> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Cloud CDN Regional Backend Services Failover Policy Should Be Enabled ### More Info: Ensure Cloud CDN regional backend services have failover policy enabled. ### Risk Level High ### Address Operational Maturity, Performance Efficiency, Reliability, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "Cloud CDN Regional Backend Services Failover Policy Should Be Enabled" for GCP using GCP console, please follow the below steps: 1. Open the GCP console and navigate to the Cloud CDN page. 2. Select the CDN endpoint you want to remediate. 3. Click on the "Edit" button at the top of the page. 4. Scroll down to the "Backend services" section and click on the "Edit" button next to it. 5. Click on the "Advanced" tab. 6. Under "Failover policy", select the "Enabled" option. 7. Click on the "Save" button to save the changes. By enabling the failover policy, the CDN endpoint will automatically switch to a backup backend service if the primary service becomes unavailable. This will ensure that your users continue to have access to your content even in the event of a backend service failure. # To remediate the misconfiguration "Cloud CDN Regional Backend Services Failover Policy Should Be Enabled" for GCP using GCP CLI, follow the below steps: 1. Open the GCP Cloud Shell in the GCP Console. 2. Run the following command to enable the failover policy for the regional backend services in Cloud CDN: ``` gcloud compute backend-services update [BACKEND_SERVICE_NAME] --failover-policy=ALL_OR_FAIL ``` Replace `[BACKEND_SERVICE_NAME]` with the name of the backend service that you want to update. 3. Verify that the failover policy has been enabled by running the following command: ``` gcloud compute backend-services describe [BACKEND_SERVICE_NAME] | grep failoverPolicy ``` This command should output the failover policy for the backend service. Note: If the output shows that the failover policy is not enabled, you may need to wait a few minutes for the changes to propagate. 4. Repeat steps 2 and 3 for all the regional backend services in Cloud CDN. Note: You can list all the regional backend services in Cloud CDN by running the following command: ``` gcloud compute backend-services list --filter="loadBalancingScheme=EXTERNAL && protocol=HTTP && backends.service=cdn-backend" ``` This command lists all the regional backend services that are used by Cloud CDN. Replace `cdn-backend` with the name of the backend service that you want to filter. By following these steps, you can remediate the misconfiguration "Cloud CDN Regional Backend Services Failover Policy Should Be Enabled" for GCP using GCP CLI. To remediate the misconfiguration "Cloud CDN Regional Backend Services Failover Policy Should Be Enabled" in GCP using Python, follow these steps: 1. Import the necessary libraries: ```python theme={null} from googleapiclient.discovery import build from google.oauth2 import service_account ``` 2. Set up credentials: ```python theme={null} credentials = service_account.Credentials.from_service_account_file( 'path/to/service_account.json') ``` 3. Create a client object for the Cloud CDN API: ```python theme={null} cdn = build('cdn', 'v1beta2', credentials=credentials) ``` 4. Get the list of existing backend services: ```python theme={null} project_id = 'your-project-id' backend_services = cdn.projects().backendServices().list(project=project_id).execute() ``` 5. For each backend service, check if the failover policy is enabled. If not, enable it: ```python theme={null} for backend_service in backend_services['items']: backend_service_name = backend_service['name'] backend_service_region = backend_service['region'] backend_service_config = cdn.projects().backendServices().get(project=project_id, backendService=backend_service_name).execute() if 'failoverPolicy' not in backend_service_config: failover_policy = { 'disableConnectionDrainOnFailover': False, 'dropTrafficIfUnhealthy': False, 'failoverRatio': 0.5 } cdn.projects().backendServices().patch(project=project_id, backendService=backend_service_name, body={'failoverPolicy': failover_policy}).execute() ``` 6. Verify that the failover policy has been enabled for all backend services. This code will enable the failover policy for all backend services in your GCP project. You can run this code periodically to ensure that the failover policy remains enabled for all backend services. ```hcl theme={null} resource "google_compute_region_backend_service" "cdn_backend" { name = "CDN_BACKEND_SERVICE_NAME" # replace with your backend service name region = "GCP_REGION" # replace with the region (e.g., us-central1) protocol = "HTTP" load_balancing_scheme = "EXTERNAL_MANAGED" health_checks = [google_compute_health_check.cdn_hc.self_link] # Primary backend backend { group = google_compute_region_network_endpoint_group.primary_neg.self_link balancing_mode = "UTILIZATION" capacity_scaler = 1.0 failover = false } # Failover backend backend { group = google_compute_region_network_endpoint_group.failover_neg.self_link balancing_mode = "UTILIZATION" capacity_scaler = 1.0 failover = true } # Enable failover policy and set the threshold failover_policy { # Set to true so traffic is failed over when the primary backends are unhealthy drop_traffic_if_unhealthy = true # Replace with your desired ratio (0.0–1.0), e.g., 0.5 for 50% failover_ratio = FAILOVER_RATIO } } resource "google_compute_health_check" "cdn_hc" { name = "CDN_HEALTH_CHECK_NAME" # replace with your health check name http_health_check { port = 80 } } resource "google_compute_region_network_endpoint_group" "primary_neg" { name = "PRIMARY_NEG_NAME" # replace with your primary NEG name region = "GCP_REGION" network_endpoint_type = "SERVERLESS" cloud_run { service = "PRIMARY_CLOUD_RUN_SERVICE_NAME" # replace with primary service } } resource "google_compute_region_network_endpoint_group" "failover_neg" { name = "FAILOVER_NEG_NAME" # replace with your failover NEG name region = "GCP_REGION" network_endpoint_type = "SERVERLESS" cloud_run { service = "FAILOVER_CLOUD_RUN_SERVICE_NAME" # replace with failover service } } ``` This change updates the existing `google_compute_region_backend_service` in place; it does not force resource replacement, so no outage is expected if backends and health checks are correctly configured. Verification with `terraform plan` should show an in-place update of `google_compute_region_backend_service.cdn_backend` adding or modifying the `backend` blocks (with `failover = true` on the failover backend) and the `failover_policy` block (with your `failover_ratio`). ### Additional Reading: * [https://cloud.google.com/cdn/docs/overview](https://cloud.google.com/cdn/docs/overview)