> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Cloud CDN Backend Buckets CDN Should Be Enabled ### More Info: Ensure Cloud CDN backend buckets have CDN enabled. ### Risk Level High ### Address Operational Maturity, Performance Efficiency, Reliability, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "Cloud CDN Backend Buckets CDN Should Be Enabled" in GCP, you can follow the below steps using GCP Console: 1. Open the GCP Console and navigate to the Cloud Storage page. 2. Click on the name of the bucket that you want to enable for Cloud CDN. 3. Click on the "Edit bucket details" button at the top of the page. 4. Scroll down to the "Cloud CDN" section and click on the "Enable Cloud CDN" checkbox. 5. Click on the "Save" button at the bottom of the page to save the changes. Once you have enabled Cloud CDN for the backend bucket, you can verify the configuration by checking the Cloud CDN page in the GCP Console. The backend bucket should now be listed as a resource in the Cloud CDN page. # To remediate the misconfiguration "Cloud CDN Backend Buckets CDN Should Be Enabled" for GCP using GCP CLI, follow these steps: 1. Open the Cloud Shell in the GCP console. 2. Run the following command to enable the Cloud CDN API: ``` gcloud services enable cdn.googleapis.com ``` 3. Run the following command to create a Cloud Storage bucket: ``` gsutil mb -c standard -l gs:// ``` Replace `` with the location where you want to create the bucket (e.g. us-central1) and `` with the name of your bucket. 4. Run the following command to enable the Cloud CDN for the bucket: ``` gsutil web set -m index.html -e 404.html gs:// ``` This command sets up the bucket as a static website and enables the Cloud CDN for it. 5. Verify that the Cloud CDN is enabled for the bucket by running the following command: ``` gcloud compute backend-buckets describe ``` Replace `` with the name of your backend bucket. Look for the `cdnPolicy` field in the output. It should show `"cacheMode": "CACHE_ALL_STATIC"` which confirms that the Cloud CDN is enabled for the bucket. 6. Repeat steps 3-5 for each backend bucket that needs the Cloud CDN enabled. By following these steps, you have successfully remediated the misconfiguration "Cloud CDN Backend Buckets CDN Should Be Enabled" for GCP using GCP CLI. To remediate the misconfiguration "Cloud CDN Backend Buckets CDN Should Be Enabled" in GCP using Python, you can follow these steps: 1. Import the necessary libraries: ```python theme={null} from google.cloud import compute_v1 from google.protobuf.field_mask_pb2 import FieldMask ``` 2. Set up the GCP credentials: ```python theme={null} # Replace [PATH_TO_YOUR_CREDENTIALS_JSON] with the path to your GCP credentials JSON file. import os os.environ["GOOGLE_APPLICATION_CREDENTIALS"] = "[PATH_TO_YOUR_CREDENTIALS_JSON]" ``` 3. Initialize the Compute Engine client: ```python theme={null} client = compute_v1.ComputeClient() ``` 4. Get the current configuration of the backend bucket: ```python theme={null} # Replace [BACKEND_BUCKET_NAME] with the name of the backend bucket. backend_bucket_name = "[BACKEND_BUCKET_NAME]" backend_bucket = client.backend_buckets.get(project="[PROJECT_ID]", backend_bucket=backend_bucket_name) ``` 5. Update the configuration to enable CDN: ```python theme={null} # Set the CDN configuration. backend_bucket.cdn_policy.cache_key_policy.include_host = True backend_bucket.cdn_policy.cache_mode = compute_v1.BackendBucketCdnPolicy.CacheMode.CACHE_ALL_STATIC backend_bucket.cdn_policy.signed_url_key_names.append("my-key-name") # Update the backend bucket. update_mask = FieldMask(paths=["cdn_policy"]) updated_backend_bucket = client.backend_buckets.update(project="[PROJECT_ID]", backend_bucket=backend_bucket_name, backend_bucket_resource=backend_bucket, update_mask=update_mask) ``` 6. Verify that CDN is enabled: ```python theme={null} print(updated_backend_bucket.cdn_policy.cache_mode) ``` This should output "CACHE\_ALL\_STATIC", indicating that CDN is enabled for the backend bucket. Note: You will need to replace \[PROJECT\_ID], \[BACKEND\_BUCKET\_NAME], and "my-key-name" with the appropriate values for your GCP project and backend bucket. ```hcl theme={null} resource "google_compute_backend_bucket" "CDN_BACKEND_BUCKET" { name = "CDN_BACKEND_BUCKET_NAME" # replace with your backend bucket name bucket_name = "GCS_BUCKET_NAME" # replace with your Cloud Storage bucket name project = "GCP_PROJECT_ID" # replace with your GCP project ID # Enable Cloud CDN on this backend bucket enable_cdn = true } ``` This change does not force replacement of the backend bucket; Terraform will update the existing resource in place to enable CDN. For verification, `terraform plan` should show an in-place update with `enable_cdn` changing from `false` (or `null`) to `true`. ### Additional Reading: * [https://cloud.google.com/cdn/docs/using-cdn](https://cloud.google.com/cdn/docs/using-cdn)