This page describes how to view and implement recommendations about
removing authorized networks for instances that violate the
[`constraints/sql.restrictAuthorizedNetworks` organization policy](https://docs.cloud.google.com/sql/docs/mysql/org-policy/org-policy.md.txt#connection-constraints) enforced by your
administrator. This policy violation occurs when authorized networks already exist for an instance at the time of enforcement of the constraint. This [recommender](https://docs.cloud.google.com/recommender/docs/overview) is called **Remove authorized networks**.

Every day, this recommender
proactively detects instances that violate the
`constraints/sql.restrictAuthorizedNetworks` organization policy and provides insights and recommendations to improve
your instance security. You can view insights and detailed recommendations about these instances by using the Google Cloud console,
[gcloud CLI](https://docs.cloud.google.com/sdk/gcloud.md.txt), or the [Recommender API](https://docs.cloud.google.com/recommender/docs/using-api).

For more information about organization policies, see [Cloud SQL organization policies](https://docs.cloud.google.com/sql/docs/sqlserver/org-policy/org-policy.md.txt).

## Before you begin

Ensure that you [enable the Recommender API](https://docs.cloud.google.com/recommender/docs/enabling).

### Required roles and permissions

To get the permissions to view and work with insights and recommendations,
ensure that you have the required [Identity and Access Management (IAM) roles](https://docs.cloud.google.com/sql/docs/sqlserver/project-access-control#roles).

| Tasks | Roles |
|---|---|
| View recommendations | `recommender.cloudsqlViewer` or `cloudsql.admin`. |
| Apply recommendations | `cloudsql.editor` or `cloudsql.admin`. |

For more information about IAM roles, see [IAM basic and predefined roles reference](https://docs.cloud.google.com/iam/docs/understanding-roles) and [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

<br />

## List the recommendations

To list the recommendations, follow these steps:

### Console

To list recommendations about instance security, follow these steps:

1. Go to the **Cloud SQL Instances** page.

   [Go to Cloud SQL Instances](https://console.cloud.google.com/sql/instances)
2. View the **Issues** column in the instance table.

Alternatively, follow these steps:

1. Go to the **Active Assist**.

   [Go to the Active Assist](https://console.cloud.google.com/home/recommendations/)

   For more information, see [Exploring recommendations](https://docs.cloud.google.com/recommender/docs/recommendation-hub/identify-configuration-problems).
2. In the **All recommendations** card, click **Security**.

### gcloud

Run the [`gcloud recommender recommendations list`](https://docs.cloud.google.com/sdk/gcloud/reference/recommender/recommendations/list) command as follows:

```
gcloud recommender recommendations list \
--project=PROJECT_ID \
--location=LOCATION \
--recommender=google.cloudsql.instance.SecurityRecommender \
--filter=recommenderSubtype=REMOVE_AUTHORIZED_NETWORKS_TO_MEET_ORG_POLICY
```

Replace the following:

- <var translate="no">PROJECT_ID</var>: Your project ID.
- <var translate="no">LOCATION</var>: A region where your instances are located, such as us-central1.

### API

Call the [`recommendations.list`](https://docs.cloud.google.com/recommender/docs/reference/rest/v1beta1/projects.locations.recommenders.recommendations/list.md.txt) method as follows:

```
GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.cloudsql.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=REMOVE_AUTHORIZED_NETWORKS_TO_MEET_ORG_POLICY
```

Replace the following:

- <var translate="no">PROJECT_ID</var>: Your project ID.
- <var translate="no">LOCATION</var>: A region where your instances are located, such as `us-central1`.

## View insights and detailed recommendations

To view insights and detailed recommendations, follow these steps:

### Console

After listing the recommendations, click a recommendation.
The recommendation panel appears, which contains insights and detailed recommendations.

### gcloud

Run the [`gcloud recommender insights list`](https://docs.cloud.google.com/sdk/gcloud/reference/recommender/insights/list) command as follows:

```
gcloud recommender insights list \
--project=PROJECT_ID \
--location=LOCATION \
--insight-type=google.cloudsql.instance.SecurityInsight \
--filter=insightSubtype=ORG_POLICY_TO_RESTRICT_AUTHORIZED_NETWORKS_VIOLATED

```

Replace the following:

- <var translate="no">PROJECT_ID</var>: Your project ID.
- <var translate="no">LOCATION</var> : A region where your instances are located, such as `us-central1`.

### API

Call the [`insights.list`](https://docs.cloud.google.com/recommender/docs/reference/rest/v1beta1/projects.locations.insightTypes.insights/list.md.txt) method as follows:

```
GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.cloudsql.instance.SecurityInsight/insights?filter=insightSubtype=ORG_POLICY_TO_RESTRICT_AUTHORIZED_NETWORKS_VIOLATED

```

Replace the following:

- <var translate="no">PROJECT_ID</var>: Your project ID.
- <var translate="no">LOCATION</var>: A region where your instances are located, such as `us-central1`.

## Apply the recommendation

### Console

To implement the recommendation, do the following:

1. Click **Manage authorized networks**.

2. Configure your clients to use [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/sqlserver/sql-proxy.md.txt) and [Cloud SQL Language Connectors](https://docs.cloud.google.com/sql/docs/sqlserver/language-connectors.md.txt).

3. Remove the
   [authorized networks](https://docs.cloud.google.com/sql/docs/sqlserver/authorize-networks.md.txt#authorized-networks)
   on your instance.

### gcloud

To implement the recommendation, do the following:

1. Configure your clients to use [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/sqlserver/sql-proxy.md.txt) and [Cloud SQL Language Connectors](https://docs.cloud.google.com/sql/docs/sqlserver/language-connectors.md.txt).

2. Remove the
   [authorized networks](https://docs.cloud.google.com/sql/docs/sqlserver/authorize-networks.md.txt#authorized-networks)
   on your instance.

### API

To implement the recommendation, do the following:

1. Configure your clients to use [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/sqlserver/sql-proxy.md.txt) and [Cloud SQL Language Connectors](https://docs.cloud.google.com/sql/docs/sqlserver/language-connectors.md.txt).

2. Remove the
   [authorized networks](https://docs.cloud.google.com/sql/docs/sqlserver/authorize-networks.md.txt#authorized-networks)
   on your instance.

## What's next

- [Authorized networks](https://docs.cloud.google.com/sql/docs/sqlserver/authorize-networks.md.txt#authorized-networks)
- [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/sqlserver/sql-proxy.md.txt)
- [Cloud SQL Language Connectors](https://docs.cloud.google.com/sql/docs/sqlserver/language-connectors.md.txt)
- [Google Cloud recommenders](https://docs.cloud.google.com/recommender/docs/recommenders.md.txt)
- [Blog: Maximize your Cloud ROI](https://cloud.google.com/blog/products/management-tools/active-assist-comes-to-google-cloud)