Skip to main content

Cloud CDN Global Backend Services Failover Policy Should Be

More Info:​

Ensure Cloud CDN global backend services have failover policy enabled.

Risk Level​

High

Address​

Operational Maturity, Performance Efficiency, Reliability, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration "Cloud CDN Global Backend Services Failover Policy Should Be Enabled" in GCP, please follow the below steps:

  1. Login to the GCP console (https://console.cloud.google.com/).
  2. Go to the Cloud CDN page by navigating to the "Navigation menu > Network Services > Cloud CDN".
  3. Select the CDN resource for which you want to enable the failover policy.
  4. Under the "Backend configuration" section, click on the "Edit" button.
  5. Scroll down to the "Failover policy" section and click on the "Add failover endpoint" button.
  6. Enter the details of the failover endpoint, such as the IP address, port, and protocol.
  7. Click on the "Save" button to save the changes.

With these steps, you have successfully enabled the failover policy for the selected CDN resource in GCP.

Using CLI

To remediate the misconfiguration "Cloud CDN Global Backend Services Failover Policy Should Be Enabled" for GCP using GCP CLI, follow the below steps:

  1. Open the Google Cloud Console and select the project in which you want to remediate the misconfiguration.

  2. Open the Cloud Shell by clicking on the icon on the top right corner of the console.

  3. In the Cloud Shell, run the following command to list the existing backend services:

gcloud compute backend-services list

  1. Identify the backend service that is associated with the Cloud CDN.

  2. Run the following command to enable the failover policy for the identified backend service:

gcloud compute backend-services update [BACKEND_SERVICE_NAME] --global-backend-service --failover-policy=ENABLE

Replace [BACKEND_SERVICE_NAME] with the name of the identified backend service.

  1. Verify that the failover policy is enabled by running the following command:
gcloud compute backend-services describe [BACKEND_SERVICE_NAME] --global

This command will display the details of the backend service, including the failover policy status.

By following these steps, you can remediate the misconfiguration "Cloud CDN Global Backend Services Failover Policy Should Be Enabled" for GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Cloud CDN Global Backend Services Failover Policy Should Be Enabled" for GCP using Python, follow the below steps:

Step 1: Import the required libraries and authenticate to GCP.

from google.oauth2 import service_account
from googleapiclient.discovery import build

# Set the credentials path for GCP
credentials = service_account.Credentials.from_service_account_file('credentials.json')

# Authenticate to GCP
service = build('compute', 'v1', credentials=credentials)

Step 2: Get the list of global backend services.

# Get the list of global backend services
backend_services = service.backendServices().list(project='your-project-id').execute()

Step 3: Loop through the backend services and check if the failover policy is enabled. If not, enable it.

for backend_service in backend_services['items']:
    # Check if failover policy is enabled
    if 'failoverPolicy' not in backend_service:
        # Enable failover policy
        backend_service['failoverPolicy'] = {
            'disableConnectionDrainOnFailover': False,
            'dropTrafficIfUnhealthy': False,
            'failoverRatio': 0.5,
            'status': 'ENABLED'
        }
        # Update the backend service with the failover policy
        service.backendServices().patch(project='your-project-id', backendService=backend_service['name'], body=backend_service).execute()

Step 4: Verify if the failover policy is enabled for all the global backend services.

# Get the list of global backend services after enabling failover policy
backend_services = service.backendServices().list(project='your-project-id').execute()

# Loop through the backend services and verify if failover policy is enabled
for backend_service in backend_services['items']:
    if 'failoverPolicy' not in backend_service:
        print(f"Failover policy is not enabled for {backend_service['name']}")
    else:
        print(f"Failover policy is enabled for {backend_service['name']}")

By following these steps, the misconfiguration "Cloud CDN Global Backend Services Failover Policy Should Be Enabled" can be remediated for GCP using Python.

Using Terraform
resource "google_compute_backend_service" "GLOBAL_BACKEND_SERVICE" {
  name                  = "GLOBAL_BACKEND_SERVICE_NAME"   # replace with your backend service name
  protocol              = "HTTP"                          # or HTTPS/HTTP2 as appropriate
  load_balancing_scheme = "EXTERNAL"                      # global external HTTP(S) LB

  # ... your existing backend definitions, health checks, etc. ...

  failover_policy {
    # Set this to the ratio of healthy primary backends below which traffic
    # should start failing over to the backup backends.
    failover_ratio = FAILOVER_RATIO                      # replace with a value between 0.0 and 1.0

    # Optional, but commonly desired with failover:
    drop_traffic_if_unhealthy = true
    # disable_connection_drain_on_failover = false       # optional, set per your requirements
  }
}

If you are instead using a regional backend service for Cloud CDN, apply the same failover_policy block to a google_compute_region_backend_service resource.

This change is an in-place update (no resource replacement). terraform plan should show the backend service being updated to add (or modify) the failover_policy block with the specified failover_ratio and flags.

Additional Reading:​