<br />

This page describes how to add organization policies on Cloud SQL
instances, to put restrictions on Cloud SQL at the project, folder, or
organization level. For an overview, see [Cloud SQL organization policies](https://docs.cloud.google.com/sql/docs/mysql/org-policy/org-policy.md.txt).

## Before you begin

1. Add the **Organization Policy Administrator** role ([`roles/orgpolicy.policyAdmin`](https://docs.cloud.google.com/iam/docs/roles-permissions/orgpolicy.md.txt)) to your user or service account from the **IAM \& Admin** page.


   [Go to the IAM accounts page](https://console.cloud.google.com/iam-admin/iam)
2. See [Restrictions](https://docs.cloud.google.com/sql/docs/mysql/org-policy/org-policy.md.txt#restrictions) before performing this procedure.

<br />

## Add the connection organization policy

For an overview see [Connection organization policies](https://docs.cloud.google.com/sql/docs/mysql/org-policy/org-policy.md.txt#connection-organization-policy).

To add a connection organization policy:

1. Go to the **Organization policies** page.

   [Go to the Organization policies page](https://console.cloud.google.com/iam-admin/orgpolicies)
2. Click projects dropdown menu in the top tab, and then select the project, folder,
   or organization that requires the organization policy. The
   **Organization policies** page displays a list of organization policy
   constraints that are available.

3. Filter for the constraint `name` or `display_name`.

   - To disable access to or from the Internet:

     ```sql
     name: "constraints/sql.restrictPublicIp"
     display_name: "Restrict Public IP access on Cloud SQL instances"
     ```
   - To disable access from the internet when IAM authentication is missing
     (this does not affect access using Private IP):

     ```sql
     name: "constraints/sql.restrictAuthorizedNetworks"
     display_name: "Restrict Authorized Networks on Cloud SQL instances"
     ```
4. Select the policy **Name** from the list.

5. Click **Edit**.

6. Click **Customize**.

7. Click **Add rule**.

8. Under **Enforcement** , click **On**.

9. Click **Save**.

## Add the CMEK organization policy

For an overview, see [Customer-managed encryption keys organization policies](https://docs.cloud.google.com/sql/docs/mysql/org-policy/org-policy.md.txt#cmek-organization-policy).

To add a CMEK organization policy:

1. Go to the **Organization policies** page.

   [Go to the Organization policies page](https://console.cloud.google.com/iam-admin/orgpolicies)
2. Click projects dropdown menu in the top tab, and then select the project, folder,
   or organization that requires the organization policy. The
   **Organization policies** page displays a list of organization policy
   constraints that are available.

3. Filter for the constraint `name` or `display_name`.

   - To put service names in a DENY list to ensure that CMEK is used in the
     resources for that service:

     ```sql
     name: "constraints/gcp.restrictNonCmekServices"
     display_name: "Restrict which services may create resources without CMEK"
     ```

     You must add `sqladmin.googleapis.com` to the list of restricted services
     with Deny.
   - To put project IDs in an ALLOW list to ensure that only keys from an
     instance of Cloud KMS within that project are used for CMEK.

     ```sql
     name: "constraints/gcp.restrictCmekCryptoKeyProjects"
     display_name: "Restrict which projects may supply KMS CryptoKeys for CMEK"
     ```
4. Select the policy **Name** from the list.

5. Click **Edit**.

6. Click **Customize**.

7. Click **Add rule**.

8. Under **Policy values** , click **Custom**.

9. For `constraints/gcp.restrictNonCmekServices`:
   a. Under **Policy types** , select **Deny** .
   b. Under **Custom values** , enter `sqladmin.googleapis.com`.

   For `constraints/gcp.restrictCmekCryptoKeyProjects`:
   a. Under **Policy types** , select **Allow** .
   b. Under **Custom values** , enter the resource using the following format:
   `under:organizations/ORGANIZATION_ID`,
   `under:folders/FOLDER_ID`, or `projects/PROJECT_ID`.
10. Click **Done**.

11. Click **Save**.

## What's next

- Learn about [Organization policies](https://docs.cloud.google.com/sql/docs/mysql/org-policy/org-policy.md.txt).
- Learn about how [private IP](https://docs.cloud.google.com/sql/docs/mysql/private-ip.md.txt) works with Cloud SQL.
- Learn how to [configure private IP](https://docs.cloud.google.com/sql/docs/mysql/configure-private-ip) for Cloud SQL.
- Learn about the [organization policy service](https://docs.cloud.google.com/resource-manager/docs/organization-policy/overview).
- Learn about [organization policy constraints](https://docs.cloud.google.com/resource-manager/docs/organization-policy/understanding-constraints).