​
More Info:

Load Balancers global backend services should use only the secure listeners. A listener is a process that checks for connection requests, using the protocol and port that you configure.

​
Risk Level

High

​
Address

Security

​
Compliance Standards

SOC2

​
Remediation

​
Using Console

Sure, here are the step by step instructions to remediate the misconfiguration “Load Balancers Global Backend Services Should Use Secure Listeners” for GCP using GCP console:

  1. Open the GCP console and navigate to the Load Balancing page.

  2. Click on the name of the load balancer that you want to modify.

  3. Click on the “Backend Services” tab.

  4. Select the backend service that you want to modify.

  5. Click on the “Edit” button.

  6. Scroll down to the “Backend” section and click on the “Add Backend” button.

  7. In the “New Backend” dialog box, enter the IP address or hostname of the backend server that you want to add.

  8. Select the protocol that you want to use for the backend service. Make sure to choose a secure protocol such as HTTPS or SSL.

  9. Enter the port number that the backend server is listening on.

  10. Click on the “Create” button to add the new backend server to the backend service.

  11. Repeat steps 6-10 for each backend server that you want to add.

  12. Once you have added all the backend servers, click on the “Save” button to save the changes to the backend service.

  13. Repeat steps 4-12 for each backend service that you want to modify.

By following these steps, you can remediate the misconfiguration “Load Balancers Global Backend Services Should Use Secure Listeners” for GCP using GCP console.

​
Using CLI

To remediate the misconfiguration “Load Balancers Global Backend Services Should Use Secure Listeners” for GCP using GCP CLI, follow these steps:

  1. Open the Cloud Shell in your GCP console.

  2. Run the following command to list all the backend services in your project:

    gcloud compute backend-services list

  3. Identify the backend service that is not using secure listeners.

  4. Run the following command to update the backend service with a secure listener:

    gcloud compute backend-services update [BACKEND_SERVICE_NAME] --global --protocol HTTPS --port-name https --timeout 30s

    Replace [BACKEND_SERVICE_NAME] with the name of the backend service that you identified in step 3.

  5. Verify that the backend service has been updated with a secure listener by running the following command:

    gcloud compute backend-services describe [BACKEND_SERVICE_NAME]

    This command should display the details of the updated backend service, including the secure listener.

  6. Repeat steps 3 to 5 for all the backend services in your project that are not using secure listeners.

  7. Finally, verify that the misconfiguration has been remediated by running the appropriate scans or audits.

​
Using Python

To remediate the misconfiguration “Load Balancers Global Backend Services Should Use Secure Listeners” for GCP using python, you can follow the below steps:

Step 1: Import the necessary libraries:

from googleapiclient.discovery import build
from google.oauth2 import service_account

Step 2: Set up the credentials:

creds = service_account.Credentials.from_service_account_file('<path_to_service_account_key_file>')
project_id = '<your_project_id>'

Step 3: Create a function to get the list of backend services:

def get_backend_services(compute, project_id):
    result = compute.backendServices().list(project=project_id).execute()
    backend_services = result['items'] if 'items' in result else None
    return backend_services

Step 4: Create a function to update the backend services to use secure listeners:

def update_backend_service(compute, project_id, backend_service):
    backend_service_name = backend_service['name']
    backend_service_url_map = backend_service['backends'][0]['group']
    backend_service_port = backend_service['backends'][0]['balancingMode']['utilization']['defaultBackendService']
    backend_service_protocol = backend_service['protocol']
    if backend_service_protocol == 'HTTP':
        backend_service_protocol = 'HTTPS'
    else:
        return
    request_body = {
        'name': backend_service_name,
        'backends': [
            {
                'group': backend_service_url_map,
                'balancingMode': 'UTILIZATION',
                'maxUtilization': 0.8,
                'capacityScaler': 1,
                'failover': False,
                'port': backend_service_port
            }
        ],
        'protocol': backend_service_protocol,
        'timeoutSec': 30
    }
    compute.backendServices().update(project=project_id, backendService=backend_service_name, body=request_body).execute()

Step 5: Call the functions to update the backend services:

compute = build('compute', 'v1', credentials=creds)
backend_services = get_backend_services(compute, project_id)
for backend_service in backend_services:
    update_backend_service(compute, project_id, backend_service)

This will update all the backend services to use secure listeners in your GCP project.

​
Additional Reading: