> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Cdn backend buckets enable negative caching remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Cloud CDN Backend Buckets Should Enable Negative Caching" for GCP using GCP Console, you can follow these step-by-step instructions:

        1. Open the Google Cloud Console and go to the Cloud Storage Browser page.

        2. Select the bucket that you want to configure for negative caching.

        3. Click on the "Edit bucket permissions" button.

        4. In the "Add members" field, enter "allUsers" and select the "Storage Object Viewer" role.

        5. Click on the "Add" button to save the changes.

        6. Go to the Cloud CDN page in the GCP Console.

        7. Select the CDN resource that is associated with the backend bucket.

        8. Click on the "Edit" button.

        9. In the "Backend configuration" section, click on the "Advanced" tab.

        10. Check the "Enable negative caching" checkbox.

        11. Set the "Negative caching TTL" value to the desired time in seconds.

        12. Click on the "Save" button to save the changes.

        13. Verify that the negative caching is enabled by sending a request to the CDN resource and checking the response headers.

        By following these steps, you can remediate the misconfiguration "Cloud CDN Backend Buckets Should Enable Negative Caching" for GCP using GCP Console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Cloud CDN Backend Buckets Should Enable Negative Caching" in GCP, follow these steps:

        1. Open the Google Cloud Console and navigate to the Cloud Storage page.
        2. Select the bucket that is being used as a backend bucket for Cloud CDN.
        3. Click on the "Edit Bucket" button.
        4. Under the "Lifecycle" tab, click on the "Add Rule" button.
        5. In the "Add Lifecycle Rule" dialog box, set the following parameters:
           * Rule Name: Enable Negative Caching
           * Action: Set storage class to "Regional"
           * Frequency: Choose an appropriate frequency for your use case
           * Conditions: Add a condition that matches the objects that should be cached with negative caching. For example, you can use the "Age" condition and set it to "is greater than" with a value of "0".
        6. Click on the "Save" button to add the lifecycle rule to the bucket.
        7. Verify that the lifecycle rule was added by checking the "Lifecycle" tab of the bucket.

        Alternatively, you can use the GCP CLI to add the lifecycle rule to the bucket. Here's an example command:

        ```
        gsutil lifecycle set lifecycle.json gs://[BUCKET_NAME]
        ```

        Where "lifecycle.json" is a JSON file that contains the lifecycle rule definition, and "\[BUCKET\_NAME]" is the name of the bucket being used as a backend bucket for Cloud CDN. Here's an example JSON file:

        ```
        {
          "lifecycle": {
            "rule": [
              {
                "action": {"type": "SetStorageClass", "storageClass": "REGIONAL"},
                "condition": {"age": 0, "matchesStorageClass": ["REGIONAL"]},
                "description": "Enable negative caching for Cloud CDN"
              }
            ]
          }
        }
        ```

        This JSON file sets the storage class to "Regional" for objects that match the condition "age is greater than 0" and "matchesStorageClass is REGIONAL". The "description" field is optional and can be used to provide additional information about the rule.
      </Accordion>

      <Accordion title="Using Python">
        None
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_compute_backend_bucket" "cdn_backend_bucket" {
          name        = "BACKEND_BUCKET_NAME"          # replace with your backend bucket name
          bucket_name = "GCS_BUCKET_NAME"              # replace with the GCS bucket backing this CDN
          project     = "GCP_PROJECT_ID"               # replace with your GCP project ID

          enable_cdn = true

          cdn_policy {
            # Enable negative caching so CDN caches HTTP 4xx/5xx responses
            negative_caching = true

            # Optional: override default negative cache TTLs per status code
            # Remove or adjust these blocks as needed.
            negative_caching_policy {
              code = 404
              ttl  = 300  # cache 404s for 5 minutes
            }

            negative_caching_policy {
              code = 500
              ttl  = 60   # cache 500s for 1 minute
            }
          }
        }
        ```

        This change updates the backend bucket in place; it does not force replacement of the resource.

        To verify, `terraform plan` should show an in-place update (`~`) to `google_compute_backend_bucket.cdn_backend_bucket` with `cdn_policy.0.negative_caching` changing from `false` (or null) to `true` and any specified `negative_caching_policy` blocks being added.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>