🛡️ Google App Engine Application HTTPS Connection is not enforced🟢⚪

• Contextual name: 🛡️ Application HTTPS Connection is not enforced🟢⚪
• ID: /ce/ca/google/app-engine/app-engine-application-https-connection
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Similar Policies

• Cloud Conformity: Enforce HTTPS Connections for App Engine Applications

Description

Open File

Description

To maintain the highest level of security, all connections to an application should be secure by default.

Rationale

Insecure HTTP connections may be subject to eavesdropping, which can expose sensitive data.

Impact

All connections to App Engine will automatically be redirected to the HTTPS endpoint, ensuring that all connections are secured by TLS.

Audit

Verify that the app.yaml file controlling the application contains a line that enforces secure connections. For example:

handlers: 
- url: /.* 
secure: always 
redirect_http_response_code: 301 
script: auto

https://cloud.google.com/appengine/docs/standard/python3/config/appref

Default Value

By default, both HTTP and HTTPS are supported.

References

1. https://cloud.google.com/appengine/docs/standard/python3/config/appref
2. https://cloud.google.com/appengine/docs/flexible/nodejs/configuring-your-app-with-app-yaml

Remediation

Open File

Remediation

Add a line to the app.yaml file controlling the application that enforces secure connections. For example:

handlers: 
- url: /.* 
**secure: always** 
redirect_http_response_code: 301 
script: auto

https://cloud.google.com/appengine/docs/standard/python3/config/appref

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS GCP v1.2.0 → 💼 4.10 Ensure that App Engine applications enforce HTTPS connections - Level 2 (Manual _ Not supported, requires a manual assessment)			1		no data
💼 CIS GCP v1.3.0 → 💼 4.10 Ensure That App Engine Applications Enforce HTTPS Connections - Level 2 (Manual)			1		no data
💼 CIS GCP v2.0.0 → 💼 4.10 Ensure That App Engine Applications Enforce HTTPS Connections - Level 2 (Manual)			1		no data
💼 CIS GCP v3.0.0 → 💼 4.10 Ensure That App Engine Applications Enforce HTTPS Connections - Level 2 (Manual)			1		no data
💼 Cloudaware Framework → 💼 Data Encryption			70		no data