Improve instance security by setting user password policies

This page describes how to view and implement recommendations about setting a user password policy for instances that don't have a user password policy enabled for any built-in authentication user. User password policies, such as expiration and lock after failed attempts, help prevent password compromise and help with compliance. This recommender is called Enable user password policy.

Every day, this recommender proactively detects instances that don't have a user password policy enabled and provides insights and recommendations to improve your instance security. You can view insights and detailed recommendations about these instances by using the Google Cloud console, gcloud CLI, or the Recommender API.

Before you begin

Ensure that you enable the Recommender API.

Required roles and permissions

To get the permissions to view and work with insights and recommendations, ensure that you have the required Identity and Access Management (IAM) roles.

Tasks Roles
View recommendations recommender.cloudsqlViewer or cloudsql.admin.
Apply recommendations cloudsql.editor or cloudsql.admin.
For more information about IAM roles, see IAM basic and predefined roles reference and Manage access to projects, folders, and organizations.

List the recommendations

To list the recommendations, follow these steps:

Console

To list recommendations about instance security, follow these steps:

  1. Go to the Cloud SQL Instances page.

    Go to Cloud SQL Instances

  2. View the Issues column in the instance table.

Alternatively, follow these steps:

  1. Go to the Recommendation Hub.

    Go to the Recommendation Hub

    For more information, see Exploring recommendations.

  2. In the All recommendations card, click Security.

gcloud

Run the gcloud recommender recommendations list command as follows:

gcloud recommender recommendations list \
--project=PROJECT_ID \
--location=LOCATION \
--recommender=google.cloudsql.instance.SecurityRecommender \
--filter=recommenderSubtype=ENABLE_USER_PASSWORD_POLICY

Replace the following:

  • PROJECT_ID: Your project ID.
  • LOCATION: A region where your instances are located, such as us-central1.

API

Call the recommendations.list method as follows:

GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.cloudsql.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=ENABLE_USER_PASSWORD_POLICY

Replace the following:

  • PROJECT_ID: Your project ID.
  • LOCATION: A region where your instances are located, such as us-central1.

View insights and detailed recommendations

To view insights and detailed recommendations, follow these steps:

Console

After listing the recommendations, click a recommendation. The recommendation panel appears, which contains insights and detailed recommendations.

gcloud

Run the gcloud recommender insights list command as follows:


gcloud recommender insights list \
--project=PROJECT_ID \
--location=LOCATION \
--insight-type=google.cloudsql.instance.SecurityInsight \
--filter=insightSubtype=USER_PASSWORD_POLICY_NOT_ENABLED

Replace the following:

  • PROJECT_ID: Your project ID.
  • LOCATION : A region where your instances are located, such as us-central1.

API

Call the insights.list method as follows:


GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.cloudsql.instance.SecurityInsight/insights?filter=insightSubtype=USER_PASSWORD_POLICY_NOT_ENABLED

Replace the following:

  • PROJECT_ID: Your project ID.
  • LOCATION: A region where your instances are located, such as us-central1.

Apply the recommendation

Console

To implement the recommendation, enable user password policies on your instance.

gcloud

To implement the recommendation, enable user password policies on your instance.

API

To implement the recommendation, enable user password policies on your instance.

What's next