Cette page explique comment ajouter des règles d'administration sur des instances Cloud SQL, afin d'appliquer des restrictions à Cloud SQL au niveau du projet, du dossier ou de l'organisation. Pour en savoir plus, consultez la page Règles d'administration Cloud SQL.
Avant de commencer
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Pour initialiser la gcloud CLI, exécutez la commande suivante :
gcloudinit
Ajoutez le rôle Administrateur des règles d'administration (roles/orgpolicy.policyAdmin) à votre compte utilisateur ou de service depuis la page IAM et admin.
Cliquez sur le menu déroulant des projets dans l'onglet supérieur, puis sélectionnez le projet, le dossier ou l'organisation qui requiert la règle d'administration. La page Règles d'administration affiche une liste des contraintes de règles d'administration qui sont disponibles.
Filtrez la liste sur la contrainte name ou display_name.
Pour désactiver l'accès depuis ou à Internet :
name:"constraints/sql.restrictPublicIp"display_name:"Restrict Public IP access on Cloud SQL instances"
Pour désactiver l'accès depuis Internet lorsque l'authentification IAM est manquante (cela n'affecte pas l'accès via l'adresse IP privée) :
name:"constraints/sql.restrictAuthorizedNetworks"display_name:"Restrict Authorized Networks on Cloud SQL instances"
Cliquez sur le menu déroulant des projets dans l'onglet supérieur, puis sélectionnez le projet, le dossier ou l'organisation qui requiert la règle d'administration. La page Règles d'administration affiche une liste des contraintes de règles d'administration qui sont disponibles.
Filtrez la liste sur la contrainte name ou display_name.
Pour placer des noms de services dans une liste DENY (refus), assurez-vous que le chiffrement CMEK est utilisé dans les ressources de ce service:
name:"constraints/gcp.restrictNonCmekServices"display_name:"Restrict which services may create resources without CMEK"
Vous devez ajouter sqladmin.googleapis.com à la liste des services limités par la contrainte Deny (refus).
Pour placer des ID de projet dans une liste ALLOW (autorisé), assurez-vous que seules les clés d'une instance Cloud KMS de ce projet sont utilisées pour CMEK.
name:"constraints/gcp.restrictCmekCryptoKeyProjects"display_name:"Restrict which projects may supply KMS CryptoKeys for CMEK"
Sélectionnez le nom de la règle dans la liste.
Cliquez sur Modifier.
Cliquez sur Personnaliser.
Cliquez sur Add rule (Ajouter une règle).
Sous Valeurs de règles, cliquez sur Personnalisé.
Pour constraints/gcp.restrictNonCmekServices : Sous Types de règles, sélectionnez Refuser.
b. Sous Valeurs personnalisées, saisissez sqladmin.googleapis.com.
Pour constraints/gcp.restrictCmekCryptoKeyProjects : Sous Types de règles, sélectionnez Autoriser. Sous Valeurs personnalisées, saisissez la ressource au format suivant : under:organizations/ORGANIZATION_ID, under:folders/FOLDER_ID ou projects/PROJECT_ID.
Sauf indication contraire, le contenu de cette page est régi par une licence Creative Commons Attribution 4.0, et les échantillons de code sont régis par une licence Apache 2.0. Pour en savoir plus, consultez les Règles du site Google Developers. Java est une marque déposée d'Oracle et/ou de ses sociétés affiliées.
Dernière mise à jour le 2025/09/03 (UTC).
[[["Facile à comprendre","easyToUnderstand","thumb-up"],["J'ai pu résoudre mon problème","solvedMyProblem","thumb-up"],["Autre","otherUp","thumb-up"]],[["Difficile à comprendre","hardToUnderstand","thumb-down"],["Informations ou exemple de code incorrects","incorrectInformationOrSampleCode","thumb-down"],["Il n'y a pas l'information/les exemples dont j'ai besoin","missingTheInformationSamplesINeed","thumb-down"],["Problème de traduction","translationIssue","thumb-down"],["Autre","otherDown","thumb-down"]],["Dernière mise à jour le 2025/09/03 (UTC)."],[],[],null,["# Add predefined organization policies\n\n\u003cbr /\u003e\n\n[MySQL](/sql/docs/mysql/org-policy/configure-org-policy \"View this page for the MySQL database engine\") \\| PostgreSQL \\| [SQL Server](/sql/docs/sqlserver/org-policy/configure-org-policy \"View this page for the SQL Server database engine\")\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nThis page describes how to add organization policies on Cloud SQL\ninstances, to put restrictions on Cloud SQL at the project, folder, or\norganization level. For an overview, see [Cloud SQL organization policies](/sql/docs/postgres/org-policy/org-policy).\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n [Install](/sdk/docs/install) the [gcloud CLI](/sdk/gcloud).\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n [Install](/sdk/docs/install) the [gcloud CLI](/sdk/gcloud).\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n1. Add the **Organization Policy Administrator** role ([`roles/orgpolicy.policyAdmin`](/iam/docs/understanding-roles#organization-policy-roles)) to your user or service account from the **IAM \\& Admin** page.\n\n\n [Go to the IAM accounts page](https://console.cloud.google.com/iam-admin/iam)\n2. See [Restrictions](/sql/docs/postgres/org-policy/org-policy#restrictions) before performing this procedure.\n\n\u003cbr /\u003e\n\nAdd the connection organization policy\n--------------------------------------\n\nFor an overview see [Connection organization policies](/sql/docs/postgres/org-policy/org-policy#connection-organization-policy).\n\nTo add a connection organization policy:\n\n1. Go to the **Organization policies** page.\n\n [Go to the Organization policies page](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. Click projects dropdown menu in the top tab, and then select the project, folder,\n or organization that requires the organization policy. The\n **Organization policies** page displays a list of organization policy\n constraints that are available.\n\n3. Filter for the constraint `name` or `display_name`.\n\n - To disable access to or from the Internet:\n\n name: \"constraints/sql.restrictPublicIp\"\n display_name: \"Restrict Public IP access on Cloud SQL instances\"\n\n - To disable access from the internet when IAM authentication is missing\n (this does not affect access using Private IP):\n\n name: \"constraints/sql.restrictAuthorizedNetworks\"\n display_name: \"Restrict Authorized Networks on Cloud SQL instances\"\n\n4. Select the policy **Name** from the list.\n\n5. Click **Edit**.\n\n6. Click **Customize**.\n\n7. Click **Add rule**.\n\n8. Under **Enforcement** , click **On**.\n\n9. Click **Save**.\n\nAdd the CMEK organization policy\n--------------------------------\n\nFor an overview, see [Customer-managed encryption keys organization policies](/sql/docs/postgres/org-policy/org-policy#cmek-organization-policy).\n\nTo add a CMEK organization policy:\n\n1. Go to the **Organization policies** page.\n\n [Go to the Organization policies page](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. Click projects dropdown menu in the top tab, and then select the project, folder,\n or organization that requires the organization policy. The\n **Organization policies** page displays a list of organization policy\n constraints that are available.\n\n3. Filter for the constraint `name` or `display_name`.\n\n - To put service names in a DENY list to ensure that CMEK is used in the\n resources for that service:\n\n name: \"constraints/gcp.restrictNonCmekServices\"\n display_name: \"Restrict which services may create resources without CMEK\"\n\n You must add `sqladmin.googleapis.com` to the list of restricted services\n with Deny.\n - To put project IDs in an ALLOW list to ensure that only keys from an\n instance of Cloud KMS within that project are used for CMEK.\n\n name: \"constraints/gcp.restrictCmekCryptoKeyProjects\"\n display_name: \"Restrict which projects may supply KMS CryptoKeys for CMEK\"\n\n4. Select the policy **Name** from the list.\n\n5. Click **Edit**.\n\n6. Click **Customize**.\n\n7. Click **Add rule**.\n\n8. Under **Policy values** , click **Custom**.\n\n9. For `constraints/gcp.restrictNonCmekServices`:\n a. Under **Policy types** , select **Deny** .\n b. Under **Custom values** , enter `sqladmin.googleapis.com`.\n\n For `constraints/gcp.restrictCmekCryptoKeyProjects`:\n a. Under **Policy types** , select **Allow** .\n b. Under **Custom values** , enter the resource using the following format:\n `under:organizations/ORGANIZATION_ID`,\n `under:folders/FOLDER_ID`, or `projects/PROJECT_ID`.\n10. Click **Done**.\n\n11. Click **Save**.\n\nWhat's next\n-----------\n\n- Learn about [Organization policies](/sql/docs/postgres/org-policy/org-policy).\n- Learn about how [private IP](/sql/docs/postgres/private-ip) works with Cloud SQL.\n- Learn how to [configure private IP](/sql/docs/postgres/configure-private-ip) for Cloud SQL.\n- Learn about the [organization policy service](/resource-manager/docs/organization-policy/overview).\n- Learn about [organization policy constraints](/resource-manager/docs/organization-policy/understanding-constraints)."]]
