​
More Info:

Load Balancer regional urlmaps should be configured to block HTTP connection and allow only HTTPS connections.

​
Risk Level

High

​
Address

Security

​
Compliance Standards

GDPR, PCIDSS

​
Remediation

​
Using Console

To remediate the misconfiguration “Load Balancer Regional Urlmaps Should Accept Https Connections” for GCP using GCP console, you can follow the steps below:

  1. Open the GCP console and navigate to the Load Balancing menu.

  2. Select the load balancer that you want to update.

  3. Click on the “Edit” button at the top of the page.

  4. Scroll down to the “Frontend configuration” section and click on the “Edit” button next to it.

  5. In the “Protocol” drop-down menu, select “HTTPS”.

  6. Under “Certificate”, select the SSL certificate that you want to use for the load balancer.

  7. In the “Port numbers” section, enter the port numbers that you want to use for HTTPS connections.

  8. Click on the “Update” button to save the changes.

After following these steps, your Load Balancer Regional Urlmaps should accept HTTPS connections and the misconfiguration will be remediated.

​
Using CLI

To remediate the “Load Balancer Regional Urlmaps Should Accept Https Connections” misconfiguration in GCP, you can follow these steps using GCP CLI:

  1. Open the Cloud Shell in your GCP console.

  2. Run the following command to list all the URL maps in your project:

    gcloud compute url-maps list

  3. Identify the URL map that you want to modify and note down its name.

  4. Run the following command to update the URL map to accept HTTPS connections:

    gcloud compute url-maps update [URL_MAP_NAME] --default-service [BACKEND_SERVICE_NAME] --ssl-certificates [SSL_CERTIFICATE_NAME]

    Replace [URL_MAP_NAME] with the name of the URL map that you want to update, [BACKEND_SERVICE_NAME] with the name of the backend service that you want to use, and [SSL_CERTIFICATE_NAME] with the name of the SSL certificate that you want to use for HTTPS connections.

    Note: You can create an SSL certificate using the GCP console or CLI. Refer to the GCP documentation for more information on creating SSL certificates.

  5. After running the above command, your URL map will be updated to accept HTTPS connections.

This should remediate the “Load Balancer Regional Urlmaps Should Accept Https Connections” misconfiguration in GCP using GCP CLI.

​
Using Python

To remediate the misconfiguration “Load Balancer Regional Urlmaps Should Accept Https Connections” in GCP using Python, follow these steps:

  1. Import the necessary libraries:
from google.cloud import compute_v1
  1. Define the project ID and the name of the load balancer:
project_id = 'your-project-id'
load_balancer_name = 'your-load-balancer-name'
  1. Create a client object for the Compute Engine API:
client = compute_v1.LoadBalancerClient()
  1. Get the URL map configuration for the load balancer:
url_map_name = client.get(project=project_id, region='global', load_balancer=load_balancer_name).url_map
url_map = client.get(project=project_id, region='global', url_map=url_map_name)
  1. Update the URL map to accept HTTPS connections:
if url_map.host_rules[0].path_matchers[0].default_service.port_name == '80':
    url_map.host_rules[0].path_matchers[0].default_service.port_name = '443'
    url_map.host_rules[0].path_matchers[0].default_service.protocol = 'HTTPS'
    update_mask = ['host_rules.path_matchers.default_service.port_name', 'host_rules.path_matchers.default_service.protocol']
    client.update(project=project_id, region='global', url_map=url_map_name, url_map_resource=url_map, update_mask=update_mask)
  1. Verify that the update was successful:
url_map = client.get(project=project_id, region='global', url_map=url_map_name)
if url_map.host_rules[0].path_matchers[0].default_service.port_name == '443' and url_map.host_rules[0].path_matchers[0].default_service.protocol == 'HTTPS':
    print('Load balancer URL map updated successfully.')
else:
    print('Failed to update load balancer URL map.')

That’s it! This code will update the URL map for the specified load balancer to accept HTTPS connections.

​
Additional Reading: