> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Lb ssl use restricted profile remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Load Balancer SSL Should Use Restricted Profile" misconfiguration in GCP using the GCP console, please follow the steps below:

        1. Open the GCP console and navigate to the Load Balancing page.
        2. Select the Load Balancer that you want to remediate.
        3. Click on the "Edit" button to edit the Load Balancer configuration.
        4. Under the "Frontend configuration" section, locate the SSL certificate that you want to remediate.
        5. Click on the "Edit" button next to the SSL certificate.
        6. In the "Certificate details" section, scroll down to the "Certificate profile" option.
        7. Select the "Restricted" profile from the dropdown menu.
        8. Click on the "Save" button to save the changes.
        9. Repeat steps 4-8 for all SSL certificates associated with the Load Balancer.

        By following these steps, you will remediate the "Load Balancer SSL Should Use Restricted Profile" misconfiguration in GCP using the GCP console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Load Balancer SSL Should Use Restricted Profile" misconfiguration in GCP using GCP CLI, follow these steps:

        1. Open the Cloud Shell by clicking on the icon on the top right corner of the GCP Console.

        2. Run the following command to list all the HTTPS load balancers in your project:

           ```
           gcloud compute target-https-proxies list
           ```

        3. Identify the HTTPS load balancer that needs to be remediated and note down its name.

        4. Run the following command to update the SSL policy of the HTTPS load balancer:

           ```
           gcloud compute target-https-proxies update [TARGET_HTTPS_PROXY_NAME] --ssl-policy=RESTRICTED
           ```

           Replace `[TARGET_HTTPS_PROXY_NAME]` with the name of the HTTPS load balancer that needs to be remediated.

        5. Verify that the SSL policy has been updated by running the following command:

           ```
           gcloud compute target-https-proxies describe [TARGET_HTTPS_PROXY_NAME] | grep sslPolicy
           ```

           The output should show `sslPolicy: RESTRICTED`.

        6. Repeat steps 4-5 for all the HTTPS load balancers in your project that need to be remediated.

        By following these steps, you have successfully remediated the "Load Balancer SSL Should Use Restricted Profile" misconfiguration for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Load Balancer SSL Should Use Restricted Profile" misconfiguration for GCP using Python, follow these steps:

        1. Install the `google-cloud-load-balancer` library using the following command:

           ```
           pip install google-cloud-load-balancer
           ```

        2. Authenticate with GCP by setting up the environment variable `GOOGLE_APPLICATION_CREDENTIALS` with the path to your service account key file.

        3. Use the `google.cloud.load_balancer_v1beta1` module to retrieve the SSL policy that is attached to your load balancer. You can use the following code snippet to achieve this:

           ```
           from google.cloud import load_balancer_v1beta1

           client = load_balancer_v1beta1.LoadBalancerClient()

           # Replace <load_balancer_name> with the name of your load balancer.
           load_balancer_path = client.load_balancer_path('<project_id>', '<location>', '<load_balancer_name>')

           # Retrieve the SSL policy attached to the load balancer.
           load_balancer = client.get_load_balancer(load_balancer_path)
           ssl_policy = load_balancer.ssl_policy
           ```

        4. Check if the SSL policy is set to `RESTRICTED` by checking the value of the `profile` field. If the `profile` is not set to `RESTRICTED`, you need to update the SSL policy. You can use the following code snippet to achieve this:

           ```
           from google.cloud import load_balancer_v1beta1

           client = load_balancer_v1beta1.LoadBalancerClient()

           # Replace <load_balancer_name> with the name of your load balancer.
           load_balancer_path = client.load_balancer_path('<project_id>', '<location>', '<load_balancer_name>')

           # Retrieve the SSL policy attached to the load balancer.
           load_balancer = client.get_load_balancer(load_balancer_path)
           ssl_policy = load_balancer.ssl_policy

           # Check if the SSL policy is set to RESTRICTED.
           if ssl_policy.profile != 'RESTRICTED':
               # Update the SSL policy to use the RESTRICTED profile.
               ssl_policy.profile = 'RESTRICTED'

               # Update the load balancer with the new SSL policy.
               update_mask = {'paths': ['ssl_policy']}
               update_mask = load_balancer_v1beta1.types.FieldMask(paths=update_mask['paths'])
               update_mask = update_mask.to_dict()
               client.update_load_balancer(load_balancer, update_mask)
           ```

        5. Verify that the SSL policy has been updated by checking the value of the `profile` field again.

        By following these steps, you can remediate the "Load Balancer SSL Should Use Restricted Profile" misconfiguration for GCP using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_compute_ssl_policy" "restricted_ssl_policy" {
          name            = "RESTRICTED_SSL_POLICY_NAME" # replace with your desired policy name
          profile         = "RESTRICTED"
          min_tls_version = "TLS_1_2"                    # optional but commonly used with RESTRICTED

          project = "GCP_PROJECT_ID"                     # replace with your project id
        }

        # Example attachment to a target HTTPS proxy:
        resource "google_compute_target_https_proxy" "example_https_proxy" {
          name             = "HTTPS_PROXY_NAME"          # replace with your proxy name
          url_map          = google_compute_url_map.example.self_link
          ssl_certificates = [google_compute_ssl_certificate.example.self_link]
          ssl_policy       = google_compute_ssl_policy.restricted_ssl_policy.self_link

          project = "GCP_PROJECT_ID"
        }
        ```

        Changing an existing `google_compute_ssl_policy` from another `profile` to `RESTRICTED` forces replacement of that SSL policy resource, which briefly affects any proxies/load balancers using it while Terraform recreates and reattaches it.

        Verification: `terraform plan` should show the `google_compute_ssl_policy` either being created with `profile = "RESTRICTED"` or being replaced with the profile changed from its previous value to `"RESTRICTED"`, and the relevant target HTTPS proxies referencing this policy.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>