Enable Data Encryption for API Gateway Backend Integrations

Run projects list command (Windows/macOS/Linux) with custom output filters to list the ID of each GCP project available in your Google Cloud account:

gcloud projects list
	--format="table(projectId)"

The command output should return the requested GCP project IDS:

PROJECT_ID
cc-web-project-123123
cc-dev-project-112233

Run api-gateway gateways list command (Windows/macOS/Linux) with the ID of the GCP project that you want to examine as the identifier parameter and custom output filters to describe the ID of each API Gateway created for the selected project:

gcloud api-gateway gateways list
	--location=us-central1
	--project cc-web-project-123123
	--format="table(NAME)"

The command output should return the fully qualified identifier for each API Gateway:

NAME: projects/cc-web-project-123123/locations/us-central1/gateways/tm-project5-api-gateway
NAME: projects/cc-web-project-123123/locations/us-central1/gateways/aqi-monitor-api-gateway

Run compute network-endpoint-groups list command (Windows/macOS/Linux) with the ID of the API Gateway that you want to examine as the identifier parameter and custom output filters to describe the URI of the serverless Network Endpoint Group (NEG) configured as the backend for the specified API Gateway. The serverless NEG is the key element linking the backend service to the API Gateway:

gcloud beta compute network-endpoint-groups list
	--regions=us-central1
	--filter="serverlessDeployment:("resource": "tm-project5-api-gateway")"
	--format="value(selfLink)"

The command output should return the URI of the serverless NEG associated with the selected API Gateway. If the compute network-endpoint-groups list command output does not return an URI, the selected API Gateway is not associated with a serverless NEG and the Audit process ends here:

https://www.googleapis.com/compute/beta/projects/cc-web-project-123123/regions/us-central1/networkEndpointGroups/tm-project5-neg

Run compute backend-services list command (Windows/macOS/Linux) with custom output filters to describe the name of each backend service deployed for the selected GCP project, along with the URI of the Network Endpoint Group (NEG) configured as backend for the backend service:

gcloud compute backend-services list
	--project cc-web-project-123123
	--format="table(name,backends[group])"

The command output should return the requested identifiers:

NAME: tm-project5-backend-service
GROUP: ['https://www.googleapis.com/compute/v1/projects/cc-web-project-123123/regions/us-central1/networkEndpointGroups/tm-project5-neg']

NAME: tm-aqi-app-backend-service
GROUP: ['https://www.googleapis.com/compute/v1/projects/cc-web-project-123123/regions/us-central1/networkEndpointGroups/tm-aqi-app-neg']

Cross-reference the data returned in step no. 6 with that returned in step no. 8 to determine the name of the backend service associated with the selected API Gateway.

Run compute backend-services describe command (Windows/macOS/Linux) with the name of the backend service associated with your API Gateway as the identifier parameter, to determine if the backend service is configured to communicate with the API Gateway using HTTPS:

gcloud compute backend-services describe tm-project5-backend-service
	--format="value(protocol)"

The command output should return the name of the protocol configured for the backend service endpoint:

HTTP

If the compute backend-services describe command output returns HTTP, as shown in the example above, the communication between your Google Cloud API Gateway and the associated backend service is not encrypted.

Repeat steps no. 5 - 10 for each API Gateway that you want to examine, created for the selected GCP project.

Repeat steps no. 3 – 11 for each GCP project deployed in your Google Cloud account.

Run compute backend-services update command (Windows/macOS/Linux) with the name of the backend service associated with your API Gateway as the identifier parameter, to change the backend service endpoint protocol to HTTPS:

gcloud compute backend-services update tm-project5-backend-service
	--protocol HTTPS

The command output should return the URI of the updated resource:

Updated [https://www.googleapis.com/compute/v1/projects/cc-web-project-123123/global/backendServices/tm-project5-backend-service].

Repeat steps no. 1 and 2 for each associated backend service that you want to configure, available within the selected GCP project.

Repeat steps no. 1 – 3 for each GCP project deployed in your Google Cloud account.