Load Balancers Should Use Latest TLS version 1.3
More Info:
Ensure Load Balancers use latest TLS version 1.3Risk Level
MediumAddress
SecurityCompliance Standards
SOC2Triage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the misconfiguration of using the latest TLS version 1.3 for Load Balancers on GCP using the GCP console:
- Open the GCP Console and go to the Load Balancing page.
- Select the Load Balancer for which you want to enable TLS 1.3.
- Click on the Edit button to open the Edit load balancer page.
- In the Edit load balancer page, scroll down to the Frontend configuration section and click on the Edit button next to the HTTPS protocol.
- In the Edit frontend configuration page, scroll down to the Advanced configuration section.
- In the Advanced configuration section, click on the Add item button to add a new item to the list.
- In the new item, set the Name to “tls-version” and the Value to “TLS_1_3”.
- Click on the Save button to save the changes.
- Click on the Update button in the Edit load balancer page to apply the changes to the Load Balancer.
Using CLI
Using CLI
To remediate the misconfiguration of Load Balancers not using the latest TLS version 1.3 on GCP using GCP CLI, you can follow the below steps:Replace Replace Replace
- Open the Cloud Shell on GCP Console, which is a command-line interface that can be used to run GCP CLI commands.
- Run the following command to create a new SSL policy with TLS version 1.3 enabled:
<ssl-policy-name> with a name for your SSL policy.- Run the following command to update the SSL policy for your load balancer:
<target-https-proxy-name> with the name of your target HTTPS proxy, and <ssl-policy-name> with the name of the SSL policy you created in step 2.- Finally, run the following command to verify that TLS version 1.3 is enabled for your load balancer:
<ssl-policy-name> with the name of the SSL policy you created in step 2. The output should show “TLS_1_3” as the minimum TLS version.With these steps, you have successfully remediated the misconfiguration of Load Balancers not using the latest TLS version 1.3 on GCP using GCP CLI.Using Python
Using Python
To remediate the misconfiguration of load balancers not using the latest TLS version 1.3 in GCP using Python, follow the below steps:This will update the SSL policy of all load balancers in the GCP project to use the latest TLS version 1.3.
- Install the latest version of the Google Cloud SDK by running the following command in the terminal:
- Initialize the Google Cloud SDK by running the following command:
- Create a new Python file and import the necessary libraries:
- Set up the Google Cloud client:
- Get the list of all load balancers in the project:
- Loop through the list of load balancers and update their SSL policy to use TLS version 1.3:
- Save the Python file and run it in the terminal: