttf', '.eot', '.json']
            extension = object_name.split('.')[-1]
            if extension in static_extensions:
                return True
            else:
                return False
        ```

        Step 5: Create a function to update the bucket's default cache control policy

        ```python theme={null}
        def update_cache_control_policy(bucket_name):
            """Update the bucket's default cache control policy"""
            storage_client = storage.Client(credentials=credentials)
            bucket = storage_client.get_bucket(bucket_name)
            bucket.default_object_acl.loaded = False
            bucket.default_object_acl.save()
            for blob in bucket.list_blobs():
                if is_static_object(bucket_name, blob.name):
                    blob.cache_control = 'public, max-age=31536000'
                else:
                    blob.cache_control = 'no-cache, no-store, must-revalidate'
                blob.patch()
        ```

        Step 6: Call the function to update the cache control policy for the bucket

        ```python theme={null}
        update_cache_control_policy('your-bucket-name')
        ```

        Note: Replace 'your-bucket-name' with the name of your GCP bucket.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/cdn/docs/caching#cache-modes](https://cloud.google.com/cdn/docs/caching#cache-modes)