Google Compute SSL policy weak cipher in use

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-gcp-google-compute-ssl-policy-weak-cipher-in-use

Provider: GCP

Platform: Ansible

Severity: Medium

Category: Encryption

Learn More

Description

Compute SSL policies must enforce a minimum TLS version of TLS_1_2 to prevent use of older, vulnerable protocol versions and weak cipher suites. The min_tls_version property on google.cloud.gcp_compute_ssl_policy (or gcp_compute_ssl_policy) resources must be defined and set to TLS_1_2. Resources that omit min_tls_version or set it to any other value are flagged.

- name: Create SSL policy with TLS 1.2 minimum
  google.cloud.gcp_compute_ssl_policy:
    name: my-ssl-policy
    profile: MODERN
    min_tls_version: TLS_1_2

Compliant Code Examples

- name: create a SSL policy
  google.cloud.gcp_compute_ssl_policy:
    name: test_object
    profile: CUSTOM
    min_tls_version: TLS_1_2
    custom_features:
    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    project: test_project
    auth_kind: serviceaccount
    service_account_file: /tmp/auth.pem
    state: present

Non-Compliant Code Examples

- name: create a SSL policy
  google.cloud.gcp_compute_ssl_policy:
    name: test_object
    profile: CUSTOM
    custom_features:
    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present
- name: create a SSL policy2
  google.cloud.gcp_compute_ssl_policy:
    name: test_object2
    profile: CUSTOM
    min_tls_version: TLS_1_1
    custom_features:
    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present