To identify AlloyDB for PostgreSQL instances without a password policy, enforce strong passwords, and help meet compliance requirements, you can view and apply recommendations from the AlloyDB password policy Recommender.
The AlloyDB password policy Recommender detects instances that don't have an instance password policy enabled and provides insights and recommendations to improve your instance security.
Recommendations are generated daily.
Pricing
The AlloyDB password policy Recommender is available at no additional charge to all Google Cloud customers. For more information, see Recommender pricing.
Before you begin
Before you can view recommendations and insights, you must do the following:
To get the permissions to view and work with insights and recommendations, ask your administrator to grant you the required Identity and Access Management (IAM) roles:
Tasks Roles View recommendations AlloyDB Recommender Viewer ( roles/recommender.alloydbViewer)Apply recommendations AlloyDB Recommender Admin ( roles/recommender.alloydbAdmin) or AlloyDB Admin (roles/alloydb.admin)See Grant access to other users for more information.
List the recommendations
You can list the password policy recommendations by using the Google Cloud console, gcloud CLI, or the Recommender API.
Console
To list password policy recommendations by using the Google Cloud console, follow these steps:
In the Google Cloud console, go to the AlloyDB Clusters page.
For more information, see Getting started with Active Assist.
In the Resources list table, find the cluster and click View issues in the Issues column.
In the Aggregated issues panel, select the No password policy recommendation card.
gcloud CLI
To list password policy recommendations by using the gcloud CLI, run the
gcloud recommender recommendations list
command as follows:
gcloud recommender recommendations list \ --project=PROJECT_ID \ --location=LOCATION \ --recommender=google.alloydb.instance.SecurityRecommender \ --filter=recommenderSubtype=ENABLE_INSTANCE_PASSWORD_POLICY
Replace the following:
PROJECT_ID: your project ID.LOCATION: the region where your instances are located, such asus-central1.
API
To list password policy recommendations by using the
Recommender API, call the
recommendations.list
method as follows:
GET https://recommender.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.alloydb.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=ENABLE_INSTANCE_PASSWORD_POLICY
Replace the following:
PROJECT_ID: your project ID.LOCATION: the region where your instances are located, such asus-central1.
View insights and detailed recommendations
You can view insights and detailed recommendations about instances that require enabling instance password policies by using the Google Cloud console, gcloud CLI, or the Recommender API.
Console
On the Clusters page, under the Resources table, click View issues in the Issues column for the cluster.
The Aggregated issues panel appears on the right, which contains insights and detailed recommendations for No password policy.
gcloud CLI
To view insights and detailed recommendations about instances that require
enabling instance password policies, run the
gcloud recommender insights list
command as follows:
gcloud recommender insights list \ --project=PROJECT_ID \ --location=LOCATION \ --insight-type=google.alloydb.instance.SecurityInsight \ --filter=insightSubtype=INSTANCE_PASSWORD_POLICY_NOT_ENABLED
Replace the following:
PROJECT_ID: your project ID.LOCATION: the region where your instances are located, such asus-central1.
API
To view insights and detailed recommendations about instances that require
enabling instance password policies by using the
Recommender API, call the
insights.list
method as follows:
GET https://recommender.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.alloydb.instance.SecurityInsight/insights?filter=insightSubtype=INSTANCE_PASSWORD_POLICY_NOT_ENABLED
Replace the following:
PROJECT_ID: your project ID.LOCATION: the region where your instances are located, such asus-central1.
Apply the recommendation
To implement this recommendation, do the following:
- In the Resources list table, click View issues in the Issues column for the cluster.
- In the Aggregated issues panel, select the No password policy recommendation card and click Edit instance.
- Set an instance password policy.