組織のポリシーの設定、変更、削除に必要な権限を取得するには、組織に対する組織のポリシー管理者 （roles/orgpolicy.policyAdmin）の IAM ロールを付与するよう管理者に依頼してください。ロールの付与については、プロジェクト、フォルダ、組織に対するアクセス権の管理をご覧ください。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-03 UTC。"],[],[],null,["# Restrict TLS cipher suites on a Looker (Google Cloud core) instance\n\nGoogle Cloud supports multiple TLS cipher suites. To meet security or compliance requirements, you may want to deny requests from clients that use less secure TLS cipher suites.\n\nThe [`gcp.restrictTLSCipherSuites`](/assured-workloads/docs/restrict-tls-cipher-suites)\norganization policy constraint provides this capability.\n\nBefore you begin\n----------------\n\n\nTo get the permissions that\nyou need to set, change, or delete organization policies,\n\nask your administrator to grant you the\n\n\n[Organization Policy Administrator](/iam/docs/roles-permissions/orgpolicy#orgpolicy.policyAdmin) (`roles/orgpolicy.policyAdmin`)\nIAM role on the organization.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nSetting the organization policy\n-------------------------------\n\nThe `gcp.restrictTLSCipherSuites` organization policy constraint can be applied to Looker (Google Cloud core) instances that use a [public IP networking configuration](/looker/docs/looker-core-networking-options#public_ip_connections).\n\nYou can apply the constraint before or after you create the instance.\n\nFollow the instructions on the [Restrict TLS cipher suites](/assured-workloads/docs/restrict-tls-cipher-suites#restrict) documentation page to set the organization policy. Looker (Google Cloud core) is compliant with the Google-managed [MODERN SSL policy profile](/load-balancing/docs/ssl-policies-concepts#defining_an_ssl_policy) and supports the cipher suites that are in that profile.\n\nIf you set or change the organization policy after the Looker (Google Cloud core) instance is created, you must perform one of the following actions to apply the organization policy update to the Looker (Google Cloud core) instance:\n\n- [Restart](/looker/docs/looker-core-delete-restart#restart_a_instance) the instance.\n- [Edit](/looker/docs/looker-core-view-console#config_edit) a Looker (Google Cloud core) setting within the Google Cloud console or through the `gcloud` CLI.\n\nPolicy violations\n-----------------\n\nIf you set the organization policy restraint to allow no [MODERN cipher suites](/load-balancing/docs/ssl-policies-concepts#defining_an_ssl_policy) supported by Looker (Google Cloud core), you will be unable to create, update, or restart the Looker (Google Cloud core) instance and will receive the following error: \n\n```bash\ncom.google.apps.framework.request.FailedPreconditionException:\nConstraint`constraints/gcp.restrictTLSCipherSuites` is violated for resource\n`resourcemanager_projects``PROJECT_ID` Code: FAILED_PRECONDITION\n```\n\nThis output includes the \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e value, which is the ID of the project that is hosting the Looker (Google Cloud core) instance.\n\nTo address the violation, update the `gcp.restrictTLSCipherSuites` organization policy to allow at least one supported cipher suite."]]
