Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suitesTF-S2004

GCP HTTPS load balancer is configured with SSL policy having TLS version 1.1 or lower or it could be using weak cipher suites.

Secure Sockets Layer (SSL) policies determine what Transport Layer Security (TLS) features clients can use when connecting to load balancers. SSL policies control SSL features in Google Cloud SSL proxy load balancer and external HTTP(S) load balancers. By default, HTTP(S) Load Balancing and SSL Proxy Load Balancing use a set of SSL features that provides good security and broad compatibility.

We recommend using of the following options to prevent usage of insecure features:

1. TLS should be set to 1.2 with the MODERN profile
2. Use RESTRICTED profile as it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version
3. If using a CUSTOM profile that does not support any of the following cipher suites:

TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA

Examples

Bad practice

Recommended

resource "google_compute_ssl_policy" "modern-profile" {
  name            = "test-ssl-policy"
  profile         = "MODERN"
  min_tls_version = "TLS_1_2"
}

resource "google_compute_ssl_policy" "custom-profile" {
  name            = "test-ssl-policy"
  profile         = "CUSTOM"
  min_tls_version = "TLS_1_2"
  custom_features = ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"]
}

resource "google_compute_ssl_policy" "custom-profile" {
  name            = "test-ssl-policy"
  profile         = "RESTRICTED"
}

References

• https://www.terraform.io/docs/providers/google/r/compute_ssl_policy.html