Requestisdisallowedbyorganization's constraints/gcp.restrictTLSVersionconstraint for 'projects/PROJECT_NUMBER' to use service'SERVICE_NAME.googleapis.com'byviolatedTLSversion`TLS_VERSION_X`
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-18。"],[[["\u003cp\u003eThis guide outlines how to restrict access to Google Cloud resources by denying requests using TLS 1.0 or 1.1 via the \u003ccode\u003egcp.restrictTLSVersion\u003c/code\u003e organization policy constraint.\u003c/p\u003e\n"],["\u003cp\u003eThe TLS version restriction can be applied at the organization, folder, or project level, and it automatically applies to all child resources, although it can be overridden at lower levels.\u003c/p\u003e\n"],["\u003cp\u003eRestricting TLS versions is done through a deny list in the organization policy, and attempting to use an allow list will result in an error.\u003c/p\u003e\n"],["\u003cp\u003eThe enforcement of TLS version restrictions uses eventual consistency, meaning it may take up to tens of minutes for changes to fully propagate and take effect.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003egcp.restrictTLSVersion\u003c/code\u003e constraint is not applicable to certain services like App Engine, Cloud Run, and custom domains, requiring alternative methods like Cloud Load Balancing for TLS restriction.\u003c/p\u003e\n"]]],[],null,["# Restrict TLS versions\n=====================\n\nThis page describes how you can prevent access to Google Cloud resources by\ndenying requests made using Transport Layer Security (TLS) 1.0 or 1.1.\n| **Note:** You can only restrict TLS versions for Google Cloud fully qualified domain names. If you want to restrict TLS versions for other fully qualified domain names ---such as a load balancer--- refer to that specific product's guidance.\n\nOverview\n--------\n\nGoogle Cloud supports multiple [TLS protocol\nversions](/docs/security/encryption-in-transit#transport_layer_security). To\nmeet compliance requirements, you might want to deny handshake requests from\nclients that use earlier TLS versions. To do this, you can use the\n`gcp.restrictTLSVersion` [organization policy\nconstraint](/resource-manager/docs/organization-policy/understanding-constraints).\n\nThe `gcp.restrictTLSVersion` constraint can be applied to organizations, folders, or projects in the\n[resource hierarchy](/resource-manager/docs/cloud-platform-resource-hierarchy).\nThe constraint uses a\n[deny list](/resource-manager/docs/organization-policy/understanding-constraints#list_constraint),\nwhich denies explicit values and allows all others. An error will occur if you\ntry to use an allow list.\n\nDue to the behavior of\n[organization policy hierarchy evaluation](/resource-manager/docs/organization-policy/understanding-hierarchy),\nthe TLS version restriction applies to the specified resource node and all of\nits children. For example, if you deny TLS version 1.0 for an organization, it\nis also denied for all folders and projects (children) that descend from that\norganization.\n\nYou can override the inherited TLS version restriction by updating the\norganization policy on a child resource. For example, if your organization\npolicy denies TLS 1.0 at the organization level, you can remove the restriction\nfor a child folder by setting a separate organization policy on that folder. If\nthe folder has any children, the folder's policy will also be applied on each\nchild resource due to policy inheritance.\n| **Note:** The TLS version restriction policy provides additional security against using less secure 3DES encryption-based cipher suites. Specifically, if the policy disallows either TLS 1.0 or TLS 1.1 versions, access to Google Cloud resources is denied for requests using a 3DES encryption-based cipher suite such as `TLS_RSA_WITH_3DES_EDE_CBC_SHA`, regardless of the request's TLS version.\n| **Note:** TLS version restrictions are enforced using eventual consistency, as they control runtime access to [in-scope services](#supported-services) resources. As a result, it may take up to tens of minutes for consistency to be fully applied when the organization policy is modified.\n\nBefore you begin\n----------------\n\n- To set, change, or delete an organization policy, you must first be granted the **Organization Policy Administrator** (`roles/orgpolicy.policyAdmin`) Identity and Access Management (IAM) role.\n\nRestrict a TLS version\n----------------------\n\nTo restrict one or more TLS versions, complete the following steps: \n\n### Console\n\n1. Open the **Organization policies** page in the Google Cloud console.\n\n [Go to Organization policies](https://console.cloud.google.com/iam-admin/orgpolicies)\n2. Select the project picker at the top of the page.\n\n3. From the project picker, select the resource for which you want\n to set the organization policy.\n\n4. Select the **Restrict TLS Version** constraint from the list on the\n **Organization policies** page.\n\n5. To update the organization policy for this resource, click **Edit**.\n\n6. On the **Edit** page, select **Customize**.\n\n7. Under **Policy enforcement**, select an enforcement option:\n\n - To merge and evaluate your organization policies together, select\n **Merge with parent** . For more information about inheritance and the\n resource hierarchy, see\n [Understanding hierarchy evaluation](/resource-manager/docs/organization-policy/understanding-hierarchy).\n\n - To override policies inherited from a parent resource, select\n **Replace**.\n\n8. Click **Add rule**.\n\n9. Under **Policy values** , the default value is set to **Deny all** . Select\n **Custom** instead.\n\n10. Under **Policy type** , select **Deny**.\n\n11. Under **Custom values**, enter a TLS version to deny. The following values\n are valid custom values:\n\n - `TLS_VERSION_1` for TLS 1.0\n - `TLS_VERSION_1_1` for TLS 1.1\n\n If you are restricting more than one TLS version, click **Add value** and\n enter the value in the additional field.\n12. To finish and apply the organization policy, click **Save**.\n\n### gcloud\n\nUse the [`gcloud org-policies set-policy` command](/sdk/gcloud/reference/resource-manager/org-policies/set-policy) to set an organization policy on the resource: \n\n```bash\ngcloud org-policies set-policy POLICY_PATH\n```\n\n\u003cvar translate=\"no\"\u003ePOLICY_PATH\u003c/var\u003e is the full path to your organization policy file,\nwhich should look like the following if using the YAML format: \n\n name: \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-l devsite-syntax-l-Scalar devsite-syntax-l-Scalar-Plain\"\u003eRESOURCE_TYPE\u003c/span\u003e\u003c/var\u003e/\u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e/policies/gcp.restrictTLSVersion\n spec:\n rules:\n - values:\n deniedValues:\n - TLS_VERSION_1\n - TLS_VERSION_1_1\n\nReplace with the following:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e is `organizations`, `folders` or\n `projects`.\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e is your organization ID, folder ID,\n project ID, or project number, depending on the type of resource specified\n in \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e.\n\nRun the following command to verify that your policy has been applied: \n\n```bash\ngcloud org-policies describe gcp.restrictTLSVersion --RESOURCE_TYPE=RESOURCE_ID --effective\n```\n\nReplace with the following:\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e is `organization`, `folder` or\n `project`.\n\n- \u003cvar translate=\"no\"\u003eRESOURCE_ID\u003c/var\u003e is your organization ID, folder ID,\n project ID, or project number, depending on the type of resource specified\n in \u003cvar translate=\"no\"\u003eRESOURCE_TYPE\u003c/var\u003e.\n\nTest the policy\n---------------\n\nThe TLS version restriction policy constraint can be tested for any\n[in-scope service](#supported-services). The following example curl command\nvalidates the TLS version restriction for a Cloud Storage bucket.\n**Note:** curl restricts TLS v1.0 and v1.1 due to [IETF RFC 8996](https://datatracker.ietf.org/doc/html/rfc8996). To allow its use, you must either append the `--ciphers DEFAULT@SECLEVEL=0` parameter or modify the OpenSSL configuration to set the `MinProtocol` system default to either 1.0 or 1.1. See the [OpenSSL](https://www.openssl.org/docs/man3.0/man5/config.html) documentation for more information. \n\n```bash\n curl -X GET -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n \"https://storage.googleapis.com/storage/v1/b/\u003cvar translate=\"no\"\u003eGCS_BUCKET_NAME\u003c/var\u003e/o\" \\\n --tlsvTLS_VERSION --tls-max TLS_VERSION --ciphers DEFAULT@SECLEVEL=0\n```\n\nThere is no space between `--tlsv` and the value. For example: `--tlsv1.1`\n\nReplace with the following:\n\n- \u003cvar translate=\"no\"\u003eGCS_BUCKET_NAME\u003c/var\u003e is a Cloud Storage bucket name\n in your project, such as `mybucketname`.\n\n- \u003cvar translate=\"no\"\u003eTLS_VERSION\u003c/var\u003e is a TLS version like `1.0` or `1.1`\n denied in the configured policy.\n\nThe following example `curl` request shows \u003cvar translate=\"no\"\u003eGCS_BUCKET_NAME\u003c/var\u003e set\nto `mybucketname` and \u003cvar translate=\"no\"\u003eTLS_VERSION\u003c/var\u003e set to `1.1`: \n\n```bash\n curl -X GET -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n \"https://storage.googleapis.com/storage/v1/b/mybucketname/o\" \\\n --tlsv1.1 --tls-max 1.1 --ciphers DEFAULT@SECLEVEL=0\n```\n\nIf the organization policy is configured to restrict `TLS_VERSION_X`, then any\nattempt to access resources with `TLS_VERSION_X` in the policy-restricted\nproject in this example command will fail. An error message is returned that\ndescribes the reason for this failure. \n\n```bash\nRequest is disallowed by organization's constraints/gcp.restrictTLSVersion\nconstraint for 'projects/PROJECT_NUMBER' to use service\n'SERVICE_NAME.googleapis.com' by violated TLS version `TLS_VERSION_X`\n```\n\nThis output includes the following values:\n\n- \u003cvar translate=\"no\"\u003ePROJECT_NUMBER\u003c/var\u003e: the project number hosting the resource referred in the earlier command.\n- \u003cvar translate=\"no\"\u003eSERVICE_NAME\u003c/var\u003e: the name of the [in-scope service](#supported-services) blocked by the TLS restriction policy.\n\nSupported services\n------------------\n\nTLS version restriction is supported by any Google Cloud resource APIs\nthat have a header signed by\n[Google Front End (GFE)](/docs/security/infrastructure/design#google-frontend-service).\n| **Note:** The `gcp.restrictTLSVersion` organization policy constraint is not enforced on public Cloud Storage objects because the request is directly served from the Google Front End (GFE) cache.\n\nUnsupported services\n--------------------\n\nThe TLS version restriction organization policy constraint is *not*\napplicable for the following services:\n\n- App Engine (`*.appspot.com`)\n- Cloud Run functions (`*.cloudfunctions.net`),\n- Cloud Run (`*.run.app`)\n- Private Service Connect\n- Custom domains\n\nTo restrict TLS versions for these services, use [Cloud Load Balancing](/load-balancing/docs/https/setting-up-https-serverless)\nalong with [SSL policies](/load-balancing/docs/use-ssl-policies). You can also\nuse the predefined [`constraints/compute.requireSslPolicy`\nconstraint](/load-balancing/docs/org-policy-constraints#restrict-tls-capabilities-custom-constraint)\nalong with custom constraints for SSL policies to\nenforce TLS version and cipher suite restrictions for your load balancers.\n\nWhat's next\n-----------\n\n- Learn which [products are supported](/assured-workloads/docs/supported-products) for each control package."]]
