限制 TLS 加密套件

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256

Request is disallowed by organization's constraints/gcp.restrictTLSCipherSuites
constraint for 'projects/PROJECT_NUMBER'.
Access to service
'SERVICE_NAME.googleapis.com' attempted with a disallowed TLS Cipher Suite: 'TLS_Cipher_Suite_X`
To access this resource, please use an allowed TLS Cipher Suite.

{
  logName: "projects/my-project-number/logs/cloudaudit.googleapis.com%2Fpolicy"
  protoPayload: {
    @type: "type.googleapis.com/google.cloud.audit.AuditLog"
    status: {
      code: 7
      message: "Request is disallowed by organization's TLS Cipher Suite Restriction Org Policy for 'projects/my-project-number'. Attempting to use service 'bigquery.googleapis.com' with a disallowed TLS Cipher Suite: 'TLS_Cipher_Suite_X`."
    }
    serviceName: "bigquery.googleapis.com"
    methodName: "google.cloud.bigquery.v2.TableDataService.InsertAll"
    resourceName: "projects/my-project-number"
    authenticationInfo: {
      principalEmail: "user_or_service_account@example.com"
    }
  }
  requestMetadata: {
    callerIp: "123.123.123.123"
  }
  policyViolationInfo: {
    orgPolicyViolationInfo: {
      violationInfo: [
        {
          constraint: "constraints/gcp.restrictTlsCipherSuites"
          errorMessage: "TLS Cipher Suite Restriction Org Policy is violated"
          policyType: "LIST_CONSTRAINT"
        }
      ]
    }
  }
  resource: {
    type: "audited_resource"
    labels: {
      project_id: "my-project-number"
      method: "google.cloud.bigquery.v2.TableDataService.InsertAll"
      service: "bigquery.googleapis.com"
    }
  }
  severity: "ERROR"
  timestamp: "2023-10-27T19:27:24.633477924Z"
  receiveTimestamp: "2023-10-27T19:27:25.071941737Z"
  insertId "42"
}

curl --ciphers TLS_CIPHER_SUITE --tls_max 1.2 -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://cloudkms.googleapis.com/v1/projects/PROJECT_ID/locations/global/keyRings" --verbose

curl --ciphers ECDHE-ECDSA-AES128-SHA --tls-max 1.2 \
  GET -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://cloudkms.googleapis.com/v1/projects/my-project-id/locations/global/keyRings" --verbose

Request is disallowed by organization's constraints/gcp.restrictTLSCipherSuites
constraint for 'projects/my-project-id'.
Access to service cloudkms.googleapis.com attempted with a disallowed TLS Cipher
Suite: `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`.
To access this resource, please use an allowed TLS Cipher Suite.