Google CloudOverview
Weak TLS versions expose workloads to known cryptographic downgrade and interception risks.
Remediation guidance
Google Cloud Remediation
Service-Wide (Recommended)
Standardize secure SSL policy profiles and attach them to all target HTTPS/SSL proxies.
Google Cloud Console (Asset-Level)
- Open Network security -> SSL policies.
- Set minimum TLS to 1.2.
- Attach policy to relevant target proxies.
Google Cloud CLI (Asset-Level)
gcloud compute ssl-policies update <policy-name> --min-tls-version=1.2 --profile=MODERN
gcloud compute target-https-proxies update <proxy-name> --ssl-policy=<policy-name>
References
- https://cloud.google.com/load-balancing/docs/use-ssl-policies
Query logic
These are the stored checks tied to this control.
SSL policies with legacy TLS
Connectors
Google Cloud
Covered asset types
SSLPolicy
Expected check: eq []
{ sslPolicies(where: { OR: [ { minTlsVersion_IN: ["TLS_1_0", "TLS_1_1"] }, { profile: "COMPATIBLE" } ] }) { ...AssetFragment } }
