![[Google Cloud Documentation]](https://www.gstatic.com/devrel-devsite/prod/v0f3a5b8b76e4a120372a69044e02756e703b6140f9f1812c6e4a0407b19864b7/clouddocs/images/lockup_full_color.svg){kind=link}
![[]](https://docs.cloud.google.com/_static/clouddocs/images/icons/products/sql-color.svg){kind=link}
This page describes how to view and implement recommendations about when to remove
the IP address range of 0.0.0.0/0 from authorized networks.
Instances with 0.0.0.0/0 in authorized networks accept connections from all internet IPs. This recommender is called Remove broad public access.
Every day, this recommender proactively detects instances that have broad public IP address ranges and provides insights and recommendations to improve your instance security. You can view insights and detailed recommendations about instances that have public IP address ranges enabled and are vulnerable to security breaches by using the Google Cloud console, gcloud CLI, or the Recommender API.
Before you begin
Ensure that you enable the Recommender API.
Required roles and permissions
To get the permissions to view and work with insights and recommendations, ensure that you have the required Identity and Access Management (IAM) roles.
| Tasks | Roles |
|---|---|
| View recommendations |
recommender.cloudsqlViewer or
cloudsql.admin.
|
| Apply recommendations |
cloudsql.editor
or cloudsql.admin.
|
List the recommendations
To list the recommendations, follow these steps:
Console
To list recommendations about instance security, follow these steps:
Go to the Cloud SQL Instances page.
View the Issues column in the instance table.
Alternatively, follow these steps:
Go to the Active Assist.
For more information, see Exploring recommendations.
In the All recommendations card, click Security.
gcloud
Run the gcloud recommender recommendations list command as follows:
gcloud recommender recommendations list \ --project=PROJECT_ID \ --location=LOCATION \ --recommender=google.cloudsql.instance.SecurityRecommender \ --filter=recommenderSubtype=REMOVE_BROAD_PUBLIC_IP_RANGE
Replace the following:
- PROJECT_ID: Your project ID.
- LOCATION: A region where your instances are located, such as us-central1.
API
Call the recommendations.list method as follows:
GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/recommenders/google.cloudsql.instance.SecurityRecommender/recommendations?filter=recommenderSubtype=REMOVE_BROAD_PUBLIC_IP_RANGE
Replace the following:
- PROJECT_ID: Your project ID.
- LOCATION: A region where your instances are located, such as
us-central1.
View insights and detailed recommendations
To view insights and detailed recommendations, follow these steps:
Console
After listing the recommendations, click a recommendation. The recommendation panel appears, which contains insights and detailed recommendations.
gcloud
Run the gcloud recommender insights list command as follows:
gcloud recommender insights list \ --project=PROJECT_ID \ --location=LOCATION \ --insight-type=google.cloudsql.instance.SecurityInsight \ --filter=insightSubtype=BROAD_AUTHORIZED_NETWORKS
Replace the following:
- PROJECT_ID: Your project ID.
- LOCATION : A region where your instances are located, such as
us-central1.
API
Call the insights.list method as follows:
GET https://recommender.googleapis.com/v1beta1/projects/PROJECT_ID/locations/LOCATION/insightTypes/google.cloudsql.instance.SecurityInsight/insights?filter=insightSubtype=BROAD_AUTHORIZED_NETWORKS
Replace the following:
- PROJECT_ID: Your project ID.
- LOCATION: A region where your instances are located, such as
us-central1.
Apply the recommendation
Console
To implement this recommendation, click Manage authorized networks and then use one of the following options:
- Remove broad IP addresses from authorized networks. For more information, see Authorize with authorized networks.
- Use Cloud SQL Auth Proxy and Cloud SQL Language Connectors.
gcloud
To implement this recommendation, use one of the following options:
- Remove broad IP addresses from authorized networks. For more information, see Authorize with authorized networks.
- Use Cloud SQL Auth Proxy and Cloud SQL Language Connectors.
API
To implement this recommendation, use one of the following options:
- Remove broad IP addresses from authorized networks. For more information, see Authorize with authorized networks.
- Use Cloud SQL Auth Proxy and Cloud SQL Language Connectors.