Improve instance security by enforcing SSL or TLS encryption

To identify AlloyDB for PostgreSQL production instances that allow unencrypted direct connections and protect your data in transit, you can view and apply recommendations from the AlloyDB enforce SSL mode recommender.

The AlloyDB enforce SSL mode recommender analyzes instance metadata. If an instance is a production instance and doesn't enforce encryption requirements for direct connections, the recommender recommends that you enable SSL mode.

Recommendations are generated daily.

Before you begin

Before you can view recommendations and insights, do the following:

• Enable the Recommender API.

• To get the permissions to view and work with insights and recommendations, ask your administrator to grant you the required Identity and Access Management (IAM) roles:

  Tasks	Roles
  View recommendations	AlloyDB Recommender Viewer (roles/recommender.alloydbViewer)
  Apply recommendations	AlloyDB Recommender Admin (roles/recommender.alloydbAdmin) or AlloyDB Admin (roles/alloydb.admin)

  See Grant access to other users for more information.

List the recommendations

You can list recommendations for enforcing SSL mode by using the Google Cloud console, gcloud CLI, or the Recommender API.

Console

1. In the Google Cloud console, go to the Clusters page.

   Go to Clusters

   For more information, see Find recommendations with Active Assist.

2. In the Resources list table, find the cluster and click View issues in the Issues column.

   A list of issues is displayed in the Aggregated issues panel. Select the Allows direct unencrypted connections recommendation card.

gcloud CLI

To list recommendations for enforcing SSL mode by using the gcloud CLI, run the gcloud recommender recommendations list command as follows:

gcloud recommender recommendations list \
--project=PROJECT_ID \
--location=LOCATION \
--recommender=google.alloydb.instance.SecurityRecommender \
--filter=recommenderSubtype=REQUIRE_SSL

Replace the following:

• PROJECT_ID: your project ID.

• LOCATION: the region where your instances are located, such as us-central1.

API

To list recommendations for enforcing SSL mode by using the Recommender API, call the recommendations.list method as follows:

GET https://recommender.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.alloydb.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=REQUIRE_SSL

Replace the following:

• PROJECT_ID: your project ID.

• LOCATION: the region where your instances are located, such as us-central1.

View insights and detailed recommendations

You can view insights and detailed recommendations about instances that require enforcing SSL mode by using the Google Cloud console, gcloud CLI, or the Recommender API.

To view insights and detailed recommendations, follow these steps:

Console

On the Clusters page, under the Resources table, click View issues in the Issues column for the cluster.

The Aggregated issues panel appears on the right, which contains insights and detailed recommendations for Allows direct unencrypted connections.

gcloud CLI

Run the gcloud recommender insights list command as follows:

gcloud recommender insights list \
--project=PROJECT_ID \
--location=LOCATION \
--insight-type=google.alloydb.instance.SecurityInsight \
--filter=insightSubtype=SSL_NOT_REQUIRED

Replace the following:

• PROJECT_ID: your project ID.

• LOCATION: the region where your instances are located, such as us-central1.

API

Call the insights.list method as follows:

GET https://recommender.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.alloydb.instance.SecurityInsight/insights?filter=insightSubtype=SSL_NOT_REQUIRED

Replace the following:

• PROJECT_ID: your project ID.

• LOCATION: the region where your instances are located, such as us-central1.

Apply the recommendation

Evaluate the recommendation carefully and do any of the following:

Console

To implement the recommendation, enforce SSL/TLS mode on your instance.

gcloud CLI

To implement the recommendation, enforce SSL/TLS mode on your instance.

What's next

• Google Cloud recommenders