Cloud Monitoring Should Mask Headers For HTTPS Requests
More Info:
Ensure that GCP Cloud Monitoring mask the headers of HTTPS requests while checking backend resources health.Risk Level
MediumAddress
SecurityCompliance Standards
CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Cloud Monitoring Should Mask Headers For HTTPS Requests” for GCP using GCP console, you can follow the below steps:
- Open the GCP console and navigate to the Cloud Monitoring page.
- Click on the “Uptime Checks” option on the left-hand side menu.
- Select the HTTPS uptime check for which you want to mask headers.
- Click on the “Edit” button to edit the uptime check.
- Under the “Request” section, click on the “Add Header” button to add a new header.
- Enter the header name as “X-Goog-Monitoring-Mask-Headers” and the header value as a comma-separated list of headers that you want to mask.
- Save the changes by clicking on the “Save” button.
- Verify that the headers are masked by checking the monitoring logs.
Using CLI
Using CLI
To remediate the “Cloud Monitoring Should Mask Headers For HTTPS Requests” misconfiguration for GCP using GCP CLI, follow these steps:Make sure to replace You should see the “HTTPS Masked Headers Alert” policy listed.By following these steps, you have remediated the “Cloud Monitoring Should Mask Headers For HTTPS Requests” misconfiguration for GCP using GCP CLI.
- Open the Google Cloud Console and go to the Cloud Shell.
- Run the following command to enable the Cloud Monitoring API:
- Run the following command to create a new metric descriptor for masking headers:
- Run the following command to create a new alert policy that will trigger when the “masked_headers” metric is false:
<your-notification-channel> with the name or ID of the notification channel you want to use.- Run the following command to verify that the alert policy was created successfully:
Using Python
Using Python
To remediate the misconfiguration “Cloud Monitoring Should Mask Headers For HTTPS Requests” for GCP using Python, you can follow the below steps:Step 1: Install the necessary libraries and authenticate to GCP using the following commands:Step 2: Create a client object for Cloud Monitoring API:Step 3: Define the metric descriptor for masking headers:Step 4: Create the metric descriptor using the client object:Step 5: Verify that the metric descriptor has been created successfully:Step 6: Create a time series for the metric:Step 7: Write the time series to Cloud Monitoring API:Step 8: Verify that the time series has been created successfully:After completing these steps, the misconfiguration “Cloud Monitoring Should Mask Headers For HTTPS Requests” should be remediated for GCP using Python.