Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Nesta página, descrevemos como adicionar políticas predefinidas da organização em clusters e backups do AlloyDB para PostgreSQL, o que permite restringir o uso do AlloyDB no nível do projeto, da pasta ou da organização.
Política da organização para chaves de criptografia gerenciadas pelo cliente (CMEK)
É possível usar a política da organização de CMEK para controlar as configurações de CMEK dos seus clusters e backups do AlloyDB. Com essa política, você controla as chaves do Cloud KMS usadas para proteger seus dados.
O AlloyDB é compatível com duas restrições de política da organização que ajudam a garantir a proteção CMEK em uma organização:
constraints/gcp.restrictNonCmekServices: exige proteção de CMEK para o
alloydb.googleapis.com. Quando você adiciona essa restrição e o
alloydb.googleapis.com à lista de serviços da política Deny,
o AlloyDB se recusa a criar um novo cluster ou backup, a menos que eles
estejam ativados com CMEK.
constraints/gcp.restrictCmekCryptoKeyProjects: limita as CryptoKeys do Cloud KMS que podem ser usadas para proteção CMEK em clusters e backups do AlloyDB. Com essa restrição, quando o AlloyDB cria um novo cluster ou um backup com CMEK, a CryptoKey precisa vir de um projeto, uma pasta ou uma organização permitida.
Essas restrições são aplicadas apenas em clusters e backups recém-criados do AlloyDB.
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Para inicializar a CLI gcloud, execute o seguinte comando:
gcloudinit
Adicione o papel Administrador da política da organização
(roles/orgpolicy.policyAdmin)
à sua conta de usuário ou de serviço da página IAM e administrador.
Clique no menu suspenso na barra de menus do console Google Cloud e selecione o projeto, a pasta ou a organização que exige a política da organização. A página Políticas da organização exibe uma lista das restrições de políticas da organização disponíveis.
Para definir constraints/gcp.restrictNonCmekServices, siga estas etapas:
Filtre a restrição usando o
ID: constraints/gcp.restrictNonCmekServices
ou o Name: Restrict which services may create resources without CMEK.
Clique no Nome da restrição.
Clique em Editar.
Clique em Personalizar.
Clique em Adicionar regra.
Em Valores da política, clique em Personalizado.
Em Tipos de política, selecione Negar.
Em Valores personalizados, digite alloydb.googleapis.com. Isso garante que a CMEK seja aplicada ao criar clusters e backups do AlloyDB.
Para definir constraints/gcp.restrictCmekCryptoKeyProjects, siga estas etapas:
Filtre a restrição ID: constraints/gcp.restrictCmekCryptoKeyProjects
ou Name: Restrict which projects may supply KMS CryptoKeys for CMEK.
Clique no Nome da restrição.
Clique em Editar.
Clique em Personalizar.
Clique em Adicionar regra.
Em Valores da política, clique em Personalizado.
Em Tipos de política, selecione Permitir.
Em Valores personalizados, digite o recurso usando o seguinte formato:
under:organizations/ORGANIZATION_ID,
under:folders/FOLDER_ID ou projects/PROJECT_ID.
Isso garante que seus clusters e backups do AlloyDB usem as chaves do Cloud KMS apenas do projeto, da pasta ou da organização permitida.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-25 UTC."],[[["\u003cp\u003eThis page details how to implement organization policies for AlloyDB for PostgreSQL clusters and backups to enforce restrictions at the project, folder, or organization level.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003econstraints/gcp.restrictNonCmekServices\u003c/code\u003e organization policy constraint mandates CMEK protection for AlloyDB, preventing the creation of new clusters or backups without it by adding the \u003ccode\u003ealloydb.googleapis.com\u003c/code\u003e service to the \u003ccode\u003eDeny\u003c/code\u003e list.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003econstraints/gcp.restrictCmekCryptoKeyProjects\u003c/code\u003e constraint limits the Cloud KMS CryptoKeys that can be used for CMEK in AlloyDB, ensuring that new clusters or backups with CMEK only use keys from specified projects, folders, or organizations.\u003c/p\u003e\n"],["\u003cp\u003eImplementing these CMEK organization policy constraints ensures that all newly created AlloyDB clusters and backups are encrypted using customer-managed keys from the allowed sources.\u003c/p\u003e\n"]]],[],null,["# Use predefined organization policies\n\nThis page describes how to add predefined organization policies on\nAlloyDB for PostgreSQL clusters and backups, which lets you put restrictions on\nAlloyDB at the project, folder, or organization level.\n\nCustomer-managed encryption keys (CMEK) organization policy\n-----------------------------------------------------------\n\nYou can use the CMEK organization policy to control the CMEK settings of your\nAlloyDB clusters and backups. This policy lets you control the\n[Cloud KMS keys](/kms/docs/resource-hierarchy) that you use to protect\nyour data.\n\nAlloyDB supports two organization policy constraints that help\nensure CMEK protection across an organization:\n\n- `constraints/gcp.restrictNonCmekServices`: Requires CMEK protection for the `alloydb.googleapis.com`. When you add this constraint and add the `alloydb.googleapis.com` to the `Deny` policy list of services, AlloyDB refuses to create a new cluster or a backup unless they are enabled with CMEK.\n- `constraints/gcp.restrictCmekCryptoKeyProjects`: Limits which Cloud KMS CryptoKeys you can use for CMEK protection in AlloyDB clusters and backups. With this constraint, when AlloyDB creates a new cluster or a backup with CMEK, the CryptoKey must come from an allowed project, folder, or organization.\n\nThese constraints are only enforced on newly created AlloyDB\nclusters and backups.\n\nFor more overview information, see\n[CMEK organization policies](/kms/docs/cmek-org-policy).\nFor information about CMEK organization policy constraints, see\n[Organization policy constraints](/resource-manager/docs/organization-policy/org-policy-constraints).\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n [Install](/sdk/docs/install) the Google Cloud CLI.\n\n- If you're using an external identity provider (IdP), you must first\n [sign in to the gcloud CLI with your federated identity](/iam/docs/workforce-log-in-gcloud).\n\n-\n To [initialize](/sdk/docs/initializing) the gcloud CLI, run the following command:\n\n ```bash\n gcloud init\n ```\n\n1. Add the **Organization Policy Administrator** role ([`roles/orgpolicy.policyAdmin`](/iam/docs/understanding-roles#organization-policy-roles)) to your user or service account from the **IAM \\& Admin** page.\n\n\n [Go to the IAM accounts page](https://console.cloud.google.com/iam-admin/iam)\n\n\u003cbr /\u003e\n\nAdd the CMEK organization policy\n--------------------------------\n\nTo add a CMEK organization policy, follow these steps:\n\n1. Go to the **Organization policies** page.\n\n [Go to the Organization policies page](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. Click the drop-down in the Google Cloud console menu bar, and then select the project, folder,\n or organization that requires the organization policy. The\n **Organization policies** page displays a list of available organization policy\n constraints.\n\n3. To set `constraints/gcp.restrictNonCmekServices`, follow these steps:\n\n 1. Filter for the constraint using the `ID`: `constraints/gcp.restrictNonCmekServices` or the `Name`: `Restrict which services may create resources without CMEK`.\n 2. Click the constraint **Name**.\n 3. Click **Edit**.\n 4. Click **Customize**.\n 5. Click **Add rule**.\n 6. Under **Policy values** , click **Custom**.\n 7. Under **Policy types** , select **Deny**.\n 8. Under **Custom values** , enter `alloydb.googleapis.com`. This ensures that CMEK is enforced while creating AlloyDB clusters and backups.\n4. To set `constraints/gcp.restrictCmekCryptoKeyProjects`, follow these steps:\n\n 1. Filter for the constraint `ID`: `constraints/gcp.restrictCmekCryptoKeyProjects` or `Name`: `Restrict which projects may supply KMS CryptoKeys for CMEK`.\n 2. Click the constraint **Name**.\n 3. Click **Edit**.\n 4. Click **Customize**.\n 5. Click **Add rule**.\n 6. Under **Policy values** , click **Custom**.\n 7. Under **Policy types** , select **Allow**.\n 8. Under **Custom values** , enter the resource using the following format:\n `under:organizations/ORGANIZATION_ID`,\n `under:folders/FOLDER_ID`, or `projects/PROJECT_ID`.\n\n This ensures that your AlloyDB clusters and backups use the\n Cloud KMS keys only from the allowed project, folder, or\n organization.\n5. Click **Done** and then click **Save**.\n\nWhat's next\n-----------\n\n- Learn more about [customer-managed encryption keys (CMEK) for AlloyDB for PostgreSQL](/alloydb/docs/cmek).\n- See [Introduction to the Organization Policy Service](/resource-manager/docs/organization-policy/overview) to learn more about organization policies.\n- Learn more about how to [create and manage organization policies](/resource-manager/docs/organization-policy/using-constraints).\n- See the full list of predefined [Organization policy constraints](/resource-manager/docs/organization-policy/org-policy-constraints).\n- [Connect using a public IP](/alloydb/docs/connect-public-ip).\n- [Create a primary instance](/alloydb/docs/instance-primary-create)."]]
