Mengonfigurasi mode penerapan SSL di instance AlloyDB
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Halaman ini menunjukkan cara mengonfigurasi mode penerapan SSL pada instance AlloyDB untuk PostgreSQL.
Secara default, instance AlloyDB hanya menerima koneksi menggunakan SSL.
AlloyDB menggunakan SSL untuk membuat koneksi yang aman, diautentikasi, dan dienkripsi ke instance AlloyDB. Selain itu, mode penerapan SSL yang dapat dikonfigurasi memastikan bahwa semua koneksi database ke instance menggunakan enkripsi SSL.
Topik ini membahas cara mengonfigurasi mode penerapan SSL pada instance yang ada.
Untuk mengetahui informasi tentang cara mengonfigurasi mode penerapan SSL saat Anda membuat
instance, lihat membuat instance utama.
Di halaman Overview, buka bagian Instances in your cluster, lalu klik Edit primary.
Di panel Edit instance utama, luaskan Opsi konfigurasi lanjutan.
Aktifkan Only allow SSL connections. Secara default, opsi ini diaktifkan.
Klik Update instance.
gcloud
Gunakan perintah gcloud alloydb instances update
dengan argumen --ssl-mode=ENCRYPTED_ONLY untuk hanya mengizinkan koneksi database
terenkripsi ke instance AlloyDB.
CLUSTER_ID: ID cluster tempat instance ditempatkan.
PROJECT_ID: ID project tempat cluster ditempatkan.
Untuk mengizinkan koneksi database yang tidak dienkripsi ke instance, gunakan perintah gcloud alloydb instances update dengan argumen --ssl-mode=ALLOW_UNENCRYPTED_AND_ENCRYPTED.
Jika perintah menampilkan pesan error yang menyertakan frasa
invalid cluster state MAINTENANCE, berarti cluster sedang menjalani pemeliharaan
rutin. Tindakan ini akan menonaktifkan sementara konfigurasi ulang instance. Jalankan perintah
lagi setelah cluster kembali ke status READY. Untuk memeriksa status
cluster, lihat Melihat detail cluster.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eAlloyDB instances, by default, only accept connections that use SSL, ensuring secure, authenticated, and encrypted communication.\u003c/p\u003e\n"],["\u003cp\u003eYou can configure the SSL enforcement mode on an existing AlloyDB instance to enforce or allow only encrypted connections.\u003c/p\u003e\n"],["\u003cp\u003eThe Google Cloud Console allows you to enforce SSL connections by enabling the "Only allow SSL connections" option within the instance's advanced configuration.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcloud alloydb instances update\u003c/code\u003e command offers options to either require encrypted connections (\u003ccode\u003e--ssl-mode=ENCRYPTED_ONLY\u003c/code\u003e) or allow both encrypted and unencrypted connections (\u003ccode\u003e--ssl-mode=ALLOW_UNENCRYPTED_AND_ENCRYPTED\u003c/code\u003e).\u003c/p\u003e\n"],["\u003cp\u003eTo configure SSL, you'll need a project enabled for AlloyDB and one of the required IAM roles: \u003ccode\u003eroles/alloydb.admin\u003c/code\u003e, \u003ccode\u003eroles/owner\u003c/code\u003e, or \u003ccode\u003eroles/editor\u003c/code\u003e.\u003c/p\u003e\n"]]],[],null,["# Configure SSL enforcement mode on AlloyDB instances\n\nThis page shows how to configure the SSL enforcement mode on AlloyDB for PostgreSQL instances.\n\nBy default, an AlloyDB instance accepts only connections using SSL.\n\nAlloyDB uses SSL to establish secure, authenticated, and encrypted\nconnections to AlloyDB instances. In addition, a configurable SSL\nenforcement mode ensures that all database connections to an instance use SSL\nencryption.\n\nThis topic covers how to configure the SSL enforcement mode on an existing instance.\nFor information about how to configure the SSL enforcement mode when you create\nan instance, see [create a primary instance](/alloydb/docs/instance-primary-create).\n\n\nBefore you begin\n----------------\n\n- The Google Cloud project you are using must have been [enabled to access AlloyDB](/alloydb/docs/project-enable-access).\n- You must have one of these IAM roles in the Google Cloud project you are using:\n - `roles/alloydb.admin` (the AlloyDB Admin predefined IAM role)\n - `roles/owner` (the Owner basic IAM role)\n - `roles/editor` (the Editor basic IAM role)\n\n If you don't have any of these roles, contact your Organization Administrator to request\n access.\n\n\u003cbr /\u003e\n\nConfigure the SSL enforcement mode on an instance\n-------------------------------------------------\n\n\nTo use the gcloud CLI, you can\n[install and initialize](/sdk/docs/install) the Google Cloud CLI, or you\ncan use [Cloud Shell](/shell/docs/using-cloud-shell).\n\n\u003cbr /\u003e\n\n### Console\n\n1. Go to the **Clusters** page.\n\n [Go to Clusters](https://console.cloud.google.com/alloydb/clusters)\n2. Click a cluster in the **Resource name** column.\n3. In the **Overview** page, go to the **Instances in your cluster** section, and click **Edit primary**.\n4. In the **Edit primary instance** pane, expand **Advanced configuration options**.\n5. Enable **Only allow SSL connections**. By default, this option is enabled.\n6. Click **Update instance**.\n\n### gcloud\n\nUse the [`gcloud alloydb instances update`](/sdk/gcloud/reference/beta/alloydb/instances/update)\ncommand with the `--ssl-mode=ENCRYPTED_ONLY` argument to allow only encrypted\ndatabase connections to an AlloyDB instance. \n\n gcloud alloydb instances update \u003cvar translate=\"no\"\u003eINSTANCE_ID\u003c/var\u003e \\\n --region=\u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e \\\n --cluster=\u003cvar translate=\"no\"\u003eCLUSTER_ID\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --ssl-mode=ENCRYPTED_ONLY\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eINSTANCE_ID\u003c/var\u003e: The ID of the instance that you are updating.\n- \u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e: The region where the instance is placed.\n- \u003cvar translate=\"no\"\u003eCLUSTER_ID\u003c/var\u003e: The ID of the cluster where the instance is placed.\n- \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e: The ID of the project where the cluster is placed.\n\nTo allow unencrypted database connections to an instance, use the\n`gcloud alloydb instances update` command with the `--ssl-mode=ALLOW_UNENCRYPTED_AND_ENCRYPTED`\nargument. \n\n gcloud alloydb instances update \u003cvar translate=\"no\"\u003eINSTANCE_ID\u003c/var\u003e \\\n --region=\u003cvar translate=\"no\"\u003eREGION_ID\u003c/var\u003e \\\n --cluster=\u003cvar translate=\"no\"\u003eCLUSTER_ID\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e \\\n --ssl-mode=ALLOW_UNENCRYPTED_AND_ENCRYPTED\n\nIf the command returns an error message that includes the phrase\n`invalid cluster state MAINTENANCE`, then the cluster is undergoing routine\nmaintenance. This temporarily disallows instance reconfiguration. Run the command\nagain after the cluster returns to a `READY` state. To check the cluster's\nstatus, see [View cluster details](/alloydb/docs/cluster-view)."]]
