Configure new and existing instances for IAM database authentication

This page has procedures for creating or editing Cloud SQL instances to allow users or service accounts that are configured to use Cloud SQL IAM database authentication. To learn more about the Cloud SQL IAM integration, see the Overview of Cloud SQL IAM database authentication.

A newly-created instance has four system databases:

  • information_schema: Provides access to database metadata, information about the MySQL server.
  • mysql: The system schema. It contains tables that store information required by the MySQL server as it runs.
  • performance_schema: A feature for monitoring MySQL Server execution at a low level.
  • sys: Contains a set of objects that helps DBAs and developers interpret data collected by the performance schema.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  3. Make sure that billing is enabled for your Google Cloud project.

  4. Install the Google Cloud CLI.
  5. To initialize the gcloud CLI, run the following command:

    gcloud init
  6. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  7. Make sure that billing is enabled for your Google Cloud project.

  8. Install the Google Cloud CLI.
  9. To initialize the gcloud CLI, run the following command:

    gcloud init
  10. Make sure you have the Cloud SQL Admin and Compute Viewer roles on your user account.

    Go to the IAM page

    Learn more about roles and permissions.

Configure new instances for IAM database authentication

Cloud SQL uses a flag to enable and disable IAM user connections on an instance. In this procedure, you enable that flag.

To configure a new instance that uses Cloud SQL IAM database authentication:

Console

  1. In the Google Cloud console, go to the Cloud SQL Instances page.

    Go to Cloud SQL Instances

  2. Click Create Instance.
  3. Click Choose MySQL.
  4. Enter a name for the Instance ID. Don't include sensitive or personally identifiable information in your instance name; it's externally visible. You don't need to include the project ID in the instance name. The project ID is included automatically where appropriate (for example, in the log files).
  5. Enter a password for the root user.
  6. From the Database version drop-down menu, select a database version.
  7. In the Choose region and zonal availability section, select the region and zone for your instance. Place your instance in the same region as the resources that access it. The region you select can't be modified in the future. Usually, you don't need to specify a zone.
  8. In the Customize your instance section, click Show Configuration Options, and then expand Flags.
  9. Click Add Flag.
  10. From the Choose a flag drop-down menu, select the cloudsql_iam_authentication flag. Make sure that On is selected as the value for this flag, and then click Done.
  11. Configure other instance settings, as needed. For more information about settings, see Settings.
  12. Click Create Instance.

gcloud

Run gcloud sql instances create with the -database-flags parameter set to cloudsql_iam_authentication=on.

Replace the following:

  • INSTANCE_NAME: The name of the new instance.
  • MYSQL_VERSION: The MySQL version (such as MYSQL_5_7 or MYSQL_8_0).
  • NUMBER_OF_CORES: The number of cores in the machine.
  • AMOUNT_OF_MEMORY: The amount of memory in the machine. A size unit should be provided (such as, 3072MiB or 9GiB).
  • ZONE: Preferred Compute Engine zone (such as us-central1-a, or us-central1-b).
  • PASSWORD: Create a password for the root user.
gcloud sql instances create INSTANCE_NAME \
--database-version=MYSQL_VERSION \
--cpu=NUMBER_OF_CORES \
--memory=AMOUNT_OF_MEMORY \
--zone=ZONE_NAME \
--root-password=PASSWORD \
--database-flags=cloudsql_iam_authentication=on

REST v1beta4

Do not include sensitive or personally identifiable information in your instance name; it is externally visible.

You do not need to include the project ID in the instance name. The project ID is included automatically where appropriate (for example, in the log files).

Before using any of the request data, make the following replacements:

  • instance-id: The desired instance ID
  • region: The desired region, such as us-east-1
  • project-id: Your project ID
  • location-id: The location ID
  • database-version: Enum string of the database version. For example: MYSQL_8_0
  • password: The password for the root user
  • machine-type: Enum string of the machine (tier) type, as: db-custom-[CPUS]-[MEMORY_MBS]

HTTP method and URL:

POST https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/locations/location-id/instances

Request JSON body:

{
  "name": "instance-id",
  "region": "region",
  "databaseVersion": "database-version",
  "rootPassword": "password",
  "settings": {
    "tier": "machine-type",
    "backupConfiguration": {
      "enabled": true
    },
    "databaseFlags": [
      {
        "name": "cloudsql_iam_authentication",
        "value": "on"
      }
    ]
  }
}

To send your request, expand one of these options:

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-01T19:13:21.834Z",
  "operationType": "CREATE",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}
To see how the underlying REST API request is constructed for this task, see the APIs Explorer on the instances:insert page.

Configure existing instances for Cloud SQL IAM database authentication

To configure IAM database authentication on an existing instance:

Console

  1. In the Google Cloud console, go to the Cloud SQL Instances page.

    Go to Cloud SQL Instances

  2. To open the Overview page of an instance, click the instance name.
  3. Click Edit.
  4. In the Customize your instance section, expand Flags.
  5. Click Add Flag.
  6. From the Choose a flag drop-down menu, select the cloudsql_iam_authentication flag. Make sure that On is selected as the value for this flag, and then click Done.
  7. Configure other instance settings, as needed. For more information about settings, see Settings.
  8. Click Save.

gcloud

For information about installing and getting started with the gcloud CLI, see Install the gcloud CLI. For information about starting Cloud Shell, see Use Cloud Shell.

For this procedure, use gcloud sql instances patch.

Replace the following:

  • INSTANCE_NAME: The name of the new instance.
gcloud sql instances patch INSTANCE_NAME \
--database-flags=cloudsql_iam_authentication=on

This resets all other existing database flag settings. For further guidance on setting database flags, see Set a database flag.

REST v1beta4

Before using any of the request data, make the following replacements:

  • project-id: Your project ID
  • location-id: The location ID
  • instance-id: The desired instance ID
  • region: The desired region
  • database-version: Enum string of the database version. For example: MYSQL_8_0
  • password: The password for the root user
  • machine-type: Enum string of the machine (tier) type, as: db-custom-[CPUS]-[MEMORY_MBS]

HTTP method and URL:

POST https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/locations/location-id/instances

Request JSON body:

{
  "name": "instance-id",
  "region": "region",
  "databaseVersion": "database-version",
  "rootPassword": "password",
  "settings": {
    "tier": "machine-type",
    "backupConfiguration": {
      "enabled": true
    }
    "databaseFlags":
    [
      {
        "name": "cloudsql_iam_authentication",
        "value": "on"
      }
    ]
  }
}

To send your request, expand one of these options:

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-01T19:13:21.834Z",
  "operationType": "CREATE",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

What's next