Control: GCP > Network > Backend Service > CDN

Determine the action to take when a GCP Network backend service's Cloud CDN state or configuration does not match the expected posture.

Cloud CDN caches backend service content at Google's edge and serves it to the internet, turning the backend into a publicly cached distribution point — part of the same exposure posture story as load balancer frontends. Cloud CDN is available only for backend services of global external Application Load Balancers (load balancing scheme EXTERNAL or EXTERNAL_MANAGED); backend services with other schemes are skipped because Cloud CDN cannot be enabled on them.

When the policy is set to an Enabled per CDN > * value, the CDN configuration sub-policies define the expected settings. Only the settings valid for the expected Cache Mode are compared: all TTLs apply to CACHE_ALL_STATIC, only Default TTL applies to FORCE_CACHE_ALL, and no TTLs apply to USE_ORIGIN_HEADERS.

If the current Cloud CDN state or configuration does not match the expectation and this policy is set to an Enforce value, the backend service will be updated in place to the expected state and settings.

Resource Types

This control targets the following resource types:

GCP > Network > Backend Service

Policies

The following policies can be used to configure this control:

GCP > Network > Backend Service > CDN

This control type relies on these other policies when running actions:

Permissions

Cloud permissions used by this control and its actions:

compute.backendServices.update

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-network#/control/types/backendServiceCdn

Category URI

tmod:@turbot/turbot#/control/categories/security

GraphQL

query controlType(id: "tmod:@turbot/gcp-network#/control/types/backendServiceCdn") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-network#/control/types/backendServiceCdn'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-network#/control/types/backendServiceCdn"