[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-03 (世界標準時間)。"],[],[],null,["# Restrict TLS cipher suites on a Looker (Google Cloud core) instance\n\nGoogle Cloud supports multiple TLS cipher suites. To meet security or compliance requirements, you may want to deny requests from clients that use less secure TLS cipher suites.\n\nThe [`gcp.restrictTLSCipherSuites`](/assured-workloads/docs/restrict-tls-cipher-suites)\norganization policy constraint provides this capability.\n\nBefore you begin\n----------------\n\n\nTo get the permissions that\nyou need to set, change, or delete organization policies,\n\nask your administrator to grant you the\n\n\n[Organization Policy Administrator](/iam/docs/roles-permissions/orgpolicy#orgpolicy.policyAdmin) (`roles/orgpolicy.policyAdmin`)\nIAM role on the organization.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nSetting the organization policy\n-------------------------------\n\nThe `gcp.restrictTLSCipherSuites` organization policy constraint can be applied to Looker (Google Cloud core) instances that use a [public IP networking configuration](/looker/docs/looker-core-networking-options#public_ip_connections).\n\nYou can apply the constraint before or after you create the instance.\n\nFollow the instructions on the [Restrict TLS cipher suites](/assured-workloads/docs/restrict-tls-cipher-suites#restrict) documentation page to set the organization policy. Looker (Google Cloud core) is compliant with the Google-managed [MODERN SSL policy profile](/load-balancing/docs/ssl-policies-concepts#defining_an_ssl_policy) and supports the cipher suites that are in that profile.\n\nIf you set or change the organization policy after the Looker (Google Cloud core) instance is created, you must perform one of the following actions to apply the organization policy update to the Looker (Google Cloud core) instance:\n\n- [Restart](/looker/docs/looker-core-delete-restart#restart_a_instance) the instance.\n- [Edit](/looker/docs/looker-core-view-console#config_edit) a Looker (Google Cloud core) setting within the Google Cloud console or through the `gcloud` CLI.\n\nPolicy violations\n-----------------\n\nIf you set the organization policy restraint to allow no [MODERN cipher suites](/load-balancing/docs/ssl-policies-concepts#defining_an_ssl_policy) supported by Looker (Google Cloud core), you will be unable to create, update, or restart the Looker (Google Cloud core) instance and will receive the following error: \n\n```bash\ncom.google.apps.framework.request.FailedPreconditionException:\nConstraint`constraints/gcp.restrictTLSCipherSuites` is violated for resource\n`resourcemanager_projects``PROJECT_ID` Code: FAILED_PRECONDITION\n```\n\nThis output includes the \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e value, which is the ID of the project that is hosting the Looker (Google Cloud core) instance.\n\nTo address the violation, update the `gcp.restrictTLSCipherSuites` organization policy to allow at least one supported cipher suite."]]
