Configuring public IP connectivity

MySQL | PostgreSQL | SQL Server

This page describes how to configure public IP connectivity for a Cloud SQL instance.

Introduction

You can configure your Cloud SQL instance to have a public IPv4 address, and to accept connections from specific IP addresses or a range of addresses by adding authorized addresses to your instance.

For help with connecting an administration client to your instance over an IP connection, see Connecting mysql Client using IP addresses.

If you configure your instance to accept connections using its public IP address, also configure it to use SSL to keep your data secure. For more information, see Configure SSL for Instances.

To configure your instance with an IP address that is not exposed to the public internet, see Configuring Private IP Connectivity.

Enabling public IP and adding an authorized address or address range

To enable public IP and add an authorized address:

When you enable public IP for your instance, it is configured with a public, static IPv4 address.

Console

Go to the Cloud SQL Instances page in the Google Cloud Console.
Go to the Cloud SQL Instances page
Click the instance name to open its Instance details page.
Select the Connections tab.
Select the Public IP checkbox.
Click Add network.
In the Network field, enter the IP address or address range you want to allow connections from.
Use CIDR notation.
Optionally, enter a name for this entry.
Click Done.
Click Save to update the instance.

gcloud

If you haven't already, add an IPv4 address to the instance:
```
gcloud sql instances patch [INSTANCE_NAME] --assign-ip
```
Show all existing authorized addresses by describing the instance:
```
gcloud sql instances describe [INSTANCE_NAME]
```
Look for authorizedNetwork entries under ipConfiguration, and note any authorized addresses you want to keep.
Update the authorized network list, including all addresses you want included.
```
gcloud sql instances patch [INSTANCE_NAME] --authorized-networks=[IP_ADDR1],[IP_ADDR2]...
```
Use CIDR notation.

Confirm your changes:

gcloud sql instances describe [INSTANCE_NAME]

REST

Show all existing authorized addresses by describing the instance:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID
machine-type The instance machine type
zone The instance zone

HTTP method and URL:

GET  https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Note: The command below assumes that you have used either gcloud init or gcloud auth login to authenticate gcloud with your user account. You can check the currently active account by executing gcloud auth list.

Execute the following command:

curl -X GET \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
 https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method GET `
  -Headers $headers `
  -Uri " https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "settings":
  {
    "authorizedGaeApplications": [],
    "tier": "machine-type",
    "kind": "sql#settings",
    "availabilityType": "REGIONAL",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration":
    {
      "privateNetwork": "projects/project-id/global/networks/default",
      "authorizedNetworks": [],
      "ipv4Enabled": true
    },
    "locationPreference":
    {
      "zone": "zone",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "maintenanceWindow":
    {
      "kind": "sql#maintenanceWindow",
      "hour": 0,
      "day": 0
    },
    "backupConfiguration":
    {
      "startTime": "03:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "54",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  }
}

Update the instance, including all addresses you want set on the instance:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID
network_range_1 An authorized ip address or range
network_range_2 Another authorized ip address or range

HTTP method and URL:

PATCH https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

Request JSON body:

{
  "settings":
  {
    "ipConfiguration":
    {
      "authorizedNetworks":
        [{"value": "network_range_1"}, {"value": network_range_2"}]
    }
  }
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Save the request body in a file called request.json, and execute the following command:

curl -X PATCH \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

PowerShell (Windows)

Save the request body in a file called request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method PATCH `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -InFile request.json `
  -Uri "https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "kind": "sql#operation",
  "targetLink": "https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-21T22:43:37.981Z",
  "operationType": "UPDATE",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://www.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

Use CIDR notation.

Confirm your changes:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID
ip-address1: The CIDR form of the first IP address
ip-address-name1: The name of the first IP address
ip-address2: The CIDR form of the second IP address
ip-address-name2: The name of the second IP address
machine-type The instance machine type
zone The instance zone

HTTP method and URL:

GET  https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
 https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method GET `
  -Headers $headers `
  -Uri " https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "settings":
  {
    "authorizedGaeApplications": [],
    "tier": "machine-type4",
    "kind": "sql#settings",
    "availabilityType": "REGIONAL",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration":
    {
      "privateNetwork": "projects/project-id/global/networks/default",
      "authorizedNetworks":
      [
        {
          "value": "ip-address1",
          "name": "ip-address-name1",
          "kind": "sql#aclEntry"
        },
        {
          "value": "ip-address2",
          "name": "ip-address-name2",
          "kind": "sql#aclEntry"
        }
      ],
      "ipv4Enabled": true
    },
    "locationPreference":
    {
      "zone": "zone",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "maintenanceWindow":
    {
      "kind": "sql#maintenanceWindow",
      "hour": 0,
      "day": 0
    },
    "backupConfiguration":
    {
      "startTime": "03:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "54",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  }
}

Removing an authorized address or address range

To remove an authorized address:

Console

Go to the Cloud SQL Instances page in the Google Cloud Console.
Go to the Cloud SQL Instances page
Click the instance name to open its Instance details page.
Select the Connections tab.
Click the delete icon for the address you want to delete.
Click Save to update the instance.

gcloud

Show all existing authorized addresses by describing the instance:
```
gcloud sql instances describe [INSTANCE_NAME]
```
Look for authorizedNetwork entries under ipConfiguration, and note any authorized addresses you want to keep.

Update the authorized network list, dropping off any addresses you want to remove.

gcloud sql instances patch [INSTANCE_NAME] --authorized-networks=[IP_ADDR1],[IP_ADDR2]...

Confirm your changes:

gcloud sql instances describe [INSTANCE_NAME]

REST

Show all existing authorized addresses by describing the instance:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID
ip-address1: The CIDR form of the first IP address
ip-address-name1: The name of the first IP address
ip-address2: The CIDR form of the second IP address
ip-address-name2: The name of the second IP address
machine-type The instance machine type
zone The instance zone

HTTP method and URL:

GET  https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
 https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method GET `
  -Headers $headers `
  -Uri " https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "settings":
  {
    "authorizedGaeApplications": [],
    "tier": "machine-type4",
    "kind": "sql#settings",
    "availabilityType": "REGIONAL",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration":
    {
      "privateNetwork": "projects/project-id/global/networks/default",
      "authorizedNetworks":
      [
        {
          "value": "ip-address1",
          "name": "ip-address-name1",
          "kind": "sql#aclEntry"
        },
        {
          "value": "ip-address2",
          "name": "ip-address-name2",
          "kind": "sql#aclEntry"
        }
      ],
      "ipv4Enabled": true
    },
    "locationPreference":
    {
      "zone": "zone",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "maintenanceWindow":
    {
      "kind": "sql#maintenanceWindow",
      "hour": 0,
      "day": 0
    },
    "backupConfiguration":
    {
      "startTime": "03:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "54",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  }
}

Update the instance, by including all the addresses you want to keep and dropping off any addresses you want to remove:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID
network_range_1 The authorized IP address or network range to remove

HTTP method and URL:

PATCH https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

Request JSON body:

{
  "settings":
  {
    "ipConfiguration":
    {
      "authorizedNetworks":
        [{"value": "network_range_1"}]
    }
  }
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Save the request body in a file called request.json, and execute the following command:

curl -X PATCH \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

PowerShell (Windows)

Save the request body in a file called request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method PATCH `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -InFile request.json `
  -Uri "https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "kind": "sql#operation",
  "targetLink": "https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-21T22:43:37.981Z",
  "operationType": "UPDATE",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://www.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

Confirm your changes:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID
ip-address: The CIDR form of the IP address
ip-address-name: The name of the IP address
machine-type The instance machine type
zone The instance zone

HTTP method and URL:

GET  https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
 https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method GET `
  -Headers $headers `
  -Uri " https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "settings":
  {
    "authorizedGaeApplications": [],
    "tier": "machine-type",
    "kind": "sql#settings",
    "availabilityType": "REGIONAL",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration":
    {
      "privateNetwork": "projects/project-id/global/networks/default",
      "authorizedNetworks":
      [
        {
          "value": "ip-address",
          "name": "ip-address-name",
          "kind": "sql#aclEntry"
        }
      ],
      "ipv4Enabled": true
    },
    "locationPreference":
    {
      "zone": "zone",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "maintenanceWindow":
    {
      "kind": "sql#maintenanceWindow",
      "hour": 0,
      "day": 0
    },
    "backupConfiguration":
    {
      "startTime": "03:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "54",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  }
}

Configuring an instance to refuse all public IP connections

To configure an instance to refuse all public IP connections:

Console

Go to the Cloud SQL Instances page in the Google Cloud Console.
Go to the Cloud SQL Instances page
Click the instance name to open its Instance details page.
Select the Connections tab.
Click the delete icon for all authorized addresses.
Click Save to update the instance.

gcloud

Clear the authorized address list:

gcloud sql instances patch [INSTANCE_NAME] --clear-authorized-networks

Confirm your changes:

gcloud sql instances describe [INSTANCE_NAME]

REST

Show all existing authorized addresses by describing the instance:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID
ip-address1: The CIDR form of the first IP address
ip-address-name1: The name of the first IP address
ip-address2: The CIDR form of the second IP address
ip-address-name2: The name of the second IP address
machine-type The instance machine type
zone The instance zone

HTTP method and URL:

GET  https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
 https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method GET `
  -Headers $headers `
  -Uri " https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "settings":
  {
    "authorizedGaeApplications": [],
    "tier": "machine-type4",
    "kind": "sql#settings",
    "availabilityType": "REGIONAL",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration":
    {
      "privateNetwork": "projects/project-id/global/networks/default",
      "authorizedNetworks":
      [
        {
          "value": "ip-address1",
          "name": "ip-address-name1",
          "kind": "sql#aclEntry"
        },
        {
          "value": "ip-address2",
          "name": "ip-address-name2",
          "kind": "sql#aclEntry"
        }
      ],
      "ipv4Enabled": true
    },
    "locationPreference":
    {
      "zone": "zone",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "maintenanceWindow":
    {
      "kind": "sql#maintenanceWindow",
      "hour": 0,
      "day": 0
    },
    "backupConfiguration":
    {
      "startTime": "03:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "54",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  }
}

Update the instance with an empty address list:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID

HTTP method and URL:

PATCH https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

Request JSON body:

{
  "settings":
  {
    "ipConfiguration":
    {
      "authorizedNetworks": []
    }
  }
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Save the request body in a file called request.json, and execute the following command:

curl -X PATCH \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

PowerShell (Windows)

Save the request body in a file called request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method PATCH `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -InFile request.json `
  -Uri "https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "kind": "sql#operation",
  "targetLink": "https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-21T22:43:37.981Z",
  "operationType": "UPDATE",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://www.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

Confirm your changes:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID
machine-type The instance machine type
zone The instance zone

HTTP method and URL:

GET  https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
 https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method GET `
  -Headers $headers `
  -Uri " https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "settings":
  {
    "authorizedGaeApplications": [],
    "tier": "machine-type",
    "kind": "sql#settings",
    "availabilityType": "REGIONAL",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration":
    {
      "privateNetwork": "projects/project-id/global/networks/default",
      "authorizedNetworks": [],
      "ipv4Enabled": true
    },
    "locationPreference":
    {
      "zone": "zone",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "maintenanceWindow":
    {
      "kind": "sql#maintenanceWindow",
      "hour": 0,
      "day": 0
    },
    "backupConfiguration":
    {
      "startTime": "03:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "54",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  }
}

Disabling public IP

You can disable public IP, but only if your instance is also configured to use Private IP. To enable private IP, see Configuring an existing instance to use private IP.

To disable public IP:

Console

Go to the Cloud SQL Instances page in the Google Cloud Console.
Go to the Cloud SQL Instances page
Click the instance name to open its Instance details page.
Select the Connections tab.
Deselect the Public IP checkbox.
Click Save to update the instance.

gcloud

Update the instance:

gcloud sql instances patch [INSTANCE_NAME] --no-assign-ip

Confirm your changes:

gcloud sql instances describe [INSTANCE_NAME]

REST

Show all existing authorized addresses by describing the instance:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID
ip-address1: The CIDR form of the first IP address
ip-address-name1: The name of the first IP address
ip-address2: The CIDR form of the second IP address
ip-address-name2: The name of the second IP address
machine-type The instance machine type
zone The instance zone

HTTP method and URL:

GET  https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
 https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method GET `
  -Headers $headers `
  -Uri " https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "settings":
  {
    "authorizedGaeApplications": [],
    "tier": "machine-type4",
    "kind": "sql#settings",
    "availabilityType": "REGIONAL",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration":
    {
      "privateNetwork": "projects/project-id/global/networks/default",
      "authorizedNetworks":
      [
        {
          "value": "ip-address1",
          "name": "ip-address-name1",
          "kind": "sql#aclEntry"
        },
        {
          "value": "ip-address2",
          "name": "ip-address-name2",
          "kind": "sql#aclEntry"
        }
      ],
      "ipv4Enabled": true
    },
    "locationPreference":
    {
      "zone": "zone",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "maintenanceWindow":
    {
      "kind": "sql#maintenanceWindow",
      "hour": 0,
      "day": 0
    },
    "backupConfiguration":
    {
      "startTime": "03:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "54",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  }
}

Update the instance:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID

HTTP method and URL:

PATCH https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

Request JSON body:

{
  "settings":
  {
    "ipConfiguration": {"ipv4Enabled": false}
  }
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Save the request body in a file called request.json, and execute the following command:

curl -X PATCH \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

PowerShell (Windows)

Save the request body in a file called request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method PATCH `
  -Headers $headers `
  -ContentType: "application/json; charset=utf-8" `
  -InFile request.json `
  -Uri "https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "kind": "sql#operation",
  "targetLink": "https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-21T22:43:37.981Z",
  "operationType": "UPDATE",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://www.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

Confirm your changes:

Before using any of the request data below, make the following replacements:

project-id: The project ID
instance-id: The instance ID
machine-type The instance machine type
zone The instance zone

HTTP method and URL:

GET  https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Execute the following command:

curl -X GET \
-H "Authorization: Bearer "$(gcloud auth print-access-token) \
 https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings

PowerShell (Windows)

Execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
  -Method GET `
  -Headers $headers `
  -Uri " https://www.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id?fields=settings" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

Response

{
  "settings":
  {
    "authorizedGaeApplications": [],
    "tier": "machine-type",
    "kind": "sql#settings",
    "availabilityType": "REGIONAL",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration":
    {
      "privateNetwork": "projects/project-id/global/networks/default",
      "authorizedNetworks": [],
      "ipv4Enabled": false
    },
    "locationPreference":
    {
      "zone": "zone",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "maintenanceWindow":
    {
      "kind": "sql#maintenanceWindow",
      "hour": 0,
      "day": 0
    },
    "backupConfiguration":
    {
      "startTime": "03:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "54",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  }
}

Configuring public IP connectivity

Introduction

Enabling public IP and adding an authorized address or address range

Console

gcloud

REST

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

Removing an authorized address or address range

Console

gcloud

REST

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

Configuring an instance to refuse all public IP connections

Console

gcloud

REST

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

Disabling public IP

Console

gcloud

REST

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

curl (Linux, macOS, or Cloud Shell)

PowerShell (Windows)

Response

What's next