이 페이지에서는 관리자가 시행한 constraints/sql.restrictPublicIp 조직 정책을 위반하는 인스턴스에서 공개 IP 액세스를 중지하는 방법에 대한 추천을 확인하고 구현하는 방법을 설명합니다. 이 정책은 인스턴스의 공개 IP 구성을 제한합니다. 제약조건을 시행할 때 인스턴스에 대한 공개 IP 액세스가 이미 존재하는 경우에 이러한 정책 위반이 발생합니다. 이 추천자를 공개 IP 사용 중지라고 부릅니다.
매일 이 추천자가 constraints/sql.restrictPublicIp 조직 정책을 위반하는 인스턴스를 감지하고 인스턴스 보안을 개선하기 위한 통계와 추천을 제공합니다. Google Cloud 콘솔, gcloud CLI 또는 Recommender API를 사용하여 이러한 인스턴스에 대한 통계와 자세한 추천을 볼 수 있습니다.
GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.cloudsql.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=DISABLE_PUBLIC_IP_TO_MEET_ORG_POLICY
GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.cloudsql.instance.SecurityInsight/insights?filter=insightSubtype=ORG_POLICY_TO_RESTRICT_PUBLIC_IP_VIOLATED
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-08-19(UTC)"],[],[],null,["# Improve instance security by disabling public IP\n\n\u003cbr /\u003e\n\n[MySQL](/sql/docs/mysql/recommender-disable-public-ip \"View this page for the MySQL database engine\") \\| [PostgreSQL](/sql/docs/postgres/recommender-disable-public-ip \"View this page for the PostgreSQL database engine\") \\| SQL Server\n\n\u003cbr /\u003e\n\nThis page describes how to view and implement recommendations about\ndisabling public IP access for instances that violate the\n[`constraints/sql.restrictPublicIp` organization policy](/sql/docs/mysql/org-policy/org-policy#connection-constraints) enforced by your\nadministrator. This policy restricts the configuration of public IP on your instances. The policy violation occurs when public IP access already exists for an instance at the time of enforcement of the constraint. This [recommender](/recommender/docs/overview) is called **Disable public IP**.\n\nEvery day, this recommender detects the instances that violate the\n`constraints/sql.restrictPublicIp` organization policy and provides insights and recommendations to improve\nyour instance security. You can view insights and detailed recommendations about these instances by using the Google Cloud console,\n[gcloud CLI](/sdk/gcloud), or the [Recommender API](/recommender/docs/using-api).\n\nFor more information about organization policies, see [Cloud SQL organization policies](/sql/docs/sqlserver/org-policy/org-policy).\n\nBefore you begin\n----------------\n\nEnsure that you [enable the Recommender API](/recommender/docs/enabling).\n\n### Required roles and permissions\n\nTo get the permissions to view and work with insights and recommendations,\nensure that you have the required [Identity and Access Management (IAM) roles](/sql/docs/sqlserver/project-access-control#roles).\n\nFor more information about IAM roles, see [IAM basic and predefined roles reference](/iam/docs/understanding-roles) and [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\u003cbr /\u003e\n\nList the recommendations\n------------------------\n\nTo list the recommendations, follow these steps: \n\n### Console\n\nTo list recommendations about instance security, follow these steps:\n\n1. Go to the **Cloud SQL Instances** page.\n\n [Go to Cloud SQL Instances](https://console.cloud.google.com/sql/instances)\n2. View the **Issues** column in the instance table.\n\nAlternatively, follow these steps:\n\n1. Go to the **Recommendation Hub**.\n\n [Go to the Recommendation Hub](https://console.cloud.google.com/home/recommendations/)\n\n For more information, see [Exploring recommendations](/recommender/docs/recommendation-hub/identify-configuration-problems).\n2. In the **All recommendations** card, click **Security**.\n\n### gcloud\n\nRun the [`gcloud recommender recommendations list`](/sdk/gcloud/reference/recommender/recommendations/list) command as follows: \n\n```\ngcloud recommender recommendations list \\\n--project=PROJECT_ID \\\n--location=LOCATION \\\n--recommender=google.cloudsql.instance.SecurityRecommender \\\n--filter=recommenderSubtype=DISABLE_PUBLIC_IP_TO_MEET_ORG_POLICY\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: A region where your instances are located, such as us-central1.\n\n### API\n\nCall the [`recommendations.list`](/recommender/docs/reference/rest/v1beta1/projects.locations.recommenders.recommendations/list) method as follows: \n\n```\nGET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.cloudsql.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=DISABLE_PUBLIC_IP_TO_MEET_ORG_POLICY\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: A region where your instances are located, such as `us-central1`.\n\nView insights and detailed recommendations\n------------------------------------------\n\nTo view insights and detailed recommendations, follow these steps: \n\n### Console\n\nAfter listing the recommendations, click a recommendation.\nThe recommendation panel appears, which contains insights and detailed recommendations.\n\n### gcloud\n\nRun the [`gcloud recommender insights list`](/sdk/gcloud/reference/recommender/insights/list) command as follows: \n\n```\n\ngcloud recommender insights list \\\n--project=PROJECT_ID \\\n--location=LOCATION \\\n--insight-type=google.cloudsql.instance.SecurityInsight \\\n--filter=insightSubtype=ORG_POLICY_TO_RESTRICT_PUBLIC_IP_VIOLATED\n\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e : A region where your instances are located, such as `us-central1`.\n\n### API\n\nCall the [`insights.list`](/recommender/docs/reference/rest/v1beta1/projects.locations.insightTypes.insights/list) method as follows: \n\n```\n\nGET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.cloudsql.instance.SecurityInsight/insights?filter=insightSubtype=ORG_POLICY_TO_RESTRICT_PUBLIC_IP_VIOLATED\n\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: Your project ID.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: A region where your instances are located, such as `us-central1`.\n\nApply the recommendation\n------------------------\n\n### Console\n\nTo implement the recommendation, do the following:\n\n1. Click **Manage instance IP assignment**.\n\n2. Configure your clients to connect to the instance using [private IP](/sql/docs/sqlserver/configure-private-ip).\n\n3. [Disable public IP](/sql/docs/sqlserver/configure-ip#disable-public)\n on your instance.\n\n### gcloud\n\nTo implement the recommendation, do the following:\n\n1. Configure your clients to connect to the instance using [private IP](/sql/docs/sqlserver/configure-private-ip).\n\n2. [Disable public IP](/sql/docs/sqlserver/configure-ip#disable-public)\n on your instance.\n\n### API\n\nTo implement the recommendation, do the following:\n\n1. Configure your clients to connect to the instance using [private IP](/sql/docs/sqlserver/configure-private-ip).\n\n2. [Disable public IP](/sql/docs/sqlserver/configure-ip#disable-public)\n on your instance.\n\nWhat's next\n-----------\n\n- [Disable public IP](/sql/docs/sqlserver/configure-ip#disable-public)\n- [Configure private IP](/sql/docs/sqlserver/configure-private-ip)\n- [Google Cloud recommenders](/recommender/docs/recommenders)\n- [Blog: Maximize your Cloud ROI](https://cloud.google.com/blog/products/management-tools/active-assist-comes-to-google-cloud)"]]
