Right Health Check Configurations Should Be Used For Load

More Info:

Improve the reliability of the applications behind your Load Balancer by using the appropriate health check configuration.

Risk Level

Medium

Address

Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration "Right Health Check Configurations Should Be Used For Load Balancer Regional Health Checks" for GCP using GCP console, follow the below steps:

1. Open the GCP Console and go to the Load Balancing page.
2. Select the Load Balancer for which you want to configure the health check.
3. In the left navigation pane, click on "Health checks".
4. Click on "Create health check".
5. Provide a name for the health check and select the protocol and port that the Load Balancer will use to check the backend instances.
6. In the "Advanced check settings" section, configure the appropriate settings for the health check, such as the request path, response timeout, and check interval.
7. Click on "Save and continue".
8. Review the health check configuration and click on "Create".
9. Once the health check is created, go back to the Load Balancer configuration and click on "Backend services".
10. Select the backend service for which you want to configure the health check.
11. In the "Health check" section, select the health check that you created in step 5.
12. Click on "Save" to save the changes.

By following the above steps, you can remediate the misconfiguration "Right Health Check Configurations Should Be Used For Load Balancer Regional Health Checks" for GCP using GCP console.

Using CLI

To remediate the misconfiguration "Right Health Check Configurations Should Be Used For Load Balancer Regional Health Checks" for GCP using GCP CLI, follow these steps:

1. Open the Cloud Shell in your GCP console.
2. Run the following command to list all the load balancers in your project:

gcloud compute target-pools list

3. Identify the target pool for which you want to configure the regional health check.
4. Run the following command to update the target pool with the correct health check configuration:

gcloud compute target-pools update [TARGET_POOL_NAME] --region [REGION] --health-check [HEALTH_CHECK_NAME]

Replace [TARGET_POOL_NAME] with the name of your target pool, [REGION] with the region where your target pool is located, and [HEALTH_CHECK_NAME] with the name of the correct health check configuration. 5. Verify that the target pool has been updated correctly by running the following command:

gcloud compute target-pools describe [TARGET_POOL_NAME] --region [REGION]

This command should show the updated health check configuration for the target pool.

By following these steps, you can remediate the misconfiguration "Right Health Check Configurations Should Be Used For Load Balancer Regional Health Checks" for GCP using GCP CLI.

Using Python

To remediate the misconfiguration "Right Health Check Configurations Should Be Used For Load Balancer Regional Health Checks" in GCP using Python, you can follow these steps:

1. Import the required libraries:

from google.cloud import compute_v1

2. Set up the client object:

client = compute_v1.HealthChecksClient()

3. Get the existing health check configuration:

project = "your-project-id"
health_check_name = "your-health-check-name"
health_check = client.get(project=project, health_check=health_check_name)

4. Update the health check configuration with the right settings:

health_check.tcp_health_check.port = 80 # Replace 80 with the correct port number
health_check.tcp_health_check.request = "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n" # Replace example.com with the correct domain name
health_check.tcp_health_check.response = "HTTP/1.1 200 OK" # Replace 200 with the correct HTTP response code
health_check.tcp_health_check.proxy_header = "NONE" # Replace NONE with the correct proxy header setting
health_check.timeout_sec = 5 # Replace 5 with the correct timeout value
health_check.check_interval_sec = 10 # Replace 10 with the correct check interval value
health_check.unhealthy_threshold = 3 # Replace 3 with the correct unhealthy threshold value
health_check.healthy_threshold = 2 # Replace 2 with the correct healthy threshold value

client.update(project=project, health_check=health_check_name, health_check_resource=health_check)

5. Verify that the health check configuration has been updated:

updated_health_check = client.get(project=project, health_check=health_check_name)
print(updated_health_check)

Note: Replace "your-project-id" and "your-health-check-name" with the correct values for your GCP project and health check name. Also, make sure to replace the other settings with the correct values for your specific use case.

Using Terraform

resource "google_compute_region_health_check" "APP_HEALTH_CHECK" {
  name        = "APP_HEALTH_CHECK_NAME"              # substitute: stable health check name
  region      = "REGION_NAME"                        # substitute: e.g. "us-central1"
  description = "Health check for APP_DESCRIPTION"   # substitute: brief description

  # Recommended general configuration for regional health checks
  check_interval_sec  = 10    # substitute if you have a different required interval (seconds)
  timeout_sec         = 5     # must be < check_interval_sec
  healthy_threshold   = 2     # number of consecutive successes to mark healthy
  unhealthy_threshold = 2     # number of consecutive failures to mark unhealthy

  # Choose *one* of the protocol blocks below to match your backend type.
  # Remove the others so only a single block remains.

  http_health_check {
    port         = 80                      # substitute: backend service port
    request_path = "/healthz"              # substitute: app-specific health path
    host         = "HEALTH_CHECK_HOST"     # substitute: optional, often your DNS name
  }

  # For HTTPS:
  # https_health_check {
  #   port         = 443
  #   request_path = "/healthz"
  #   host         = "HEALTH_CHECK_HOST"
  # }

  # For TCP:
  # tcp_health_check {
  #   port = PORT_NUMBER                  # e.g. 5432 for PostgreSQL, etc.
  # }

  # For SSL:
  # ssl_health_check {
  #   port = 443
  # }

  # For HTTP/2:
  # http2_health_check {
  #   port         = 443
  #   request_path = "/healthz"
  #   host         = "HEALTH_CHECK_HOST"
  # }

  log_config {
    enable = true
  }
}

If you change only thresholds, intervals, timeout, or health-check protocol settings, Terraform will update the existing google_compute_region_health_check in place (no forced replacement). Changing the name generally forces replacement and may briefly affect backends depending on how quickly the backend service re-associates.

Verification: terraform plan should show an in-place update (~ change) to the google_compute_region_health_check with new values for check_interval_sec, timeout_sec, healthy_threshold, unhealthy_threshold, and the selected protocol block, and no other resources changed.

Additional Reading:

• https://cloud.google.com/load-balancing/docs/health-checks