Restrict TLS cipher suites

This page describes how you can prevent access to Google Cloud resources by denying requests made using certain less secure Transport Layer Security (TLS) cipher suites.

Overview

Google Cloud supports multiple TLS cipher suites. To meet security or compliance requirements, you may want to deny requests from clients that use less secure TLS cipher suites.

This capability is provided by the gcp.restrictTLSCipherSuites organization policy constraint. The constraint can be applied on organizations, folders, or projects in the resource hierarchy.

You can use the gcp.restrictTLSCipherSuites constraint either as an allow list or as a deny list:

• Allow list: Allows a specific set of cipher suites. All others are denied.
• Deny list: Denies a specific set of cipher suites. All others are allowed.

Due to the behavior of organization policy hierarchy evaluation, the Restrict TLS cipher suites constraint applies to the specified resource node and all of its children. For example, if you only allow certain TLS cipher suites for an organization, it also applies for all folders and projects (children) that descend from that organization.

Before you begin

To get the permissions that you need to set, change, or delete organization policies, ask your administrator to grant you the Organization policy administrator (roles/orgpolicy.policyAdmin) IAM role on the organization. For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Setting the organization policy

The Restrict TLS cipher suites constraint is a type of list constraint. You can add and remove cipher suites from the allowed_values or denied_values lists of a Restrict TLS cipher suites constraint. To prevent organization policies from being too restrictive and to simplify policy management, use value groups. Value groups are Google-curated recommended TLS cipher suites.

constraint: constraints/gcp.restrictTLSCipherSuites
listPolicy:
  allowedValues:
  - in:CNSA-2.0-recommended-ciphers
  - is:TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

gcloud resource-manager org-policies set-policy \
--RESOURCE_TYPE RESOURCE_ID \
POLICY_PATH

constraint: constraints/gcp.restrictTLSCipherSuites
etag: COS9qr0GELii6o0C
listPolicy:
  allowedValues:
  - in:CNSA-2.0-recommended-ciphers
  - is:TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
updateTime: '2025-02-11T00:50:44.565875Z'

Value groups

Value groups are collections of cipher suites that are curated by Google to provide a simpler way to define preferred or recommended TLS cipher suites. Value groups include multiple cipher suites and are expanded over time by Google. You don't need to change your organization policy to accommodate the new cipher suites.

To use value groups in your organization policy, prefix your entries with the string in:. For more information on using value prefixes, see Using Constraints. Value group names are validated on the call to set the organization policy. Using an invalid group name will cause the policy setting to fail.

The following table contains the current list of available groups:

Supported cipher suites

This is the list of cipher suites supported by Google Cloud.

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256

Error message

Services that support the Restrict TLS cipher suites constraint deny requests that violate the constraint.

Example error message

The error message has a format similar to the following example:

Request is disallowed by organization's constraints/gcp.restrictTLSCipherSuites
constraint for 'projects/PROJECT_NUMBER'.
Access to service
'SERVICE_NAME.googleapis.com' attempted with a disallowed TLS Cipher Suite: 'TLS_Cipher_Suite_X`
To access this resource, please use an allowed TLS Cipher Suite.

This output includes the following values:

• PROJECT_NUMBER: the project number hosting the resource referred in the earlier command.
• SERVICE_NAME: the name of the in-scope service blocked by the Restrict TLS cipher suites policy.
• TLS_Cipher_Suite_X: the TLS Cipher suite used in the request.

Example Cloud Audit Log

An audit log entry is also generated for further monitoring, alerting, or debugging. The audit log entry looks similar to the following example:

{
  logName: "projects/my-project-number/logs/cloudaudit.googleapis.com%2Fpolicy"
  protoPayload: {
    @type: "type.googleapis.com/google.cloud.audit.AuditLog"
    status: {
      code: 7
      message: "Request is disallowed by organization's TLS Cipher Suite Restriction Org Policy for 'projects/my-project-number'. Attempting to use service 'bigquery.googleapis.com' with a disallowed TLS Cipher Suite: 'TLS_Cipher_Suite_X`."
    }
    serviceName: "bigquery.googleapis.com"
    methodName: "google.cloud.bigquery.v2.TableDataService.InsertAll"
    resourceName: "projects/my-project-number"
    authenticationInfo: {
      principalEmail: "[email protected]"
    }
  }
  requestMetadata: {
    callerIp: "123.123.123.123"
  }
  policyViolationInfo: {
    orgPolicyViolationInfo: {
      violationInfo: [
        {
          constraint: "constraints/gcp.restrictTlsCipherSuites"
          errorMessage: "TLS Cipher Suite Restriction Org Policy is violated"
          policyType: "LIST_CONSTRAINT"
        }
      ]
    }
  }
  resource: {
    type: "audited_resource"
    labels: {
      project_id: "my-project-number"
      method: "google.cloud.bigquery.v2.TableDataService.InsertAll"
      service: "bigquery.googleapis.com"
    }
  }
  severity: "ERROR"
  timestamp: "2023-10-27T19:27:24.633477924Z"
  receiveTimestamp: "2023-10-27T19:27:25.071941737Z"
  insertId "42"
}

Test the policy

You can test the TLS cipher restriction policy constraint for any in-scope service. The following example curl command validates the Restrict TLS cipher suites for a Cloud Key Management Service key ring.

curl --ciphers TLS_CIPHER_SUITE --tls_max 1.2 -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://cloudkms.googleapis.com/v1/projects/PROJECT_ID/locations/global/keyRings" --verbose

Replace the following variables:

• TLS_CIPHER_SUITE: the TLS cipher suite name in OpenSSL naming convention, for example ECDHE-ECDSA-AES128-SHA which is the OpenSSL name for TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA.

• PROJECT_ID: Name of the project containing the key ring

The following example curl request shows PROJECT_ID set to my-project-id and TLS_CIPHER_SUITE set to ECDHE-ECDSA-AES128-SHA:

curl --ciphers ECDHE-ECDSA-AES128-SHA --tls-max 1.2 \
  GET -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://cloudkms.googleapis.com/v1/projects/my-project-id/locations/global/keyRings" --verbose

If the organization policy for 'my-project-id' is configured to deny TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA , then any attempt to access resources with the cipher in the policy-restricted project in this example command fails. An error message similar to the following example is returned that describes the reason for this failure.

Request is disallowed by organization's constraints/gcp.restrictTLSCipherSuites
constraint for 'projects/my-project-id'.
Access to service cloudkms.googleapis.com attempted with a disallowed TLS Cipher
Suite: `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`.
To access this resource, please use an allowed TLS Cipher Suite.

Create an organization policy in dry-run mode

An organization policy in dry-run mode is a type of organization policy where violations of the policy are audit logged, but the violating actions aren't denied. You can create an organization policy in dry-run mode using the TLS Cipher Suite Restriction constraint to monitor how it would affect your organization before you enforce the live policy. For more information, see Create an organization policy in dry-run mode.

Supported services

The following services support Restrict TLS cipher suites. The constraint applies to all variations of the API endpoint including global, locational, and regional endpoints. See the API endpoint types page for more information.

Unsupported services

The Restrict TLS cipher suites organization policy constraint is not applicable for the following services:

• App Engine (*.appspot.com)
• Cloud Run functions (*.cloudfunctions.net),
• Cloud Run (*.run.app)
• Private Service Connect
• Custom domains

To restrict TLS cipher suites for these services, use Cloud Load Balancing along with SSL security policy.

Google Cloud cipher suite preference

Endpoints for supported services prioritize AES-256 over AES-128 over ChaCha20. Clients that support AES-256 should successfully negotiate to it without requiring any change in configuration.