> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Lb global url maps accept https connections remediation ### Triage and Remediation ### Remediation To remediate the misconfiguration of Load Balancer Global Urlmaps should accept HTTPS connections in GCP, you can follow the below steps: 1. Login to your GCP console and select the project where the misconfiguration exists. 2. Go to the Navigation menu and select Networking -> Network services -> Load balancing. 3. Select the Load balancer where the misconfiguration exists. 4. Click on the Edit button at the top of the page. 5. In the Edit Load Balancer page, scroll down to the Backend configuration section. 6. Click on the Backend services link. 7. Select the backend service where the misconfiguration exists. 8. In the Backend service page, scroll down to the Backend configuration section. 9. Click on the Edit button next to the backend configuration. 10. In the Edit backend configuration page, scroll down to the Protocol section. 11. Select the HTTPS option from the dropdown list. 12. Click on the Save button to save the changes. Once the above steps are completed, the Load Balancer Global Urlmaps will accept HTTPS connections. # To remediate the misconfiguration "Load Balancer Global Urlmaps Should Accept Https Connections" in GCP using GCP CLI, follow the below steps: 1. Open the Cloud Shell in the GCP Console. 2. Run the following command to get the list of all the URL maps in the project: ``` gcloud compute url-maps list ``` 3. Identify the URL map that needs to be modified and note down its name. 4. Run the following command to update the URL map to accept HTTPS connections: ``` gcloud compute url-maps update [URL_MAP_NAME] --default-service [SERVICE_NAME] --ssl-certificates [SSL_CERTIFICATE_NAME] ``` Replace \[URL\_MAP\_NAME] with the name of the URL map that needs to be modified, \[SERVICE\_NAME] with the name of the default service associated with the URL map, and \[SSL\_CERTIFICATE\_NAME] with the name of the SSL certificate to be used for HTTPS connections. 5. After running the above command, the URL map will be updated to accept HTTPS connections. You can verify the changes by running the following command: ``` gcloud compute url-maps describe [URL_MAP_NAME] ``` This command will display the updated configuration of the URL map. Note: Before running the above commands, make sure you have the necessary permissions to modify the URL maps in the project. To remediate the misconfiguration of Load Balancer Global Urlmaps not accepting HTTPS connections in GCP using Python, follow the steps below: 1. Import the necessary libraries: ``` from google.cloud import compute_v1 from google.protobuf.json_format import MessageToDict ``` 2. Authenticate to the GCP project: ``` compute_client = compute_v1.ComputeClient() project = "your-project-id" ``` 3. Get the list of URL maps: ``` urlmaps = compute_client.url_maps().list(project=project).execute() ``` 4. Loop through the URL maps and check if HTTPS is enabled: ``` for urlmap in urlmaps.get("items", []): urlmap_name = urlmap["name"] urlmap = compute_client.url_maps().get(project=project, urlMap=urlmap_name).execute() urlmap_dict = MessageToDict(urlmap, preserving_proto_field_name=True) if urlmap_dict.get("hostRules"): for host_rule in urlmap_dict["hostRules"]: if host_rule.get("pathMatcher"): path_matcher = host_rule["pathMatcher"] if path_matcher.get("defaultService"): default_service = path_matcher["defaultService"] if default_service.startswith("https://"): print(f"HTTPS is enabled for URL map {urlmap_name}") else: print(f"HTTPS is not enabled for URL map {urlmap_name}") else: print(f"No default service found for path matcher in URL map {urlmap_name}") else: print(f"No path matcher found for host rule in URL map {urlmap_name}") else: print(f"No host rules found in URL map {urlmap_name}") ``` 5. If HTTPS is not enabled, update the URL map to accept HTTPS connections: ``` urlmap_name = "your-url-map-name" urlmap = compute_client.url_maps().get(project=project, urlMap=urlmap_name).execute() urlmap_dict = MessageToDict(urlmap, preserving_proto_field_name=True) if urlmap_dict.get("hostRules"): for host_rule in urlmap_dict["hostRules"]: if host_rule.get("pathMatcher"): path_matcher = host_rule["pathMatcher"] if path_matcher.get("defaultService"): default_service = path_matcher["defaultService"] if default_service.startswith("http://"): path_matcher["defaultService"] = default_service.replace("http://", "https://") urlmap_body = {"hostRules": urlmap_dict["hostRules"]} compute_client.url_maps().patch(project=project, urlMap=urlmap_name, body=urlmap_body).execute() print(f"HTTPS enabled for URL map {urlmap_name}") else: print(f"HTTPS already enabled for URL map {urlmap_name}") else: print(f"No default service found for path matcher in URL map {urlmap_name}") else: print(f"No path matcher found for host rule in URL map {urlmap_name}") else: print(f"No host rules found in URL map {urlmap_name}") ``` Note: Replace "your-project-id" and "your-url-map-name" with the actual project ID and URL map name in the code. Also, make sure you have the necessary permissions to update the URL map. ```hcl theme={null} resource "google_compute_url_map" "HTTPS_ONLY_URL_MAP" { name = "HTTPS_ONLY_URL_MAP" description = "URL map that enforces HTTPS-only access" # Replace with your actual backend service default_service = google_compute_backend_service.DEFAULT_BACKEND.self_link # If you still have an HTTP frontend, use this URL map on the HTTP proxy # to redirect all HTTP traffic to HTTPS. default_url_redirect { https_redirect = true redirect_response_code = "MOVED_PERMANENTLY_DEFAULT" # 301 strip_query = false } # Example of path matcher-level redirects; optional but often useful path_matcher { name = "pm-https-only" default_service = google_compute_backend_service.DEFAULT_BACKEND.self_link path_rule { paths = ["/secure/*"] service = google_compute_backend_service.SECURE_BACKEND.self_link } route_rules { priority = 1 match_rules { prefix_match = "/" } url_redirect { https_redirect = true redirect_response_code = "MOVED_PERMANENTLY_DEFAULT" strip_query = false } } } } # Attach this URL map only to HTTPS target proxies / forwarding rules. resource "google_compute_target_https_proxy" "HTTPS_PROXY" { name = "HTTPS_PROXY" url_map = google_compute_url_map.HTTPS_ONLY_URL_MAP.self_link ssl_certificates = [google_compute_ssl_certificate.LB_CERT.self_link] } resource "google_compute_global_forwarding_rule" "HTTPS_FORWARDING_RULE" { name = "HTTPS_FORWARDING_RULE" target = google_compute_target_https_proxy.HTTPS_PROXY.self_link port_range = "443" ip_protocol = "TCP" # Replace with your global static IP if you have one load_balancing_scheme = "EXTERNAL" } # (Optional but recommended) Remove or change any existing HTTP forwarding rule # to no longer send traffic directly to backends. Either: # - delete the HTTP forwarding rule/HTTP proxy and let only HTTPS exist, or # - point the HTTP proxy at HTTPS_ONLY_URL_MAP so all HTTP is redirected. # Example: HTTP proxy using the same URL map purely for redirect resource "google_compute_target_http_proxy" "HTTP_REDIRECT_PROXY" { name = "HTTP_REDIRECT_PROXY" url_map = google_compute_url_map.HTTPS_ONLY_URL_MAP.self_link } resource "google_compute_global_forwarding_rule" "HTTP_FORWARDING_RULE" { name = "HTTP_FORWARDING_RULE" target = google_compute_target_http_proxy.HTTP_REDIRECT_PROXY.self_link port_range = "80" ip_protocol = "TCP" load_balancing_scheme = "EXTERNAL" } ``` Changing the `google_compute_url_map` redirect settings is in-place and does not force replacement of the load balancer, but removing or recreating forwarding rules or proxies will briefly affect HTTP/HTTPS reachability for those frontends. To verify, `terraform plan` should show updates to `google_compute_url_map.HTTPS_ONLY_URL_MAP` adding `default_url_redirect`/`url_redirect` with `https_redirect = true`, and (if you chose to) creation of HTTPS-only forwarding/proxy resources and deletion or modification of any existing HTTP forwarding rule that sends traffic directly to backends.