Skip to main content

Load Balancers Regional Backend Services Should Use Secure

More Info:​

Load Balancers regional backend services should use only the secure listeners. A listener is a process that checks for connection requests, using the protocol and port that you configure.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Sure! Here are the step-by-step instructions to remediate the misconfiguration "Load Balancers Regional Backend Services Should Use Secure Listeners" for GCP using the GCP console:

  1. Open the GCP console and navigate to the Load Balancing section.

  2. Select the load balancer for which you want to remediate the misconfiguration.

  3. Click on the "Backend Services" tab.

  4. Select the backend service for which you want to enable secure listeners.

  5. Click on the "Edit" button at the top of the page.

  6. In the "Backend Configuration" section, click on the "Add backend" button.

  7. Select the protocol you want to use for the secure listener (HTTPS or SSL).

  8. Set the port number for the secure listener.

  9. Select the appropriate certificate from the drop-down menu.

  10. Click on the "Create" button.

  11. Click on the "Save" button to save the changes.

  12. Repeat the above steps for all the backend services that are part of the load balancer.

Once you have completed the above steps, your load balancer will be configured to use secure listeners for all the regional backend services. This will help to ensure that your applications are protected against potential security threats.

Using CLI

To remediate the misconfiguration "Load Balancers Regional Backend Services Should Use Secure Listeners" for GCP using GCP CLI, follow the below steps:

  1. Open the Cloud Shell in the GCP console.

  2. Run the following command to list all the regional backend services:

    gcloud compute backend-services list --filter=loadBalancingScheme=INTERNAL_SELF_MANAGED

  3. Identify the backend service that needs to be updated and note down its name.

  4. Run the following command to update the backend service to use secure listeners:

    gcloud compute backend-services update [BACKEND_SERVICE_NAME] --global-ssl-certificates [SSL_CERTIFICATE_NAME]

    Replace [BACKEND_SERVICE_NAME] with the name of the backend service identified in step 3, and [SSL_CERTIFICATE_NAME] with the name of the SSL certificate that needs to be used.

    Note: If you don't have an SSL certificate, you can create one using the following command:

    gcloud compute ssl-certificates create [SSL_CERTIFICATE_NAME] --description "SSL certificate for backend service" --domains [DOMAIN_NAME]

    Replace [SSL_CERTIFICATE_NAME] with a name for the SSL certificate, and [DOMAIN_NAME] with the domain name for which the SSL certificate needs to be created.

  5. Once the backend service is updated with the secure listeners, run the following command to verify the changes:

    gcloud compute backend-services describe [BACKEND_SERVICE_NAME]

    This will display the updated backend service configuration, including the secure listeners.

By following the above steps, you can remediate the misconfiguration "Load Balancers Regional Backend Services Should Use Secure Listeners" for GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Load Balancers Regional Backend Services Should Use Secure Listeners" for GCP using Python, you can follow the below steps:

  1. Install the required libraries:
pip install google-cloud-load-balancer
  1. Import the necessary libraries:
from google.cloud import load_balancer_v1
from google.protobuf import field_mask_pb2
  1. Set up the client:
client = load_balancer_v1.LoadBalancerClient()
  1. Get the existing backend services:
project_id = "your-project-id"
region = "us-central1"
parent = client.region_path(project_id, region)
backend_services = client.list_region_backend_services(parent=parent)
  1. Loop through each backend service and update it to use secure listeners:
for backend_service in backend_services:
    backend_service_name = backend_service.name
    backend_service_url_map = backend_service.url_map
    backend_service_protocol = backend_service.protocol
    if backend_service_protocol == "HTTP":
        backend_service.protocol = "HTTPS"
        update_mask = field_mask_pb2.FieldMask(paths=["protocol"])
        client.update_region_backend_service(
            backend_service=backend_service,
            update_mask=update_mask,
        )
  1. Verify that the backend services have been updated:
backend_services = client.list_region_backend_services(parent=parent)
for backend_service in backend_services:
    backend_service_name = backend_service.name
    backend_service_protocol = backend_service.protocol
    print(f"Backend Service {backend_service_name} protocol: {backend_service_protocol}")

This code will update all backend services in the specified GCP project and region to use secure listeners.

Using Terraform
# This finding cannot be remediated directly on the backend service itself;
# in GCP, “listeners” are implemented by forwarding rules and target proxies.
# You must terminate TLS on an HTTPS / SSL proxy that fronts the
# google_compute_region_backend_service.

# Existing regional backend service (already in your config)
resource "google_compute_region_backend_service" "BACKEND_SERVICE" {
  name          = "BACKEND_SERVICE_NAME"        # substitute your backend service name
  region        = "REGION"                      # e.g. "us-central1"
  protocol      = "HTTP"                        # or "HTTPS" depending on your design
  health_checks = [google_compute_health_check.backend.id]

  backend {
    group = google_compute_instance_group.backend.id
  }
}

# 1. SSL certificate for HTTPS listener
resource "google_compute_ssl_certificate" "lb_cert" {
  name        = "HTTPS_CERT_NAME"               # substitute a cert resource name
  private_key = file("PATH_TO_PRIVATE_KEY.pem") # substitute path to your key
  certificate = file("PATH_TO_CERT.pem")        # substitute path to your cert
}

# 2. URL map pointing to the regional backend service
resource "google_compute_url_map" "https_url_map" {
  name            = "HTTPS_URL_MAP_NAME"        # substitute URL map name
  default_service = google_compute_region_backend_service.BACKEND_SERVICE.self_link
}

# 3. HTTPS target proxy that uses the URL map and certificate
resource "google_compute_target_https_proxy" "https_proxy" {
  name             = "HTTPS_PROXY_NAME"         # substitute proxy name
  url_map          = google_compute_url_map.https_url_map.id
  ssl_certificates = [google_compute_ssl_certificate.lb_cert.id]
}

# 4. Regional HTTPS forwarding rule (the secure listener)
resource "google_compute_forwarding_rule" "https_forwarding_rule" {
  name                  = "HTTPS_FORWARDING_RULE_NAME" # substitute FR name
  load_balancing_scheme = "EXTERNAL_MANAGED"
  port_range            = "443"
  target                = google_compute_target_https_proxy.https_proxy.id
  network               = "NETWORK_SELF_LINK"          # substitute VPC self_link as needed
  subnetwork            = "SUBNETWORK_SELF_LINK"       # substitute subnetwork self_link
  ip_protocol           = "TCP"
  region                = google_compute_region_backend_service.BACKEND_SERVICE.region
  ip_address            = "IP_ADDRESS_SELF_LINK"       # optional: static IP self_link
}

# OPTIONAL: If you previously had an insecure HTTP listener, remove or comment out
# the corresponding HTTP forwarding rule / target_http_proxy resources so Terraform
# deletes them and only the HTTPS listener remains.
#
# Example (to be removed once HTTPS is in place):
# resource "google_compute_forwarding_rule" "http_forwarding_rule" { ... }

Changing from an HTTP listener to an HTTPS listener is often a replacement: if you remove the old HTTP google_compute_forwarding_rule and add the HTTPS one, client traffic will move to the new HTTPS endpoint once applied; plan for a cutover window.

To verify, terraform plan should show:

  • Creation of google_compute_ssl_certificate, google_compute_url_map, google_compute_target_https_proxy, and the HTTPS google_compute_forwarding_rule.
  • Removal of any old HTTP google_compute_forwarding_rule / google_compute_target_http_proxy you’ve deleted from configuration, ensuring only secure (HTTPS) listeners remain.

Additional Reading:​