Using (plain) http between GCP Load Balancer and backend instance, what are the risks?

Question

Now that GCP offers managed certificates at the load balancer level, it's tempting to use plain http between the load balancer and the backend instances (i.e. compute engine VMs), because then you don't need to generate / deploy certs for them.

Since this traffic, even if it's outside the project VPC, is still contained on GCP network, what are the risks? I'm guessing that excluding someone with privileged access at GCP, it would be difficult to eavesdrop on it...?

Answer 1

Terminating your HTTPS connections at the load balancer and using plain HTTP on the backend may be enough to secure your services. GCP isolates all network traffic and provides robust security features across its infrastructure and services including a high level of encryption. Meaning this that other VMs that are not part of that specific communication can’t listen to it. As its build on top of IAM and IAM ACLs.However, making your CGP resources secure is a shared responsibility. Security considerations are never enough and using, for example, HTTPS or HTTP/2 sessions, between the load balancer and the backend instances, might be an good idea if you you require end to end encryption.For backend VMs you have more flexibility when it comes to SSL certificate.

-The certificate can be self signed or signed by any certificate authority. The GFE does not validate the backend's certificate.

-The GFE does not validate that the CN or subjectAlternativeName attribute matches the hostname of the backend VM. Wildcard certificates are also accepted.

-The certificate might not yet be valid, might be valid currently, or might have expired. The GFE does not validate any of the dates (notValidBefore, notValidAfter) on the certificate presented by the backend VM.

Long story short, the GFE is not very picky at all when it comes to SSL certificates that are used for backend to LB communication. This Best Practice guide could help you to take some appropriate measures to help ensure that your information and services are protected.

Additionally, these Google public documentation could help you understand the different encryption levels (GCP Encryption in transit, GCP Encryption at REST) and processes GCP uses to protect your data.