More Info:
Load Balancer should not send any new requests to the unhealthy instance if an compute instance fails health checksRisk Level
MediumAddress
Reliability, SecurityCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- DPDPA
- Digital Operational Resilience Act (EU)
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIST CSF
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- SWIFT Customer Security Controls Framework
- Sarbanes-Oxley IT General Controls
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of Load Balancers not having connection draining enabled in Global Backend Services in GCP using GCP console, follow the below steps:
- Login to the GCP console and navigate to the Load Balancing page.
- Select the Load Balancer that needs to be remediated.
- Click on the Edit button to edit the Load Balancer configuration.
- Scroll down to the Backend section and click on the Edit button next to the Global Backend Service.
- In the Global Backend Service configuration, scroll down to the Connection Draining section.
- Enable Connection Draining by checking the box next to it.
- Set the Drain Timeout to the desired value (in seconds) for the load balancer to wait before terminating connections.
- Click on the Save button to save the changes.
- Once the changes are saved, verify that the Load Balancer now has Connection Draining enabled for Global Backend Services.
Using CLI
Using CLI
To remediate the misconfiguration “Load Balancers Should Have Connection Draining Enabled In Global Backend Services” for GCP using GCP CLI, follow the below steps:
- Open the Cloud Shell in the GCP Console.
-
Run the following command to list all the global backend services in your project:
- Identify the backend service that is associated with the load balancer that needs to be updated. Note down the name of the backend service.
-
Run the following command to enable connection draining for the identified backend service:
Replace [BACKEND_SERVICE_NAME] with the name of the backend service identified in step 3 and [TIMEOUT_IN_SECONDS] with the time in seconds that you want to wait for existing connections to drain before terminating them. For example:This command sets the connection draining timeout to 300 seconds (5 minutes).
-
Verify that connection draining is enabled for the backend service by running the following command:
Replace [BACKEND_SERVICE_NAME] with the name of the backend service identified in step 3. The output should show “connectionDraining: true”.
Using Python
Using Python
To remediate the misconfiguration “Load Balancers Should Have Connection Draining Enabled In Global Backend Services” for GCP using python, follow these steps:
-
Install the
google-cloud-load-balancerlibrary using pip by running the following command: -
Import the necessary modules in your python script:
-
Create a client object for the load balancer API:
-
Get the existing global backend services:
-
Loop through the backend services and check if connection draining is enabled. If not, enable it:
In the above code, we are checking if the
draining_timeout_secparameter in theconnection_drainingfield is set to 0. If it is, we create an update request to set it to 300 seconds (5 minutes). -
Run the python script to remediate the misconfiguration.
Note: Replace
remediate_load_balancer_connection_draining.pywith the name of your python script.
Using Terraform
Using Terraform
terraform plan should show an in-place update to google_compute_backend_service.GLOBAL_BACKEND_SERVICE adding or changing the connection_draining.draining_timeout_sec attribute to the desired value.
