本頁說明如何在 Cloud SQL 執行個體中建立、設定及管理自訂限制。如要瞭解自訂機構政策,請參閱這篇文章。
Cloud SQL 支援的資源
本頁說明如何使用 Organization Policy Service 自訂限制,限制對下列 Google Cloud 資源執行的特定作業:
sqladmin.googleapis.com/Instance
sqladmin.googleapis.com/BackupRun
如要進一步瞭解機構政策,請參閱自訂機構政策。
關於機構政策和限制
Google Cloud 機構政策服務可讓您透過程式以集中方式控管機構的資源。身為機構政策管理員,您可以定義機構政策,也就是一組稱為「限制」的限制,適用於Google Cloud 資源和Google Cloud 資源階層中這些資源的子系。您可以在機構、資料夾或專案層級強制執行機構政策。
機構政策提供各種 Google Cloud 服務的內建代管限制。不過,如要更精細地自訂機構政策中受限的特定欄位,也可以建立自訂限制,並在機構政策中使用這些自訂限制。
政策繼承
根據預設,機構政策會由您強制執行政策的資源子系繼承。舉例來說,如果您對資料夾強制執行政策, Google Cloud 系統會對該資料夾中的所有專案強制執行政策。如要進一步瞭解這項行為及如何變更,請參閱「階層評估規則」。
事前準備
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
Install the gcloud CLI.
-
If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.
-
To initialize the gcloud CLI, run the following command:
gcloud init
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
Install the gcloud CLI.
-
If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.
-
To initialize the gcloud CLI, run the following command:
gcloud init
- 請確認您知道機構 ID。
ORGANIZATION_ID
:您的機構 ID,例如123456789
。CONSTRAINT_NAME
:新自訂限制的名稱。自訂限制條件必須以custom.
開頭,且只能包含大寫英文字母、小寫英文字母或數字。例如,custom.region
。這個欄位的長度上限為 70 個字元。RESOURCE_NAME
:包含要限制物件和欄位的Google Cloud 資源完整名稱。例如:sqladmin.googleapis.com/Instance
。CONDITION
:針對支援服務資源的代表項目編寫的 CEL 條件。這個欄位的長度上限為 1000 個字元。如要進一步瞭解可編寫條件的資源,請參閱「支援的資源」。例如:"resource.region == "us-central1""
。ACTION
:如果符合condition
,應採取的動作。可能的值為ALLOW
和DENY
。DISPLAY_NAME
:限制條件的易記名稱。這個欄位的長度上限為 200 個字元。DESCRIPTION
:違反政策時,要以錯誤訊息形式顯示的限制說明。這個欄位的長度上限為 2000 個字元。- 前往 Google Cloud 控制台的「Organization policies」(組織政策) 頁面。
- 在專案選擇工具中,選取要設定機構政策的專案。
- 在「Organization policies」(機構政策) 頁面上的清單中選取限制條件,即可查看該限制條件的「Policy details」(政策詳情) 頁面。
- 如要設定這項資源的機構政策,請按一下「管理政策」。
- 在「編輯政策」頁面中,選取「覆寫上層政策」。
- 按一下「新增規則」。
- 在「Enforcement」(強制執行) 區段中,選取是否要強制執行這項機構政策。
- 選用:如要根據標記設定機構政策條件,請按一下「新增條件」。請注意,如果為組織政策新增條件式規則,您必須至少新增一項無條件規則,否則無法儲存政策。詳情請參閱「使用標記設定組織政策」。
- 按一下「測試變更」,模擬機構政策的影響。舊版受管理限制不支援政策模擬。詳情請參閱「 使用 Policy Simulator 測試組織政策變更」。
- 如要完成並套用機構政策,請按一下「設定政策」。這項政策最多需要 15 分鐘才會生效。
-
PROJECT_ID
:要強制執行限制的專案。 -
CONSTRAINT_NAME
:您為自訂限制定義的名稱。例如:custom.region
。
必要的角色
如要取得管理自訂機構政策所需的權限,請要求管理員為您授予機構資源的機構政策管理員 (roles/orgpolicy.policyAdmin
) IAM 角色。如要進一步瞭解如何授予角色,請參閱「管理專案、資料夾和機構的存取權」。
建立自訂限制
自訂限制是在 YAML 檔案中定義,當中包含您要強制執行機構政策的服務所支援的資源、方法、條件和動作。自訂限制的條件是使用一般運算語言 (CEL) 定義。如要進一步瞭解如何使用 CEL 在自訂限制中建構條件,請參閱「建立及管理自訂限制」一文的 CEL 一節。
如要建立自訂限制,請使用下列格式建立 YAML 檔案:
name: organizations/ORGANIZATION_ID/customConstraints/CONSTRAINT_NAME
resourceTypes:
- RESOURCE_NAME
methodTypes:
- CREATE
- UPDATE
condition: "CONDITION"
actionType: ACTION
displayName: DISPLAY_NAME
description: DESCRIPTION
更改下列內容:
如要進一步瞭解如何建立自訂限制,請參閱「定義自訂限制」。
設定自訂限制
為新的自訂限制建立 YAML 檔案後,您必須進行設定,才能在貴機構的機構政策中使用該檔案。如要設定自訂限制,請使用gcloud org-policies set-custom-constraint
指令:
gcloud org-policies set-custom-constraint CONSTRAINT_PATH
CONSTRAINT_PATH
替換為自訂限制檔案的完整路徑。例如:/home/user/customconstraint.yaml
。
完成後,自訂限制就會顯示在 Google Cloud 機構政策清單中,做為機構政策使用。如要確認自訂限制存在,請使用 gcloud org-policies list-custom-constraints
指令:gcloud org-policies list-custom-constraints --organization=ORGANIZATION_ID
ORGANIZATION_ID
替換為機構資源的 ID。
詳情請參閱「查看機構政策」。強制執行自訂機構政策
如要強制執行限制,請建立參照該限制的機構政策,然後將該政策套用至 Google Cloud 資源。控制台
gcloud
如要建立含有布林值規則的機構政策,請建立參照限制的政策 YAML 檔案:
name: projects/PROJECT_ID/policies/CONSTRAINT_NAME spec: rules: - enforce: true
取代下列項目:
如要強制執行包含限制的機構政策,請執行下列指令:
gcloud org-policies set-policy POLICY_PATH
將 POLICY_PATH
替換為機構政策 YAML 檔案的完整路徑。這項政策最多需要 15 分鐘才會生效。
常見用途的自訂機構政策範例
下表提供一些常見用途的自訂限制語法:
說明 | 限制語法 |
---|---|
確認執行個體為 Enterprise Plus |
name: organizations/ORGANIZATION_ID/customConstraints/custom.edition resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.edition == 'ENTERPRISE_PLUS'" actionType: ALLOW displayName: Instances must be Enterprise Plus. description: Cloud SQL instances must be Enterprise Plus. |
確保執行個體的可用性高 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.availability resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.availabilityType == 'REGIONAL'" actionType: ALLOW displayName: Instances must be regional. description: Cloud SQL instances must be highly available. To do this, make them regional. |
確認執行個體已套用密碼政策。 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.enforcePassword resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.passwordValidationPolicy.enablePasswordPolicy == true" actionType: ALLOW displayName: The password policy must be enabled for Cloud SQL instances. description: Cloud SQL instances must have a password policy. |
確認執行個體的密碼政策設有長度下限 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.passwordMinLength resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.passwordValidationPolicy.minLength >= 6" actionType: ALLOW displayName: The password policy must have a minimum length of six characters. description: Cloud SQL instances must have a password policy that has a minimum length of six characters. |
確認執行個體已啟用密碼政策複雜度。 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.passwordComplexity resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.passwordValidationPolicy.complexity == 'COMPLEXITY_DEFAULT'" actionType: ALLOW displayName: The password policy complexity must be enabled. description: Cloud SQL instances must have a password policy with complex passwords. |
要求啟用 SSL 模式,且僅允許加密連線。 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.sslMode resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.ipConfiguration.sslMode == 'ENCRYPTED_ONLY'" actionType: ALLOW displayName: Only allow connections that are encrypted with SSL/TLS. description: Cloud SQL instances must only allow connections that are encrypted with SSL/TLS. |
禁止從公開網際網路的任何位置存取資料庫。 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.authorizedNetworks resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.ipConfiguration.authorizedNetworks.exists(network, network.value == '0.0.0.0/0')" actionType: DENY displayName: The list of authorized networks can't contain 0.0.0.0/0 description: Authorized networks for Cloud SQL instances can't contain 0.0.0.0/0. This allows users to access the database from any IP address. |
確保建立執行個體時沒有外部 IP 位址。 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.ipv4Enabled resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.ipConfiguration.ipv4Enabled == false" actionType: ALLOW displayName: ipv4Enabled must be set to false. description: Cloud SQL instances can't have an external IP address. |
確認執行個體是以 KMS 金鑰加密。 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.encrypted resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.diskEncryptionConfiguration.kmsKeyName.size() > 0" actionType: ALLOW displayName: Instances must be encrypted with a KMS key. description: Cloud SQL instances must be disk-encrypted with a KMS key. |
確認執行個體位於 us-central1 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.region resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.region == 'us-central1'" actionType: ALLOW displayName: Instances must be in the us-central1 region. description: Cloud SQL instances must be in the us-central1 region. |
確認執行個體已啟用資料快取。 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.dataCache resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.dataCacheConfig.dataCacheEnabled == true" actionType: ALLOW displayName: Instances must have data cache enabled. description: Cloud SQL instances must have data cache enabled. |
強制執行自動備份。 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.enableBackups resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.backupConfiguration.enabled == true" actionType: ALLOW displayName: Automated backups must be enabled. description: Cloud SQL instances must have automated backups enabled. |
限制自動備份的位置。 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.automatedBackupLocation resourceTypes: - sqladmin.googleapis.com/Instance methodTypes: - CREATE - UPDATE condition: "resource.settings.backupConfiguration.location == 'us-central1'" actionType: ALLOW displayName: The location of automated backups must be in the us-central1 region. description: The location of automated backups for Cloud SQL instances must be in the us-central1 region. |
將隨選備份的位置限制為 us-central1 |
name: organizations/ORGANIZATION_ID/customConstraints/custom.onDemandBackupLocation resourceTypes: - sqladmin.googleapis.com/BackupRun methodTypes: - CREATE - UPDATE condition: "condition: resource.location == 'us-central1'" actionType: ALLOW displayName: The location of on-demand backups must be in the us-central1 region. description: On-demand backups are restricted to the us-central1. |
PostgreSQL 適用的 Cloud SQL 支援的資源
下表列出可在自訂限制中參照的 PostgreSQL 適用的 Cloud SQL 資源。資源 | 欄位 |
---|---|
sqladmin.googleapis.com/BackupRun |
resource.description
|
resource.location
| |
sqladmin.googleapis.com/Instance |
resource.databaseVersion
|
resource.diskEncryptionConfiguration.kmsKeyName
| |
resource.diskEncryptionStatus.kmsKeyVersionName
| |
resource.failoverReplica.name
| |
resource.masterInstanceName
| |
resource.name
| |
resource.nodeCount
| |
resource.project
| |
resource.region
| |
resource.replicaConfiguration.cascadableReplica
| |
resource.replicaConfiguration.failoverTarget
| |
resource.settings.activationPolicy
| |
resource.settings.activeDirectoryConfig.domain
| |
resource.settings.advancedMachineFeatures.threadsPerCore
| |
resource.settings.availabilityType
| |
resource.settings.backupConfiguration.backupRetentionSettings.retainedBackups
| |
resource.settings.backupConfiguration.backupRetentionSettings.retentionUnit
| |
resource.settings.backupConfiguration.binaryLogEnabled
| |
resource.settings.backupConfiguration.enabled
| |
resource.settings.backupConfiguration.location
| |
resource.settings.backupConfiguration.pointInTimeRecoveryEnabled
| |
resource.settings.backupConfiguration.startTime
| |
resource.settings.backupConfiguration.transactionLogRetentionDays
| |
resource.settings.collation
| |
resource.settings.connectionPoolConfig.connectionPoolingEnabled
| |
resource.settings.connectionPoolConfig.flags.name
| |
resource.settings.connectionPoolConfig.flags.value
| |
resource.settings.connectorEnforcement
| |
resource.settings.databaseFlags.name
| |
resource.settings.databaseFlags.value
| |
resource.settings.dataCacheConfig.dataCacheEnabled
| |
resource.settings.dataDiskProvisionedIops
| |
resource.settings.dataDiskProvisionedThroughput
| |
resource.settings.dataDiskSizeGb
| |
resource.settings.dataDiskType
| |
resource.settings.deletionProtectionEnabled
| |
resource.settings.denyMaintenancePeriods.endDate
| |
resource.settings.denyMaintenancePeriods.startDate
| |
resource.settings.denyMaintenancePeriods.time
| |
resource.settings.edition
| |
resource.settings.enableDataplexIntegration
| |
resource.settings.enableGoogleMlIntegration
| |
resource.settings.insightsConfig.queryInsightsEnabled
| |
resource.settings.insightsConfig.queryPlansPerMinute
| |
resource.settings.insightsConfig.queryStringLength
| |
resource.settings.insightsConfig.recordApplicationTags
| |
resource.settings.insightsConfig.recordClientAddress
| |
resource.settings.ipConfiguration.authorizedNetworks.name
| |
resource.settings.ipConfiguration.authorizedNetworks.value
| |
resource.settings.ipConfiguration.customSubjectAlternativeNames
| |
resource.settings.ipConfiguration.enablePrivatePathForGoogleCloudServices
| |
resource.settings.ipConfiguration.ipv4Enabled
| |
resource.settings.ipConfiguration.privateNetwork
| |
resource.settings.ipConfiguration.pscConfig.allowedConsumerProjects
| |
resource.settings.ipConfiguration.pscConfig.pscAutoConnections.consumerNetwork
| |
resource.settings.ipConfiguration.pscConfig.pscAutoConnections.consumerProject
| |
resource.settings.ipConfiguration.pscConfig.pscEnabled
| |
resource.settings.ipConfiguration.serverCaMode
| |
resource.settings.ipConfiguration.serverCaPool
| |
resource.settings.ipConfiguration.sslMode
| |
resource.settings.locationPreference.secondaryZone
| |
resource.settings.locationPreference.zone
| |
resource.settings.maintenanceWindow.day
| |
resource.settings.maintenanceWindow.hour
| |
resource.settings.maintenanceWindow.updateTrack
| |
resource.settings.passwordValidationPolicy.complexity
| |
resource.settings.passwordValidationPolicy.disallowUsernameSubstring
| |
resource.settings.passwordValidationPolicy.enablePasswordPolicy
| |
resource.settings.passwordValidationPolicy.minLength
| |
resource.settings.passwordValidationPolicy.passwordChangeInterval
| |
resource.settings.passwordValidationPolicy.reuseInterval
| |
resource.settings.replicationLagMaxSeconds
| |
resource.settings.retainBackupsOnDelete
| |
resource.settings.sqlServerAuditConfig.bucket
| |
resource.settings.sqlServerAuditConfig.retentionInterval
| |
resource.settings.sqlServerAuditConfig.uploadInterval
| |
resource.settings.storageAutoResize
| |
resource.settings.tier
| |
resource.settings.timeZone
|