UPDATE Sept-2019: Google's recent changes to Google Search Console has made my original answer (below) a bit outdated and in some respects incorrect.
You can now submit two different types of properties in GSC:
"URL-prefix property", which is the same as the property type mentioned here. In this case you would still submit all variations as required, ie
https://www, etc. This allows you to prove ownership of these separate properties and monitor the non-canonical properties for errors, index-status etc. However, going forward, you only submit sitemaps to the canonical property ie.
https://www.example.com in this case.
"Domain property" - allows you to create a single property for an entire domain, eg.
foo.bar.example.com. This naturally includes all additional subdomains (eg.
www, etc.) and protocols (
HTTP and `HTTPS), so multiple properties do not need to be submitted in this case. However, you can create filters to report on specific protocols or subdomains as required.
You can mix both property types for the "same domain" as required.
Original answer... now outdated / historical reference only
Yes, that is correct. You need to submit and verify all four properties in Google Search Console (GSC) - formerly Google Webmaster Tools.
However, from now on you only submit sitemaps etc. to
https://www.example.com (ie. your canonical domain/property).
By submitting all variations of your site to GSC (and verifying them), you are proving ownership, you can specify the preferred domain (www or non-www*1 - if your redirect does fail for whatever reason) and you can make sure that everything is working correctly by periodically checking the reports in these other properties. ie. making sure that
http://example.com isn't getting indexed, ...for whatever reason.
As of May 23, 2016, you can now group these related properties in a single property set.
UPDATE: Property sets were removed from Search Console at the end of March, 2019. Google announced this in 25-Jan-2019 and users that made use of this feature were emailed in February 2019. ("Property sets" have been replaced with "domain properties" - see bove)
HTTP / HTTPS preference
Whilst you can set a preference for the domain (ie. www or non-www)*1, GSC does not allow you to explicitly set the preferred protocol. However, Google will naturally prefer the HTTPS protocol. You should also ensure that the HTTPS version is set as the canonical version in-page (ie. in the
rel="canonical" link tag) and configure 301 redirects from HTTP to HTTPS. If you want to make HTTPS permanent then consider implementing HSTS (and even submission to the HSTS preload list) if you want to go the whole hog.
*1 On 18-June-2019, Google announced they were removing the www vs non-www preference in GSC. The original help document that explained this process has been removed (404).