Using Cloud SQL for MySQL

Cloud SQL provides a relational database that lives in Google's cloud that you can use with your App Engine application. To learn more about Cloud SQL, see the Cloud SQL documentation.

For information on pricing and restrictions imposed by both Cloud SQL and App Engine, see Pricing and Access Limits.

Before you begin

  1. Create or select a GCP project in the GCP Console and then ensure that project includes an App Engine application:

    Go to App Engine

    The Dashboard opens if an App Engine application already exists in your project. Otherwise, you are prompted to choose the region where you want your App Engine application located.

  2. Download, install, and initialize Cloud SDK:

    Download the SDK

    If you already have the gcloud tool installed and want to configure it to use a GCP project ID other than the one that you initialized it to, see Managing Cloud SDK Configurations.

Setting up the Cloud SQL instance

  1. Create a Second Generation Cloud SQL instance.
  2. If you haven't already, set the password for the default user on your Cloud SQL instance:
    gcloud sql users set-password root % --instance [INSTANCE_NAME] --password [PASSWORD]
  3. If you don't want to use the default user to connect, create a user.
  4. Using Cloud SDK, get the Cloud SQL instance connection name to use as a connection string in your application code:
    gcloud sql instances describe [INSTANCE_NAME]
    Record the value returned for connectionName. You can also find this value in the Instance details page of the Google Cloud Platform Console. For example, in the Cloud SDK output:
    gcloud sql instances describe instance1
      connectionName: project1:us-central1:instance1
  5. Add the Cloud SQL instance connection name, database name, user, and password to the environment variables in app.yaml.
      # Replace INSTANCE_CONNECTION_NAME with the value obtained when configuring your
      # Cloud SQL instance, available from the Google Cloud Console or from the Cloud SDK.
      # For Cloud SQL 2nd generation instances, this should be in the form of "project:region:instance".
      # Replace username and password if you aren't using the root user.
      CLOUDSQL_USER: root

Running Cloud SQL and App Engine in separate projects

If your App Engine application and Cloud SQL instance are in different Google Cloud Platform projects, you must use a service account to allow your App Engine application access to Cloud SQL.

This service account represents your App Engine application and is created by default when you create a Google Cloud Platform project.

  1. If your App Engine application is in the same project as your Cloud SQL instance, proceed to Setting up. Otherwise, proceed to the next step.
  2. Identify the service account associated with your App Engine application. The default App Engine service account is named [PROJECT-ID]

    You can verify the App Engine service account on the IAM Permissions page. Ensure that you select the project for your App Engine application, not your Cloud SQL instance.

    Go to the IAM Permissions page

  3. Go to the IAM & Admin Projects page in the Google Cloud Platform Console.

    Go to the IAM & Admin Projects page

  4. Select the project that contains the Cloud SQL instance.
  5. Search for the service account name.
  6. If the service account is already there, and it has a role that includes the cloudsql.instances.connect permission, you can proceed to Setting up.

    The Cloud SQL Client, Cloud SQL Editor and Cloud SQL Admin roles all provide the necessary permission, as do the legacy Editor and Owner project roles.

  7. Otherwise, add the service account by clicking Add.
  8. In the Add members dialog, provide the name of the service account and select a role that include the cloudsql.instances.connect permission (any Cloud SQL predefined role other than Viewer will work).

    Alternatively, you can use the primitive Editor role by selecting Project > Editor, but the Editor role includes permissions across Google Cloud Platform.

    If you do not see these roles, your Google Cloud Platform user might not have the resourcemanager.projects.setIamPolicy permission. You can check your permissions by going to the IAM page in the Google Cloud Platform Console and searching for your user id.

  9. Click Add.

    You should now see the service account listed with the specified role.

Code sample overview

The following sample lists the databases on a Cloud SQL instance.

// Copyright 2019 Google LLC
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// See the License for the specific language governing permissions and
// limitations under the License.

// Sample cloudsql demonstrates connection to a Cloud SQL instance from App Engine standard.
package main

import (


	_ ""

var db *sql.DB

func main() {
	var (
		connectionName = mustGetenv("CLOUDSQL_CONNECTION_NAME")
		user           = mustGetenv("CLOUDSQL_USER")
		password       = os.Getenv("CLOUDSQL_PASSWORD") // NOTE: password may be empty

	var err error
	db, err = sql.Open("mysql", fmt.Sprintf("%s:%s@cloudsql(%s)/", user, password, connectionName))
	if err != nil {
		log.Fatalf("Could not open db: %v", err)

	http.HandleFunc("/", handler)

func handler(w http.ResponseWriter, r *http.Request) {
	if r.URL.Path != "/" {
		http.NotFound(w, r)

	w.Header().Set("Content-Type", "text/plain")

	rows, err := db.Query("SHOW DATABASES")
	if err != nil {
		http.Error(w, fmt.Sprintf("Could not query db: %v", err), 500)
	defer rows.Close()

	buf := bytes.NewBufferString("Databases:\n")
	for rows.Next() {
		var dbName string
		if err := rows.Scan(&dbName); err != nil {
			http.Error(w, fmt.Sprintf("Could not scan result: %v", err), 500)
		fmt.Fprintf(buf, "- %s\n", dbName)

func mustGetenv(k string) string {
	v := os.Getenv(k)
	if v == "" {
		log.Panicf("%s environment variable not set.", k)
	return v

Deploying your app

To deploy your app to App Engine, run the gcloud app deploy command:

gcloud app deploy

For details about deploying to App Engine, see Deploying a Go 1.9 App.

That's it! To launch your browser and view the app at http://[YOUR_PROJECT_ID], run the following command:

gcloud app browse
Was this page helpful? Let us know how we did:

Send feedback about...

App Engine standard environment for Go