Lb Global Instance Groups Use Secure Listeners Remediation

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration "Load Balancers Global Instance Groups Should Use Secure Listeners" for GCP using GCP console, follow the below steps:

Open the GCP console and navigate to the Load Balancing page.
Select the Load Balancer that you want to remediate.
In the Load Balancer details page, click on the Edit button.
In the Edit Load Balancer page, click on the Frontend Configuration tab.
In the Frontend Configuration tab, for each protocol (HTTP and HTTPS), select the HTTPS protocol and click on the Create button.
In the Create Frontend IP and Port page, enter the required details such as Name, IP address, and Port number.
In the Protocol section, select HTTPS and click on the Done button.
Repeat steps 5 to 7 for all the protocols that are being used by the Load Balancer.
Once all the protocols have been configured with HTTPS, click on the Update button to save the changes.
Verify that the Load Balancer is now using secure listeners by accessing the Load Balancer URL using HTTPS protocol.

By following the above steps, you can remediate the misconfiguration "Load Balancers Global Instance Groups Should Use Secure Listeners" for GCP using GCP console.

Using CLI

To remediate the misconfiguration "Load Balancers Global Instance Groups Should Use Secure Listeners" for GCP using GCP CLI, follow the steps below:

Open the Cloud Shell in your GCP console.
Use the following command to list all the global forwarding rules in your project:
```
gcloud compute forwarding-rules list
```
Identify the global forwarding rule that is associated with the load balancer for which you want to enable secure listeners.
Use the following command to update the global forwarding rule to use HTTPS as the protocol:
```
gcloud compute forwarding-rules update [FORWARDING_RULE_NAME] --global --protocol HTTPS
```
Replace [FORWARDING_RULE_NAME] with the name of the global forwarding rule that you identified in step 3.
Use the following command to update the global forwarding rule to use a valid SSL certificate:
```
gcloud compute ssl-certificates create [CERTIFICATE_NAME] --certificate [CERTIFICATE_FILE_PATH] --private-key [PRIVATE_KEY_FILE_PATH]
```
Replace [CERTIFICATE_NAME] with a name for your SSL certificate, [CERTIFICATE_FILE_PATH] with the path to your SSL certificate file, and [PRIVATE_KEY_FILE_PATH] with the path to your SSL private key file.
Use the following command to update the global forwarding rule to use the SSL certificate:
```
gcloud compute target-https-proxies update [TARGET_PROXY_NAME] --ssl-certificates [CERTIFICATE_NAME]
```
Replace [TARGET_PROXY_NAME] with the name of the target HTTPS proxy associated with the global forwarding rule.
Verify that the global forwarding rule is now using HTTPS as the protocol and a valid SSL certificate.
```
gcloud compute forwarding-rules describe [FORWARDING_RULE_NAME] --global
```
Replace [FORWARDING_RULE_NAME] with the name of the global forwarding rule that you updated in step 4.

By following these steps, you have successfully remediated the misconfiguration "Load Balancers Global Instance Groups Should Use Secure Listeners" for GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Load Balancers Global Instance Groups Should Use Secure Listeners" in GCP using Python, you can follow the below steps:

Import the necessary libraries:

from googleapiclient.discovery import build
from oauth2client.client import GoogleCredentials

Authenticate with GCP using the below code:

credentials = GoogleCredentials.get_application_default()
service = build('compute', 'v1', credentials=credentials)

Get a list of all the global forwarding rules:

project = 'PROJECT_NAME'
global_forwarding_rules = service.globalForwardingRules().list(project=project).execute()

Loop through the list of global forwarding rules and check if they are using HTTPS as the protocol:

for forwarding_rule in global_forwarding_rules['items']:
    if forwarding_rule['IPProtocol'] == 'TCP' and forwarding_rule['portRange'] == '443':
        # HTTPS is being used as the protocol, so no action is needed
        continue
    else:
        # HTTPS is not being used as the protocol, so update the forwarding rule to use HTTPS
        forwarding_rule_url = forwarding_rule['selfLink']
        forwarding_rule_name = forwarding_rule_url.split('/')[-1]
        forwarding_rule_body = {
            'IPProtocol': 'TCP',
            'portRange': '443'
        }
        service.globalForwardingRules().patch(project=project, forwardingRule=forwarding_rule_name, body=forwarding_rule_body).execute()

This code will update the global forwarding rules to use HTTPS as the protocol. You can run this code periodically to ensure that any new global forwarding rules are also updated to use HTTPS.

Note: Make sure to replace the PROJECT_NAME with your actual project name.

Using Terraform

# Global managed instance group (backend)
resource "google_compute_instance_group_manager" "WEB_GLOBAL_MIG" {
  name               = "WEB_GLOBAL_MIG"
  base_instance_name = "WEB_INSTANCE_BASE_NAME"
  instance_template  = google_compute_instance_template.WEB_TEMPLATE.self_link
  target_size        = 3

  named_port {
    name = "http"
    port = 80
  }
}

resource "google_compute_instance_template" "WEB_TEMPLATE" {
  name_prefix = "WEB_TEMPLATE_PREFIX"

  machine_type = "e2-medium"

  disk {
    source_image = "projects/debian-cloud/global/images/family/debian-12"
    boot         = true
    auto_delete  = true
  }

  network_interface {
    # Replace with your VPC/subnet
    network    = "default"
    subnetwork = "SUBNETWORK_SELF_LINK"
  }

  metadata = {
    # App still listens on 80; the *listener* exposed to the internet will be HTTPS.
    startup-script = "STARTUP_SCRIPT_CONTENT"
  }
}

# Backend service using the global managed instance group
resource "google_compute_backend_service" "WEB_BACKEND" {
  name                            = "WEB_BACKEND"
  load_balancing_scheme           = "EXTERNAL_MANAGED"
  protocol                        = "HTTP"
  port_name                       = "http"
  timeout_sec                     = 30
  enable_cdn                      = false
  connection_draining_timeout_sec = 0

  backend {
    group = google_compute_instance_group_manager.WEB_GLOBAL_MIG.instance_group
  }

  health_checks = [google_compute_health_check.WEB_HEALTHCHECK.self_link]
}

resource "google_compute_health_check" "WEB_HEALTHCHECK" {
  name = "WEB_HEALTHCHECK"

  http_health_check {
    port = 80
    request_path = "/"
  }
}

# URL map for HTTPS load balancer
resource "google_compute_url_map" "WEB_URL_MAP" {
  name            = "WEB_URL_MAP"
  default_service = google_compute_backend_service.WEB_BACKEND.self_link
}

# SSL certificate for HTTPS listener
resource "google_compute_managed_ssl_certificate" "WEB_SSL_CERT" {
  name = "WEB_SSL_CERT"

  managed {
    domains = ["YOUR_DOMAIN_NAME"]
  }
}

# HTTPS target proxy – this is the *secure listener* front-end
resource "google_compute_target_https_proxy" "WEB_HTTPS_PROXY" {
  name            = "WEB_HTTPS_PROXY"
  url_map         = google_compute_url_map.WEB_URL_MAP.self_link
  ssl_certificates = [
    google_compute_managed_ssl_certificate.WEB_SSL_CERT.self_link
  ]
}

# Global forwarding rule exposing ONLY HTTPS (secure listener)
resource "google_compute_global_forwarding_rule" "WEB_HTTPS_FORWARDING_RULE" {
  name                  = "WEB_HTTPS_FORWARDING_RULE"
  load_balancing_scheme = "EXTERNAL_MANAGED"
  port_range            = "443"
  ip_protocol           = "TCP"
  target                = google_compute_target_https_proxy.WEB_HTTPS_PROXY.self_link
  ip_address            = google_compute_global_address.WEB_LB_IP.address
}

# Static IP for the HTTPS load balancer
resource "google_compute_global_address" "WEB_LB_IP" {
  name = "WEB_LB_IP"
}

If you currently have an insecure listener (for example, a google_compute_global_forwarding_rule pointing at a google_compute_target_http_proxy on port 80), remove those HTTP resources from Terraform so that only the HTTPS forwarding rule and HTTPS proxy remain; this enforces “only secure listeners”.

This change will replace the existing HTTP target proxy and HTTP forwarding rule (and their public entrypoint) if you remove them from Terraform, but it does not force replacement of the instance group or backend service.

Verification: terraform plan should show creation (or update) of google_compute_target_https_proxy, google_compute_managed_ssl_certificate, and a google_compute_global_forwarding_rule on port 443, and removal of any google_compute_target_http_proxy / HTTP google_compute_global_forwarding_rule so that only HTTPS listeners remain.

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation