Yes, that is correct. You need to submit and verify all four properties in Google Search Console (GSC) - formerly Google Webmaster Tools.
However, from now on you only submit sitemaps etc. to
https://www.example.com (ie. your canonical domain/property).
By submitting all variations of your site to GSC (and verifying them), you are proving ownership, you can specify the preferred domain (www or non-www - if your redirect does fail for whatever reason) and you can make sure that everything is working correctly by periodically checking the reports in these other properties. ie. making sure that
http://example.com isn't getting indexed, ...for whatever reason.
As of May 23, 2016, you can now group these related properties in a single property set.
HTTP / HTTPS preference
Whilst you can set a preference for the domain (ie. www or non-www), GSC does not allow you to explicitly set the preferred protocol. However, Google will naturally prefer the HTTPS protocol. You should also ensure that the HTTPS version is set as the canonical version in-page (ie. in the
rel="canonical" link tag) and configure 301 redirects from HTTP to HTTPS. If you want to make HTTPS permanent then consider implementing HSTS (and even submission to the HSTS preload list) if you want to go the whole hog.