This page describes how to view and implement recommendations about when to remove
the IP address range of `0.0.0.0/0` from authorized networks.
Instances with `0.0.0.0/0` in authorized networks accept connections from all internet IPs. This [recommender](https://docs.cloud.google.com/recommender/docs/overview) is called **Remove broad public access**.

Every day, this recommender
proactively detects instances that have broad public IP address ranges and provides insights and recommendations to improve
your instance security. You can view insights and detailed recommendations about instances that have public IP address
ranges enabled and are vulnerable to security breaches by using the Google Cloud console,
[gcloud CLI](https://docs.cloud.google.com/sdk/gcloud.md.txt), or the [Recommender API](https://docs.cloud.google.com/recommender/docs/using-api).

## Before you begin

Ensure that you [enable the Recommender API](https://docs.cloud.google.com/recommender/docs/enabling).

### Required roles and permissions

To get the permissions to view and work with insights and recommendations,
ensure that you have the required [Identity and Access Management (IAM) roles](https://docs.cloud.google.com/sql/docs/mysql/project-access-control#roles).

| Tasks | Roles |
|---|---|
| View recommendations | `recommender.cloudsqlViewer` or `cloudsql.admin`. |
| Apply recommendations | `cloudsql.editor` or `cloudsql.admin`. |

For more information about IAM roles, see [IAM basic and predefined roles reference](https://docs.cloud.google.com/iam/docs/understanding-roles) and [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

<br />

## List the recommendations

To list the recommendations, follow these steps:

### Console

To list recommendations about instance security, follow these steps:

1. Go to the **Cloud SQL Instances** page.

   [Go to Cloud SQL Instances](https://console.cloud.google.com/sql/instances)
2. View the **Issues** column in the instance table.

Alternatively, follow these steps:

1. Go to the **Active Assist**.

   [Go to the Active Assist](https://console.cloud.google.com/home/recommendations/)

   For more information, see [Exploring recommendations](https://docs.cloud.google.com/recommender/docs/recommendation-hub/identify-configuration-problems).
2. In the **All recommendations** card, click **Security**.

### gcloud

Run the [`gcloud recommender recommendations list`](https://docs.cloud.google.com/sdk/gcloud/reference/recommender/recommendations/list) command as follows:

```
gcloud recommender recommendations list \
--project=PROJECT_ID \
--location=LOCATION \
--recommender=google.cloudsql.instance.SecurityRecommender \
--filter=recommenderSubtype=REMOVE_BROAD_PUBLIC_IP_RANGE
```

Replace the following:

- <var translate="no">PROJECT_ID</var>: Your project ID.
- <var translate="no">LOCATION</var>: A region where your instances are located, such as us-central1.

### API

Call the [`recommendations.list`](https://docs.cloud.google.com/recommender/docs/reference/rest/v1beta1/projects.locations.recommenders.recommendations/list.md.txt) method as follows:

```
GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.cloudsql.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=REMOVE_BROAD_PUBLIC_IP_RANGE
```

Replace the following:

- <var translate="no">PROJECT_ID</var>: Your project ID.
- <var translate="no">LOCATION</var>: A region where your instances are located, such as `us-central1`.

## View insights and detailed recommendations

To view insights and detailed recommendations, follow these steps:

### Console

After listing the recommendations, click a recommendation.
The recommendation panel appears, which contains insights and detailed recommendations.

### gcloud

Run the [`gcloud recommender insights list`](https://docs.cloud.google.com/sdk/gcloud/reference/recommender/insights/list) command as follows:

```
gcloud recommender insights list \
--project=PROJECT_ID \
--location=LOCATION \
--insight-type=google.cloudsql.instance.SecurityInsight \
--filter=insightSubtype=BROAD_AUTHORIZED_NETWORKS

```

Replace the following:

- <var translate="no">PROJECT_ID</var>: Your project ID.
- <var translate="no">LOCATION</var> : A region where your instances are located, such as `us-central1`.

### API

Call the [`insights.list`](https://docs.cloud.google.com/recommender/docs/reference/rest/v1beta1/projects.locations.insightTypes.insights/list.md.txt) method as follows:

```
GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.cloudsql.instance.SecurityInsight/insights?filter=insightSubtype=BROAD_AUTHORIZED_NETWORKS

```

Replace the following:

- <var translate="no">PROJECT_ID</var>: Your project ID.
- <var translate="no">LOCATION</var>: A region where your instances are located, such as `us-central1`.

## Apply the recommendation

### Console

To implement this recommendation, click **Manage authorized networks** and then use one of the following options:

- Remove broad IP addresses from authorized networks. For more information, see [Authorize with authorized networks](https://docs.cloud.google.com/sql/docs/mysql/authorize-networks.md.txt).
- Use [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/mysql/sql-proxy.md.txt) and [Cloud SQL Language Connectors](https://docs.cloud.google.com/sql/docs/mysql/language-connectors.md.txt).

### gcloud

To implement this recommendation, use one of the following options:

- Remove broad IP addresses from authorized networks. For more information, see [Authorize with authorized networks](https://docs.cloud.google.com/sql/docs/mysql/authorize-networks.md.txt).
- Use [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/mysql/sql-proxy.md.txt) and [Cloud SQL Language Connectors](https://docs.cloud.google.com/sql/docs/mysql/language-connectors.md.txt).

### API

To implement this recommendation, use one of the following options:

- Remove broad IP addresses from authorized networks. For more information, see [Authorize with authorized networks](https://docs.cloud.google.com/sql/docs/mysql/authorize-networks.md.txt).
- Use [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/mysql/sql-proxy.md.txt) and [Cloud SQL Language Connectors](https://docs.cloud.google.com/sql/docs/mysql/language-connectors.md.txt).

## What's next

- [Authorize with authorized networks](https://docs.cloud.google.com/sql/docs/mysql/authorize-networks.md.txt)
- [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/mysql/sql-proxy.md.txt)
- [Cloud SQL Language Connectors](https://docs.cloud.google.com/sql/docs/mysql/language-connectors.md.txt)
- [Google Cloud recommenders](https://docs.cloud.google.com/recommender/docs/recommenders.md.txt)
- [Blog: Maximize your Cloud ROI](https://cloud.google.com/blog/products/management-tools/active-assist-comes-to-google-cloud)