This appeal involves certified questions from the United States Court of Appeals for the Eleventh Circuit. ^[1] In 1996 Garden City entered into a series of agreements with CSX Transportation, Inc. and its affiliates to utilize a railroad right-of-way to install water and sewer lines. The agreements required Garden City to indemnify and hold harmless CSX or its subsidiaries for all liabilities CSX suffered in connection with the project and for which CSX was not the sole cause. The agreements also required Garden City to maintain insurance covering the indemnity obligations the City had assumed. In October 1997 a passenger train collided with a tractor trailer operated by Garden City’s subcontractor causing CSX to incur substantial property damage and subjecting CSX to third-party claims. CSX sought indemnification from Garden City in accordance with the agreements. Garden City refused and CSX brought suit alleging that it was entitled to indemnification. The district court granted summary judgment to the City, finding that the indemnification provision constituted an impermissible waiver of the City’s sovereign immunity in the absence of any evidence that the City had liability insurance to cover the indemnity claim. The Eleventh Circuit reversed and remanded to the trial court for its consideration of the effect of the City’s participation in the Georgia Interlocal Risk Management Agency (GIRMA), a multi-government insurance fund. On remand, the district court again granted summary judgment to the City, finding that the indemnification agreements were ultra vires[*249] and that OCGA § 36-33-1 (a) did not authorize the City to waive its immunity by entering into an indemnity contract. On appeal, the Eleventh Circuit certified to this Court the following questions:

(1) May a Georgia municipality contractually indemnify a private party for any and all loss, damage, and liability arising in connection with a public works project involving the private party’s land? (2) If not, is there any loss, damage, or liability arising in connection with a public works project involving a private party’s land for which a Georgia municipality may contractually indemnify the private party?

For the reasons that follow, we answer in the negative.

1. It is the general rule in Georgia that municipalities cannot exercise powers except those granted to them by the State and can be held liable upon contracts only when the State has authorized the incurring of the liability that is asserted against them. Kemp v. City of Claxton, 269 Ga. 173, 176 (1) (496 SE2d 712) (1998) (“Municipal corporations are creations of the state, possessing only those powers that have been granted to them, and allocations of power from the state are strictly construed. [Cit.]”); Screws v. City of Atlanta, 189 Ga. 839, 843 (2) (8 SE2d 16) (1940) (“[w]hat can not be done by an ordinance can not be done by a contract”). See OCGA § 36-34-1 (“[i]t is declared to be the intention of the General Assembly to vest certain general powers in the governing body of each of the municipal corporations of this state”). Thus, the principal issue before us is whether Garden City was authorized to enter into an indemnification agreement with a private third party, thereby waiving its sovereign immunity.

The answer is controlled by specific legislative provisions authorizing the waiver of sovereign immunity. This Court has long recognized that sovereign immunity applies to all actions where the State or its departments or agencies is a party, see, e.g., Gilbert v. Richardson, 264 Ga. 744 (3) (452 SE2d 476) (1994), see also Youngblood v. Gwinnett Rockdale Newton Community Svc. Bd., 273 Ga. 715 (2) (545 SE2d 875) (2001), and only the legislature has the authority to enact a law that specifically waives a municipality’s sovereign immunity. ^[2] Hiers v. City of Barwick, 262 Ga. 129 (2) (414 SE2d 647) (1992). In the context of tort liability, the legislature has authorized a narrow waiver of a municipality’s sovereign immunity through the enactment of OCGA § 36-33-1 (a), which provides in part that:

[*250] Pursuant to Article IX, Section II, Paragraph IX of the Constitution of the State of Georgia, the General Assembly, except as provided in this Code section, declares it is the public policy of the State of Georgia that there is no waiver of the sovereign immunity of municipal corporations of the state and such municipal corporations shall be immune from liability for damages. A municipal corporation shall not waive its immunity by the purchase of liability insurance, except as provided in Code Section 33-24-51, ^[3] or unless the policy of insurance issued covers an occurrence for which the defense of sovereign immunity is available, and then only to the extent of the limits of such insurance policy. ^[4]

Thus, as we have previously stated, any “waiver of sovereign immunity is a mere privilege, not a right, and the extension of that privilege is solely a matter of legislative grace. [Cit.]” Woodard v. Laurens County, 265 Ga. 404, 406 (1) (456 SE2d 581) (1995).

Here, the indemnification agreements required the City to indemnify CSX for “all liability, loss, claim, suit, damage, charge, or expense which CSX may suffer, sustain, incur or in any way be subjected to . . . except when caused solely by the fault or negligence of CSX.” Because nothing in OCGA § 36-33-1 can be construed to permit a municipality to waive its sovereign immunity by contracting to indemnify a third party, the indemnification agreement between the City and CSX is void as an ultra vires contract. Newsome v. City of Union Point, 249 Ga. 434, 436 (291 SE2d 712) (1972) (municipal contract is ultra vires and void where it is beyond power or authority of local government to perform under any circumstances). See also Precise v. City ofRossville, 261 Ga. 210 (1) (403 SE2d 47) (1991); R. Perry Sentell, Jr., Local Government and Contracts that Bind, 3 Ga. L. Rev. 546 (1968). CSX concedes there is no statutory authority for the City to waive its sovereign immunity by entering into a contract of indemnity. We decline CSX’s invitation to find that municipalities have an implied authority to do what is expressly reserved to the legislature. See Ga. Const. 1983, Art. IX, Sec. II, Par. IX.

2. Although the indemnification provision itself is void, and does not, therefore, effectuate a waiver of the City’s sovereign immunity, CSX contends that sovereign immunity was waived by the City’s participation in GIRMA. Under the plain terms of OCGA § 36-33-1, if a[*251] municipality purchases liability insurance, sovereign immunity is waived only as to those occurrences for which sovereign immunity would apply. We have held that the purchase of a GIRMA coverage agreement as authorized by OCGA §§ 36-85-1 to 36-85-20 constitutes the purchase of liability insurance. See Gilbert, supra, 264 Ga. at 751-752. Thus, if the facts behind CSX’s cause of action against the City fall within the scope of coverage provided by the GIRMA policy and sovereign immunity would otherwise apply to that cause of action, the City’s sovereign immunity is waived to the extent of such liability coverage.

To answer the additional query* * ^[5] posed by the Eleventh Circuit, the indemnification agreement between CSX and the City has no effect on the issue of the City’s waiver of immunity both because it is void and because under OCGA § 36-33-1 (a) it is the purchase of insurance that effectuates the waiver of sovereign immunity. It is irrelevant that the invalid indemnification agreement covered occurrences to which sovereign immunity both did and did not apply. Under Georgia law, sovereign immunity may be waived only by an act of the legislature and the legislature has provided that municipal sovereign immunity may be waived only by the purchase of liability insurance if the “policy of insurance issued covers an occurrence for which the defense of sovereign immunity is available, and then only to the extent of the limits of such insurance policy.” OCGA § 36-33-1 (a). ^[6]

3. Because we hold that the indemnification agreements are void as ultra vires, we need not address whether such agreements are void under OCGA § 36-30-3 (a) as agreements preventing free legislation or whether they created an unlawful public debt in violation of Article IX, Section V, Paragraph I, Ga. Const. 1983.

Certified questions answered.