# 4.10 Ensure That App Engine Applications Enforce HTTPS Connections (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233024-4-10-ensure-that-app-engine-applications-enforce-https-connections-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability: - Level 2 Description: To ensure secure communication, all connections to App Engine applications should be secured by HTTPS by default. This prevents sensitive data from being transmitted over insecure channels. Rationale: Insecure HTTP connections are vulnerable to eavesdropping and man-in-the-middle attacks, potentially exposing sensitive data such as user credentials and other private information. By enforcing HTTPS connections, applications ensure secure, encrypted communication between the client and server. Impact: All incoming HTTP connections will be automatically redirected to the corresponding HTTPS endpoint. This guarantees that all traffic is encrypted using TLS. Default Value: By default, App Engine applications support both HTTP and HTTPS connections. However, HTTPS is not enforced unless explicitly configured. Audit Steps: #### Check Configuration in app.yaml File: 1. Locate the app.yaml file for the application. Verify that the following configuration exists to enforce secure connections: handlers: - url: /.\* secure: always redirect\_http\_response\_code: 301 script: auto[](https://cloud.google.com/appengine/docs/standard/python3/config/appref)[](https://cloud.google.com/appengine/docs/standard/python3/config/appref) Remediation Steps: #### Modify the app.yaml File: 1. Open the app.yaml file for the application. Add or modify the configuration to enforce HTTPS connections: handlers: - url: /.\* secure: always redirect\_http\_response\_code: 301 script: auto Redeploy the application to App Engine: gcloud app deploy ### Backout Plan: Disable Confidential Computing: If confidential computing needs to be disabled, run the following command to disable it on an existing instance: gcloud compute instances update \[INSTANCE\_NAME\] \\ --zone \[ZONE\] \\ --no-confidential-compute - This command will remove confidential computing settings from the instance. 2. Revert to Previous Instance Configuration: If you need to revert to the previous instance configuration, restore the instance to its original settings or recreate the VM without the confidential computing option. 3. Test and Verify: After rolling back, verify that the instance is working as expected and that confidential computing is no longer enabled. Notify Stakeholders: Notify the relevant teams and stakeholders about the backout and any operational impact it might have on workloads. References: 1. [App Engine](https://cloud.google.com/appengine/docs/standard/python3/config/appref) [app.yaml Configuration Reference](https://cloud.google.com/appengine/docs/standard/python3/config/appref) CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.10 Encrypt Sensitive Data in Transit

Encrypt all sensitive data in transit using mechanisms such as TLS or SSH.

✅

✅


16.11 Leverage Vetted Security Components

Use vetted and secure modules for application security components like encryption and authentication to minimize implementation errors.

✅

✅


18.5 Use Standard Encryption Algorithms

Ensure the use of standardized and extensively reviewed encryption algorithms to protect sensitive data.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.