HTTPS or SSL proxy load balancers should prohibit SSL policies with weak cipher suites
Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites. The Checkov check CKV_GCP_4 evaluates `google_compute_ssl_policy` resources. It looks at `profile`, `min_tls_version` and `custom_features`.
Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers.
What this control checks
SSL policies on HTTPS or SSL proxy load balancers must not allow weak cipher suites
Common pitfalls
MODERN profile needs min_tls_version TLS_1_2
The check passes MODERN only when min_tls_version is TLS_1_2. Otherwise it returns FAILED.
CUSTOM profile with weak custom_features fails
For CUSTOM, the check passes only if custom_features has none of TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_ssl_policy_with_no_weak_cipher.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_4.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.AA-04 (Identity assertions are protected, conveyed, and verified.) and PR.DS-02 (The confidentiality, integrity, and availability of data-in-transit are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- PR.AA-04
- PR.DS-02
- 3.9 Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites
- 3.9 Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites
- 3.9 Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
- 3.9 Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
- 3.9 Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_ssl_policy_with_no_weak_cipher - Checkov Check:
CKV_GCP_4 - Powerpipe Control:
gcp_compliance.control.compute_ssl_policy_with_no_weak_cipher
Last reviewed: 2026-10-09