Add custom organization policies

MySQL  |  PostgreSQL  |  SQL Server

This page describes how to create, set up, and manage custom constraints in Cloud SQLinstances. For an overview of custom organization policies, seecustom organization policies.

Cloud SQL supported resources

This page shows you how to use Organization Policy Service custom constraints to restrictspecific operations on the following Google Cloud resources:

  • sqladmin.googleapis.com/Instance
  • sqladmin.googleapis.com/BackupRun

To learn more about Organization Policy, seeCustom organization policies.

About organization policies and constraints

The Google Cloud Organization Policy Service gives you centralized, programmaticcontrol over your organization's resources. As theorganization policy administrator, you can define an organizationpolicy, which is a set of restrictions calledconstraints that apply toGoogle Cloud resources and descendants of those resources in theGoogle Cloud resource hierarchy. You can enforce organizationpolicies at the organization, folder, or project level.

Organization Policy provides built-inmanaged constraintsfor various Google Cloud services. However, if you want more granular,customizable control over the specific fields that are restricted in yourorganization policies, you can also createcustom constraints and use thosecustom constraints in an organization policy.

Policy inheritance

By default, organization policies are inherited by the descendants of theresources on which you enforce the policy. For example, if you enforce a policyon a folder, Google Cloud enforces the policy on all projects in thefolder. To learn more about this behavior and how to change it, refer toHierarchy evaluation rules.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission.Learn how to grant roles.
    Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Install thegcloud CLI.

  5. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  6. Toinitialize the gcloud CLI, run the following command:

    gcloudinit

  7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains theresourcemanager.projects.create permission.Learn how to grant roles.
    Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

    Go to project selector

  8. Verify that billing is enabled for your Google Cloud project.

  9. Install thegcloud CLI.

  10. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  11. Toinitialize the gcloud CLI, run the following command:

    gcloudinit
  12. Ensure that you know yourorganization ID.

Required roles

To get the permissions that you need to manage custom organization policies, ask your administrator to grant you theOrganization Policy Administrator (roles/orgpolicy.policyAdmin) IAM role on the organization resource. For more information about granting roles, seeManage access to projects, folders, and organizations.

You might also be able to get the required permissions throughcustom roles or otherpredefined roles.

Create a custom constraint

A custom constraint is defined in a YAML file by the resources, methods,conditions, and actions that are supported by the service on which you areenforcing the organization policy. Conditions for your custom constraints aredefined usingCommon Expression Language (CEL). For more information about how to buildconditions in custom constraints using CEL, see the CEL section ofCreating and managing custom constraints.

To create a custom constraint, create a YAML file using the following format:

name:organizations/ORGANIZATION_ID/customConstraints/CONSTRAINT_NAMEresourceTypes:-RESOURCE_NAMEmethodTypes:-CREATE-UPDATEcondition:"CONDITION"actionType:ACTIONdisplayName:DISPLAY_NAMEdescription:DESCRIPTION

Replace the following:

  • ORGANIZATION_ID: your organization ID, such as123456789.

  • CONSTRAINT_NAME: the name you want for your newcustom constraint. A custom constraint must start withcustom., and canonly include uppercase letters, lowercase letters, or numbers. Forexample,custom.region. The maximum length of this field is70 characters.

  • RESOURCE_NAME: the fully qualified name of theGoogle Cloud resource containing the object and field you want torestrict. For example,sqladmin.googleapis.com/Instance.

  • CONDITION: aCEL condition that is written againsta representation of a supported service resource. Thisfield has a maximum length of 1000 characters. SeeSupported resources for more information about theresources available to write conditions against. For example,"resource.region == "us-central1"".

  • ACTION: the action to take if thecondition ismet.Possible values areALLOW andDENY.

  • DISPLAY_NAME: a human-friendly name for theconstraint. This field has a maximum length of 200 characters.

  • DESCRIPTION: a human-friendly description of theconstraint to display as an error message when the policy is violated. Thisfield has a maximum length of 2000 characters.

For more information about how to create a custom constraint, seeDefining custom constraints.

Set up a custom constraint

After you have created the YAML file for a new custom constraint, you must set it up to makeit available for organization policies in your organization. To set up a custom constraint, usethegcloud org-policies set-custom-constraint command:
gcloudorg-policiesset-custom-constraintCONSTRAINT_PATH
ReplaceCONSTRAINT_PATH with the full path to yourcustom constraint file. For example,/home/user/customconstraint.yaml.Once completed, your custom constraints are available as organization policiesin your list of Google Cloud organization policies.To verify that the custom constraint exists, use thegcloud org-policies list-custom-constraints command:
gcloudorg-policieslist-custom-constraints--organization=ORGANIZATION_ID
ReplaceORGANIZATION_ID with the ID of your organization resource.For more information, seeViewing organization policies.

Enforce a custom organization policy

You can enforce a constraint by creating an organization policy that references it, and thenapplying that organization policy to a Google Cloud resource.

Console

  1. In the Google Cloud console, go to theOrganization policies page.

    Go to Organization policies

  2. From the project picker, select the project for which you want to set the organization policy.
  3. From the list on theOrganization policies page, select your constraint to view thePolicy details page for that constraint.
  4. To configure the organization policy for this resource, clickManage policy.
  5. On theEdit policy page, selectOverride parent's policy.
  6. ClickAdd a rule.
  7. In theEnforcement section, select whether enforcement of this organization policy is on or off.
  8. Optional: To make the organization policy conditional on a tag, clickAdd condition. Note that if you add a conditional rule to an organization policy, you must add at least one unconditional rule or the policy cannot be saved. For more information, seeSetting an organization policy with tags.
  9. ClickTest changes to simulate the effect of the organization policy. Policy simulation isn't available for legacy managed constraints. For more information, see Test organization policy changes with Policy Simulator.
  10. To finish and apply the organization policy, clickSet policy. The policy requires up to 15 minutes to take effect.

gcloud

To create an organization policy with boolean rules, create a policy YAML file that references the constraint:

name:projects/PROJECT_ID/policies/CONSTRAINT_NAMEspec:rules:-enforce:true

Replace the following:

  • PROJECT_ID: the project on which you want to enforce your constraint.
  • CONSTRAINT_NAME: the name you defined for your custom constraint. For example,custom.region.

To enforce the organization policy containing the constraint, run the following command:

gcloudorg-policiesset-policyPOLICY_PATH

ReplacePOLICY_PATH with the full path to your organization policy YAML file. The policy requires up to 15 minutes to take effect.

Example custom organization policies for common use cases

This table provides syntax examples for some common custom constraints.

DescriptionConstraint syntax
Ensure that instances are Enterprise Plus
name:organizations/ORGANIZATION_ID/customConstraints/custom.editionresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.edition=='ENTERPRISE_PLUS'"actionType:ALLOWdisplayName:Instances must be Enterprise Plus.description:Cloud SQL instances must be Enterprise Plus.
Ensure instances are highly available
name:organizations/ORGANIZATION_ID/customConstraints/custom.availabilityresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.availabilityType=='REGIONAL'"actionType:ALLOWdisplayName:Instances must be regional.description:Cloud SQL instances must be highly available. To do this, make them regional.
Ensure that instances have a password policy.
name:organizations/ORGANIZATION_ID/customConstraints/custom.enforcePasswordresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.passwordValidationPolicy.enablePasswordPolicy==true"actionType:ALLOWdisplayName:The password policy must be enabled for Cloud SQL instances.description:Cloud SQL instances must have a password policy.
Ensure that the password policy for instances has a minimum length
name:organizations/ORGANIZATION_ID/customConstraints/custom.passwordMinLengthresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.passwordValidationPolicy.minLength>=6"actionType:ALLOWdisplayName:The password policy must have a minimum length of six characters.description:Cloud SQL instances must have a password policy that has a minimum length of six characters.
Ensure that instances have password policy complexity enabled.
name:organizations/ORGANIZATION_ID/customConstraints/custom.passwordComplexityresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.passwordValidationPolicy.complexity=='COMPLEXITY_DEFAULT'"actionType:ALLOWdisplayName:The password policy complexity must be enabled.description:Cloud SQL instances must have a password policy with complex passwords.
Require the SSL Mode to be enabled with encrypted connections only.
name:organizations/ORGANIZATION_ID/customConstraints/custom.sslModeresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.ipConfiguration.sslMode=='ENCRYPTED_ONLY'"actionType:ALLOWdisplayName:Only allow connections that are encrypted with SSL/TLS.description:Cloud SQL instances must only allow connections that are encrypted with SSL/TLS.
Block database access from anywhere in the public internet.
name:organizations/ORGANIZATION_ID/customConstraints/custom.authorizedNetworksresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.ipConfiguration.authorizedNetworks.exists(network,network.value=='0.0.0.0/0')"actionType:DENYdisplayName:The list of authorized networks can't contain 0.0.0.0/0description:Authorized networks for Cloud SQL instances can't contain 0.0.0.0/0. This allows users to access the database from any IP address.
Ensure that instances aren't created with an external IP address.
name:organizations/ORGANIZATION_ID/customConstraints/custom.ipv4EnabledresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.ipConfiguration.ipv4Enabled==false"actionType:ALLOWdisplayName:ipv4Enabled must be set to false.description:Cloud SQL instances can't have an external IP address.
Ensure that instances are encrypted with a KMS key.
name:organizations/ORGANIZATION_ID/customConstraints/custom.encryptedresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.diskEncryptionConfiguration.kmsKeyName.size() >0"actionType:ALLOWdisplayName:Instances must be encrypted with a KMS key.description:Cloud SQL instances must be disk-encrypted with a KMS key.
Ensure Instances are in the us-central1
name:organizations/ORGANIZATION_ID/customConstraints/custom.regionresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.region=='us-central1'"actionType:ALLOWdisplayName:Instances must be in the us-central1 region.description:Cloud SQL instances must be in the us-central1 region.
Ensure that instances have data cache enabled.
name:organizations/ORGANIZATION_ID/customConstraints/custom.dataCacheresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.dataCacheConfig.dataCacheEnabled==true"actionType:ALLOWdisplayName:Instances must have data cache enabled.description:Cloud SQL instances must have data cache enabled.
Enforce automated backups.
name:organizations/ORGANIZATION_ID/customConstraints/custom.enableBackupsresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.backupConfiguration.enabled==true"actionType:ALLOWdisplayName:Automated backups must be enabled.description:Cloud SQL instances must have automated backups enabled.
Restrict the location of automated backups.
name:organizations/ORGANIZATION_ID/customConstraints/custom.automatedBackupLocationresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"resource.settings.backupConfiguration.location=='us-central1'"actionType:ALLOWdisplayName:The location of automated backups must be in the us-central1 region.description:The location of automated backups for Cloud SQL instances must be in the us-central1 region.
Restrict the location of on-demand backups to us-central1
name:organizations/ORGANIZATION_ID/customConstraints/custom.onDemandBackupLocationresourceTypes:-sqladmin.googleapis.com/BackupRunmethodTypes:-CREATE-UPDATEcondition:"condition:resource.location=='us-central1'"actionType:ALLOWdisplayName:The location of on-demand backups must be in the us-central1 region.description:On-demand backups are restricted to the us-central1.
Enforce a final backup at instance deletion
name:organizations/ORGANIZATION_ID/customConstraints/custom.retainBackupsOnDeleteresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"condition:resource.settings.finalBackupConfig.enabled==true"actionType:ALLOWdisplayName:Final backup is enabled and must be taken at instance deletion.description:Final backups are enabled for instance.
Enforce a final backup at instance deletion retention period
name:organizations/ORGANIZATION_ID/customConstraints/custom.retainBackupsOnDeleteresourceTypes:-sqladmin.googleapis.com/InstancemethodTypes:-CREATE-UPDATEcondition:"condition:resource.settings.finalBackupConfig.enabled==true &&resource.settings.finalBackupConfig.retentionDays==20"actionType:ALLOWdisplayName:Final backup is enabled and must be retained for 20 days afterinstance deletion.description:Final backups is retained for 20 days after instance deletion.

Cloud SQL for PostgreSQL supported resources

The following table lists the Cloud SQL for PostgreSQL resources that you can referencein custom constraints.

ResourceField
sqladmin.googleapis.com/BackupRunresource.description
resource.location
sqladmin.googleapis.com/Instanceresource.databaseVersion
resource.diskEncryptionConfiguration.kmsKeyName
resource.diskEncryptionStatus.kmsKeyVersionName
resource.failoverReplica.name
resource.masterInstanceName
resource.name
resource.nodeCount
resource.project
resource.region
resource.replicaConfiguration.cascadableReplica
resource.replicaConfiguration.failoverTarget
resource.settings.activationPolicy
resource.settings.activeDirectoryConfig.domain
resource.settings.advancedMachineFeatures.threadsPerCore
resource.settings.availabilityType
resource.settings.backupConfiguration.backupRetentionSettings.retainedBackups
resource.settings.backupConfiguration.backupRetentionSettings.retentionUnit
resource.settings.backupConfiguration.binaryLogEnabled
resource.settings.backupConfiguration.enabled
resource.settings.backupConfiguration.location
resource.settings.backupConfiguration.pointInTimeRecoveryEnabled
resource.settings.backupConfiguration.startTime
resource.settings.backupConfiguration.transactionLogRetentionDays
resource.settings.collation
resource.settings.connectionPoolConfig.connectionPoolingEnabled
resource.settings.connectionPoolConfig.flags.name
resource.settings.connectionPoolConfig.flags.value
resource.settings.connectorEnforcement
resource.settings.databaseFlags.name
resource.settings.databaseFlags.value
resource.settings.dataCacheConfig.dataCacheEnabled
resource.settings.dataDiskProvisionedIops
resource.settings.dataDiskProvisionedThroughput
resource.settings.dataDiskSizeGb
resource.settings.dataDiskType
resource.settings.deletionProtectionEnabled
resource.settings.denyMaintenancePeriods.endDate
resource.settings.denyMaintenancePeriods.startDate
resource.settings.denyMaintenancePeriods.time
resource.settings.edition
resource.settings.enableDataplexIntegration
resource.settings.enableGoogleMlIntegration
resource.settings.insightsConfig.queryInsightsEnabled
resource.settings.insightsConfig.queryPlansPerMinute
resource.settings.insightsConfig.queryStringLength
resource.settings.insightsConfig.recordApplicationTags
resource.settings.insightsConfig.recordClientAddress
resource.settings.ipConfiguration.authorizedNetworks.name
resource.settings.ipConfiguration.authorizedNetworks.value
resource.settings.ipConfiguration.customSubjectAlternativeNames
resource.settings.ipConfiguration.enablePrivatePathForGoogleCloudServices
resource.settings.ipConfiguration.ipv4Enabled
resource.settings.ipConfiguration.privateNetwork
resource.settings.ipConfiguration.pscConfig.allowedConsumerProjects
resource.settings.ipConfiguration.pscConfig.pscAutoConnections.consumerNetwork
resource.settings.ipConfiguration.pscConfig.pscAutoConnections.consumerProject
resource.settings.ipConfiguration.pscConfig.pscEnabled
resource.settings.ipConfiguration.serverCaMode
resource.settings.ipConfiguration.serverCaPool
resource.settings.ipConfiguration.sslMode
resource.settings.locationPreference.secondaryZone
resource.settings.locationPreference.zone
resource.settings.maintenanceWindow.day
resource.settings.maintenanceWindow.hour
resource.settings.maintenanceWindow.updateTrack
resource.settings.passwordValidationPolicy.complexity
resource.settings.passwordValidationPolicy.disallowUsernameSubstring
resource.settings.passwordValidationPolicy.enablePasswordPolicy
resource.settings.passwordValidationPolicy.minLength
resource.settings.passwordValidationPolicy.passwordChangeInterval
resource.settings.passwordValidationPolicy.reuseInterval
resource.settings.replicationLagMaxSeconds
resource.settings.retainBackupsOnDelete
resource.settings.sqlServerAuditConfig.bucket
resource.settings.sqlServerAuditConfig.retentionInterval
resource.settings.sqlServerAuditConfig.uploadInterval
resource.settings.storageAutoResize
resource.settings.tier
resource.settings.timeZone

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-11-24 UTC.