Cdn regional urlmaps accept https only remediation

Using Console

Using CLI

To remediate the Cloud CDN Regional Urlmaps to accept HTTPS connections only on GCP using GCP CLI, you can follow these steps:

Open the Cloud Shell in the GCP Console.
Run the following command to list all the existing Cloud CDN UrlMaps:

gcloud compute url-maps list

Identify the name of the UrlMap that needs to be updated and run the following command to describe the details of the UrlMap:

gcloud compute url-maps describe [URL_MAP_NAME]

Identify the name of the backend service associated with the UrlMap and run the following command to describe the details of the backend service:

gcloud compute backend-services describe [BACKEND_SERVICE_NAME]

Identify the name of the health check associated with the backend service and run the following command to describe the details of the health check:

gcloud compute health-checks describe [HEALTH_CHECK_NAME]

If the health check is not already configured to use HTTPS, update the health check to use HTTPS by running the following command:

gcloud compute health-checks update [HEALTH_CHECK_NAME] --use-https

Update the UrlMap to accept HTTPS connections only by running the following command:

gcloud compute url-maps update [URL_MAP_NAME] --default-service [BACKEND_SERVICE_NAME] --ssl-policy=global-ssl-policy

Note: The global-ssl-policy is a built-in SSL policy that enforces HTTPS connections only.

Verify that the changes have been applied by running the following command:

gcloud compute url-maps describe [URL_MAP_NAME]

The output should show that the sslPolicy is set to global-ssl-policy.That’s it! You have successfully remediated the Cloud CDN Regional Urlmaps to accept HTTPS connections only on GCP using GCP CLI.

Using Python

To remediate the misconfiguration of Cloud CDN Regional Urlmaps accepting only HTTPS connections in GCP using Python, you can follow the below steps:

First, you need to install the Google Cloud SDK and authenticate to your GCP project using the command:

gcloud auth login

Next, you need to install the required Python libraries using the command:

pip install google-cloud-cdn

After that, you can use the following Python code to remediate the misconfiguration:

from google.cloud import cdn_v1beta1
from google.protobuf.field_mask_pb2 import FieldMask

client = cdn_v1beta1.UrlMapsClient()

# Replace [PROJECT_ID] with your GCP project ID
project_id = '[PROJECT_ID]'

# Replace [REGION] with the region where the urlmap is located
region = '[REGION]'

# Replace [URLMAP_NAME] with the name of the urlmap
urlmap_name = '[URLMAP_NAME]'

urlmap = client.get_url_map(request={'project_id': project_id, 'region': region, 'url_map': urlmap_name})

# Update the urlmap to accept only HTTPS connections
urlmap.default_url_redirect.https_redirect = True

# Update the urlmap using the FieldMask to only modify the https_redirect field
field_mask = FieldMask(paths=['default_url_redirect.https_redirect'])
client.update_url_map(request={'url_map': urlmap, 'update_mask': field_mask})

Finally, you can run the above Python code to remediate the misconfiguration of Cloud CDN Regional Urlmaps accepting only HTTPS connections in GCP.

Note: You need to replace the placeholders [PROJECT_ID], [REGION], and [URLMAP_NAME] with your GCP project ID, the region where the urlmap is located, and the name of the urlmap, respectively.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Cdn regional urlmaps accept https only remediation

Triage and Remediation

Remediation

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

​Triage and Remediation

​Remediation

Triage and Remediation

Remediation