Skip to main content

Cloud CDN Backend Buckets Should Enable Negative Caching

More Info:​

Ensure Cloud CDN backend buckets enable negative caching for better performance.

Risk Level​

Medium

Address​

Operational Maturity, Reliability, Security

Compliance Standards​

  • Cloudanix Best Practice

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration "Cloud CDN Backend Buckets Should Enable Negative Caching" for GCP using GCP Console, you can follow these step-by-step instructions:

  1. Open the Google Cloud Console and go to the Cloud Storage Browser page.

  2. Select the bucket that you want to configure for negative caching.

  3. Click on the "Edit bucket permissions" button.

  4. In the "Add members" field, enter "allUsers" and select the "Storage Object Viewer" role.

  5. Click on the "Add" button to save the changes.

  6. Go to the Cloud CDN page in the GCP Console.

  7. Select the CDN resource that is associated with the backend bucket.

  8. Click on the "Edit" button.

  9. In the "Backend configuration" section, click on the "Advanced" tab.

  10. Check the "Enable negative caching" checkbox.

  11. Set the "Negative caching TTL" value to the desired time in seconds.

  12. Click on the "Save" button to save the changes.

  13. Verify that the negative caching is enabled by sending a request to the CDN resource and checking the response headers.

By following these steps, you can remediate the misconfiguration "Cloud CDN Backend Buckets Should Enable Negative Caching" for GCP using GCP Console.

Using CLI

To remediate the misconfiguration "Cloud CDN Backend Buckets Should Enable Negative Caching" in GCP, follow these steps:

  1. Open the Google Cloud Console and navigate to the Cloud Storage page.
  2. Select the bucket that is being used as a backend bucket for Cloud CDN.
  3. Click on the "Edit Bucket" button.
  4. Under the "Lifecycle" tab, click on the "Add Rule" button.
  5. In the "Add Lifecycle Rule" dialog box, set the following parameters:
    • Rule Name: Enable Negative Caching
    • Action: Set storage class to "Regional"
    • Frequency: Choose an appropriate frequency for your use case
    • Conditions: Add a condition that matches the objects that should be cached with negative caching. For example, you can use the "Age" condition and set it to "is greater than" with a value of "0".
  6. Click on the "Save" button to add the lifecycle rule to the bucket.
  7. Verify that the lifecycle rule was added by checking the "Lifecycle" tab of the bucket.

Alternatively, you can use the GCP CLI to add the lifecycle rule to the bucket. Here's an example command:

gsutil lifecycle set lifecycle.json gs://[BUCKET_NAME]

Where "lifecycle.json" is a JSON file that contains the lifecycle rule definition, and "[BUCKET_NAME]" is the name of the bucket being used as a backend bucket for Cloud CDN. Here's an example JSON file:

{
  "lifecycle": {
    "rule": [
      {
        "action": {"type": "SetStorageClass", "storageClass": "REGIONAL"},
        "condition": {"age": 0, "matchesStorageClass": ["REGIONAL"]},
        "description": "Enable negative caching for Cloud CDN"
      }
    ]
  }
}

This JSON file sets the storage class to "Regional" for objects that match the condition "age is greater than 0" and "matchesStorageClass is REGIONAL". The "description" field is optional and can be used to provide additional information about the rule.

Using Python

None

Using Terraform
resource "google_compute_backend_bucket" "cdn_backend_bucket" {
  name        = "BACKEND_BUCKET_NAME"          # replace with your backend bucket name
  bucket_name = "GCS_BUCKET_NAME"              # replace with the GCS bucket backing this CDN
  project     = "GCP_PROJECT_ID"               # replace with your GCP project ID

  enable_cdn = true

  cdn_policy {
    # Enable negative caching so CDN caches HTTP 4xx/5xx responses
    negative_caching = true

    # Optional: override default negative cache TTLs per status code
    # Remove or adjust these blocks as needed.
    negative_caching_policy {
      code = 404
      ttl  = 300  # cache 404s for 5 minutes
    }

    negative_caching_policy {
      code = 500
      ttl  = 60   # cache 500s for 1 minute
    }
  }
}

This change updates the backend bucket in place; it does not force replacement of the resource.

To verify, terraform plan should show an in-place update (~) to google_compute_backend_bucket.cdn_backend_bucket with cdn_policy.0.negative_caching changing from false (or null) to true and any specified negative_caching_policy blocks being added.

Additional Reading:​