조직 정책을 설정, 변경 또는 삭제하는 데 필요한 권한을 얻으려면 관리자에게 조직에 대한 조직 정책 관리자 (roles/orgpolicy.policyAdmin) IAM 역할을 부여해 달라고 요청하세요.
역할 부여에 대한 자세한 내용은 프로젝트, 폴더, 조직에 대한 액세스 관리를 참조하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["# Restrict TLS cipher suites on a Looker (Google Cloud core) instance\n\nGoogle Cloud supports multiple TLS cipher suites. To meet security or compliance requirements, you may want to deny requests from clients that use less secure TLS cipher suites.\n\nThe [`gcp.restrictTLSCipherSuites`](/assured-workloads/docs/restrict-tls-cipher-suites)\norganization policy constraint provides this capability.\n\nBefore you begin\n----------------\n\n\nTo get the permissions that\nyou need to set, change, or delete organization policies,\n\nask your administrator to grant you the\n\n\n[Organization Policy Administrator](/iam/docs/roles-permissions/orgpolicy#orgpolicy.policyAdmin) (`roles/orgpolicy.policyAdmin`)\nIAM role on the organization.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nSetting the organization policy\n-------------------------------\n\nThe `gcp.restrictTLSCipherSuites` organization policy constraint can be applied to Looker (Google Cloud core) instances that use a [public IP networking configuration](/looker/docs/looker-core-networking-options#public_ip_connections).\n\nYou can apply the constraint before or after you create the instance.\n\nFollow the instructions on the [Restrict TLS cipher suites](/assured-workloads/docs/restrict-tls-cipher-suites#restrict) documentation page to set the organization policy. Looker (Google Cloud core) is compliant with the Google-managed [MODERN SSL policy profile](/load-balancing/docs/ssl-policies-concepts#defining_an_ssl_policy) and supports the cipher suites that are in that profile.\n\nIf you set or change the organization policy after the Looker (Google Cloud core) instance is created, you must perform one of the following actions to apply the organization policy update to the Looker (Google Cloud core) instance:\n\n- [Restart](/looker/docs/looker-core-delete-restart#restart_a_instance) the instance.\n- [Edit](/looker/docs/looker-core-view-console#config_edit) a Looker (Google Cloud core) setting within the Google Cloud console or through the `gcloud` CLI.\n\nPolicy violations\n-----------------\n\nIf you set the organization policy restraint to allow no [MODERN cipher suites](/load-balancing/docs/ssl-policies-concepts#defining_an_ssl_policy) supported by Looker (Google Cloud core), you will be unable to create, update, or restart the Looker (Google Cloud core) instance and will receive the following error: \n\n```bash\ncom.google.apps.framework.request.FailedPreconditionException:\nConstraint`constraints/gcp.restrictTLSCipherSuites` is violated for resource\n`resourcemanager_projects``PROJECT_ID` Code: FAILED_PRECONDITION\n```\n\nThis output includes the \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e value, which is the ID of the project that is hosting the Looker (Google Cloud core) instance.\n\nTo address the violation, update the `gcp.restrictTLSCipherSuites` organization policy to allow at least one supported cipher suite."]]
