Policy: GCP > CIS v2.0 > 3 - Networking > 3.09 - Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites

Configures auditing against a CIS Benchmark item.

Level: 1

Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features:

TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA

Targets

This policy targets the following resource types:

Primary Policy

This policy is used with the following primary policy:

GCP > CIS v2.0 > 3 - Networking

Controls

Setting this policy configures this control:

GCP > CIS v2.0 > 3 - Networking > 3.09 - Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites

Policy Specification

Schema Type	`string`
Default	`Per GCP > CIS v2.0 > 3 - Networking`
Valid Values [YAML]	`Per GCP > CIS v2.0 > 3 - Networking` `Skip` `Check: Benchmark`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/cis#/control/categories/v071404

Policy Type URI

tmod:@turbot/gcp-cisv2-0#/policy/types/r0309

GraphQL

query policyType(id: "tmod:@turbot/gcp-cisv2-0#/policy/types/r0309") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/gcp-cisv2-0#/policy/types/r0309'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/gcp-cisv2-0#/policy/types/r0309'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/gcp-cisv2-0#/policy/types/r0309"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/gcp-cisv2-0#/policy/types/r0309"