GCP Load Balancer SSL proxy permits SSL policies with weak cipher suites
This policy identifies GCP SSL Load Balancers that permit SSL policies with weak cipher suites. GCP default SSL policy uses a minimum TLS version of 1.0 and a Compatible profile, which allows the widest range of insecure cipher suites.

To prevent usage of insecure features, SSL policies should use at least TLS 1.2 with the MODERN profile; or the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or a CUSTOM profile that does not support any of the following features:

TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
This is applicable to gcp cloud and is considered a low severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: If the target SSL Proxy Load Balancer does not have any SSL policy configured, updating the proxy with either a new or an existing secured SSL policy is recommended.

The 'GCP default' SSL policy uses a minimum TLS version of 1.0 and a Compatible profile, which allows the broadest range of insecure cipher suites and is not modifiable. If this SSL policy is attached to the target SSL Proxy Load Balancer, updating the proxy with a more secured SSL policy is recommended.

To create a new SSL policy, refer to the following URL:
https://cloud.google.com/load-balancing/docs/use-ssl-policies#creating_ssl_policies

To modify the existing insecure SSL policy attached to the Target SSL Proxy:
1. Login to GCP Portal
2. Go to Network services (Left Panel)
3. Select Load balancing
4. Click on 'load balancing components view' hyperlink at bottom of page to view target proxies
5. Go to 'TARGET PROXIES' tab and Click on the reported SSL target proxy
6. Note the 'Backend service' name.
7. Click on the hyperlink under 'In use by'
8. Note the 'External IP address'
9. Select Load Balancing (Left Panel) and click on the SSL load balancer with same name as previously noted 'Backend service' name.
10. In frontend section, consider the rule where 'IP:Port' matches the previously noted 'External IP address'.
11. Click on the 'SSL Policy' of the rule. This will take you to the alert causing SSL policy.
12. Click on 'EDIT'
13. Set 'Minimum TLS Version' to TLS 1.2 and set 'Profile' to Modern or Restricted.
14. Alternatively, if you use the profile 'Custom', make sure that the following features are disabled:
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
15. Click on 'Save'.

Query:
```config from cloud.resource where api.name = 'gcloud-compute-target-ssl-proxy' as X; config from cloud.resource where api.name = 'gcloud-compute-ssl-policies' as Y; filter "$.X.sslPolicy does not exist or ($.Y.profile equals COMPATIBLE and $.Y.selfLink contains $.X.sslPolicy) or ( ($.Y.profile equals MODERN or $.Y.profile equals CUSTOM) and $.Y.minTlsVersion does not equal TLS_1_2 and $.Y.selfLink contains $.X.sslPolicy ) or ( $.Y.profile equals CUSTOM and ( $.Y.enabledFeatures[*] contains TLS_RSA_WITH_AES_128_GCM_SHA256 or $.Y.enabledFeatures[*] contains TLS_RSA_WITH_AES_256_GCM_SHA384 or $.Y.enabledFeatures[*] contains TLS_RSA_WITH_AES_128_CBC_SHA or $.Y.enabledFeatures[*] contains TLS_RSA_WITH_AES_256_CBC_SHA or $.Y.enabledFeatures[*] contains TLS_RSA_WITH_3DES_EDE_CBC_SHA ) and $.Y.selfLink contains $.X.sslPolicy ) "; show X;```