Google Cloud Compliance ControlsGoogle Cloud Load Balancing
HTTPS or SSL proxy load balancers should prohibit SSL policies with weak cipher suites
Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites. The Checkov check CKV_GCP_4 evaluates `google_compute_ssl_policy` resources. It looks at `profile`, `min_tls_version` and `custom_features`.
What this control checks
SSL policies on HTTPS or SSL proxy load balancers must not allow weak cipher suites
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- PR.AA-04
- PR.DS-02
- 3.9 Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites
- 3.9 Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites
- 3.9 Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
- 3.9 Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
- 3.9 Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_ssl_policy_with_no_weak_cipher - Checkov Check:
CKV_GCP_4 - Powerpipe Control:
gcp_compliance.control.compute_ssl_policy_with_no_weak_cipher
Last reviewed: 2026-10-09