[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-25。"],[[["\u003cp\u003eThis page provides troubleshooting advice for users experiencing issues with the AlloyDB Auth Proxy.\u003c/p\u003e\n"],["\u003cp\u003eReview the AlloyDB Auth Proxy output for specific error messages, which often indicate the problem's source and solution.\u003c/p\u003e\n"],["\u003cp\u003eVerify that service accounts have the necessary permissions, including Cloud AlloyDB Client or Admin roles, and the Service Usage Consumer role, to avoid \u003ccode\u003e403 Forbidden\u003c/code\u003e errors.\u003c/p\u003e\n"],["\u003cp\u003eEnsure the AlloyDB Admin API is enabled to prevent \u003ccode\u003eError 403: Access Not Configured\u003c/code\u003e messages in the logs.\u003c/p\u003e\n"],["\u003cp\u003eIf facing quota-related errors or \u003ccode\u003e400 Bad Request\u003c/code\u003e responses with reauth issues, then addressing the source of the quota issue or refreshing the gcloud application default credentials, respectively, may fix the problem.\u003c/p\u003e\n"]]],[],null,["# Troubleshoot AlloyDB Auth Proxy connections\n\nThis page lists troubleshooting tips in case you run into problems using the\nAlloyDB Auth Proxy.\n\nIf you are having trouble connecting to your AlloyDB instance using\nthe AlloyDB Auth Proxy, here are a few things to try to find what's causing the\nproblem.\n\n- Check the AlloyDB Auth Proxy output carefully and look for errors. Often, the\n error messages provide the information you need determine the source of the\n problem and how to solve it.\n\n- If you are getting a `403 Forbidden` error, and you are using a service\n account to authenticate the AlloyDB Auth Proxy, make sure the service account has the\n correct permissions.\n\n The predefined AlloyDB roles that provide these permissions are Cloud\n AlloyDB Client (`roles/alloydb.client`) and Cloud AlloyDB Admin\n (`roles/alloydb.admin`). In addition, you must add the Service Usage Consumer\n (`roles/serviceusage.serviceUsageConsumer`) role.\n- Make sure to enable the AlloyDB API.\n\n If it is not enabled, you see output like `Error 403: Access Not\n Configured` in your AlloyDB Auth Proxy logs.\n- If you are connecting using UNIX sockets, confirm that the sockets were\n created by listing the directory you provided when you started the AlloyDB Auth Proxy.\n\n- If you have an outbound firewall policy, make sure it allows connections\n to port 5433 on the target AlloyDB instance.\n\n | **Note:** The Auth Proxy client uses 5433 to connect to the Auth Proxy server. Port 5432 is the default port for the PostgreSQL protocol over a direct TCP connection.\n- Quota issues: If you see errors related to quotas being exceeded, either\n identify the source of the quota problem (for example, an\n application is misusing the connector and unnecessarily creating new\n connections) or contact support to request an increase to the AlloyDB API\n quota.\n\n- If you get a `400 Bad Request` response with an error message containing\n `reauth related error`, refresh your gcloud application default\n credentials:\n\n gcloud auth application-default login\n\n For more information, see [How Application Default Credentials works](/docs/authentication/application-default-credentials)."]]
