> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Right Health Check Configurations Should Be Used For Load Balancer Global Health Checks ### More Info: Improve the reliability of the applications behind your Load Balancer by using the appropriate health check configuration. ### Risk Level Medium ### Address Reliability, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of "Right Health Check Configurations Should Be Used For Load Balancer Global Health Checks" for GCP using GCP console, follow these steps: 1. Open the Google Cloud Console and navigate to the Load Balancing page. 2. Select the Load Balancer for which you want to configure the Health Check. 3. In the left-hand navigation menu, click on the "Health Checks" option. 4. Click on the "Create Health Check" button. 5. In the "Create a Health Check" dialog box, select the appropriate protocol for your application. 6. Configure the "Request Path" field with the correct path to the application's health check endpoint. 7. Configure the "Port" field with the port number on which the application is listening. 8. Set the "Check Interval" and "Timeout" values to appropriate values based on your application's requirements. 9. Configure the "Healthy Threshold" and "Unhealthy Threshold" values based on the number of successful and unsuccessful health checks required to mark an instance as healthy or unhealthy. 10. Click on the "Create" button to create the Health Check. 11. Once the Health Check is created, go back to the Load Balancer page and select the Load Balancer again. 12. In the left-hand navigation menu, click on the "Backend Services" option. 13. Select the Backend Service for which you want to configure the Health Check. 14. In the "Backend Service Details" page, click on the "Health Check" tab. 15. Click on the "Edit" button. 16. In the "Health Check" dialog box, select the Health Check that you created earlier. 17. Click on the "Save" button to save the changes. By following these steps, you can remediate the misconfiguration of "Right Health Check Configurations Should Be Used For Load Balancer Global Health Checks" for GCP using GCP console. # To remediate the misconfiguration of Right Health Check Configurations Should Be Used For Load Balancer Global Health Checks in GCP using GCP CLI, follow the below steps: 1. Open the Cloud Shell in your GCP console. 2. Run the following command to list all the load balancers in your project: ``` gcloud compute target-pools list ``` 3. Choose the target pool for which you want to configure health checks. 4. Run the following command to configure a health check for the target pool: ``` gcloud compute health-checks create http [HEALTH_CHECK_NAME] --port [PORT_NUMBER] --request-path [REQUEST_PATH] ``` Replace \[HEALTH\_CHECK\_NAME] with the name you want to give to the health check, \[PORT\_NUMBER] with the port number on which the target is listening, and \[REQUEST\_PATH] with the path to the health check page. 5. Run the following command to add the health check to the target pool: ``` gcloud compute target-pools add-health-checks [TARGET_POOL_NAME] --health-check [HEALTH_CHECK_NAME] --global ``` Replace \[TARGET\_POOL\_NAME] with the name of the target pool you want to configure and \[HEALTH\_CHECK\_NAME] with the name of the health check you created in step 4. 6. Verify the health check configuration by running the following command: ``` gcloud compute target-pools get-health [TARGET_POOL_NAME] ``` Replace \[TARGET\_POOL\_NAME] with the name of the target pool you configured in step 5. By following these steps, you can remediate the misconfiguration of Right Health Check Configurations Should Be Used For Load Balancer Global Health Checks in GCP using GCP CLI. To remediate this misconfiguration for GCP using Python, you can follow these steps: 1. First, you need to create a health check object with the correct configurations. Here's an example code: ``` from google.cloud import compute_v1 compute = compute_v1.ComputeClient() # Define the health check configuration health_check_config = { "check_interval_sec": 10, "timeout_sec": 5, "healthy_threshold": 2, "unhealthy_threshold": 2, "type": "HTTP", "http_health_check": { "port": 80, "request_path": "/", "port_name": "http" } } # Create the health check object health_check = { "name": "my-http-health-check", "description": "Health check for HTTP load balancer", "check_interval_sec": health_check_config["check_interval_sec"], "timeout_sec": health_check_config["timeout_sec"], "healthy_threshold": health_check_config["healthy_threshold"], "unhealthy_threshold": health_check_config["unhealthy_threshold"], "type": health_check_config["type"], "http_health_check": health_check_config["http_health_check"] } # Create the health check operation = compute.health_checks().insert( project="my-project", body=health_check ).execute() # Wait for the operation to complete operation_name = operation["name"] operation_status = compute.zone_operations().get( project="my-project", operation=operation_name ).execute()["status"] while operation_status != "DONE": operation_status = compute.zone_operations().get( project="my-project", operation=operation_name ).execute()["status"] ``` 2. Once the health check object is created, you need to update the load balancer to use this new health check. Here's an example code: ``` # Get the load balancer object load_balancer = compute.url_maps().get( project="my-project", urlMap="my-load-balancer" ).execute() # Update the load balancer to use the new health check load_balancer["healthChecks"] = ["my-http-health-check"] # Update the load balancer operation = compute.url_maps().update( project="my-project", urlMap="my-load-balancer", body=load_balancer ).execute() # Wait for the operation to complete operation_name = operation["name"] operation_status = compute.zone_operations().get( project="my-project", operation=operation_name ).execute()["status"] while operation_status != "DONE": operation_status = compute.zone_operations().get( project="my-project", operation=operation_name ).execute()["status"] ``` These steps will create a new health check object with the correct configurations and update the load balancer to use this new health check. ```hcl theme={null} resource "google_compute_health_check" "LOAD_BALANCER_HEALTH_CHECK" { name = "LOAD_BALANCER_HEALTH_CHECK_NAME" # replace with your health check name # Adjust this to your protocol: "http_health_check", "https_health_check", # "tcp_health_check", "ssl_health_check", or "http2_health_check" http_health_check { port = 80 # replace with BACKEND_SERVICE_PORT request_path = "/healthz" # replace with HEALTH_CHECK_PATH } # Core reliability parameters – tune to match your SLOs and any given thresholds check_interval_sec = 5 # how often to probe (seconds) timeout_sec = 5 # how long to wait for a response (seconds) healthy_threshold = 2 # consecutive successes before marking healthy unhealthy_threshold = 2 # consecutive failures before marking unhealthy # Optional: set this if backends must respond quickly # log_config { # enable = true # } } ``` Substitute: * `LOAD_BALANCER_HEALTH_CHECK_NAME` with the desired health check name. * `BACKEND_SERVICE_PORT` with the actual port your backends listen on. * `HEALTH_CHECK_PATH` with an endpoint that accurately reflects application health. This resource is global by default for external/global load balancers. Changes to `check_interval_sec`, `timeout_sec`, `healthy_threshold`, and `unhealthy_threshold` are in-place updates and do not normally force replacement. To verify, `terraform plan` should show updates (or creation) on `google_compute_health_check.LOAD_BALANCER_HEALTH_CHECK` with the desired protocol block and the configured thresholds and timings. ### Additional Reading: * [https://cloud.google.com/load-balancing/docs/health-checks](https://cloud.google.com/load-balancing/docs/health-checks)