Configuring instances for IAM database authentication

This page has procedures for creating or editing Cloud SQL instances to allow users or service accounts that are configured to use Cloud SQL IAM database authentication. To learn more about the Cloud SQL IAM integration, see the Overview of Cloud SQL IAM database authentication.

Before you begin

  1. Sign in to your Google Account.

    If you don't already have one, sign up for a new account.

  2. In the Google Cloud Console, on the project selector page, select or create a Google Cloud project.

    Go to the project selector page

  3. Make sure that billing is enabled for your Cloud project. Learn how to confirm that billing is enabled for your project.

  4. Install and initialize the Cloud SDK.
  5. Make sure you have the Cloud SQL Admin and Compute Viewer roles on your user account.

    Go to the IAM page

    Learn more about roles and permissions.

Configuring new instances for IAM database authentication

To configure a new instance that uses Cloud SQL IAM database authentication:

Console

  1. Go to the Cloud SQL Instances page in the Google Cloud Console.

    Go to the Cloud SQL Instances page

  2. Click Create instance.
  3. Select PostgreSQL and click Next.
  4. Enter a name for the Instance ID. Do not include sensitive or personally identifiable information in your instance name; it is externally visible. You do not need to include the project ID in the instance name. The project ID is included automatically where appropriate (for example, in the log files). Note: You cannot reuse an instance name for up to a week after you have deleted the instance.
  5. Enter a password for the postgres user.
  6. Under Location, select the region and zone for your instance. Place your instance in the same region as the resources that access it. The region you select can't be modified in the future. Usually, you don't need to specify a zone. Note: If there is a resource location constraint on your organization policy, you must select one of the regions that the organization policy allows. If a constraint exists, you see a message about Resource Location Restriction in the Location section. Learn more.
  7. Select a database version.
  8. Under Configuration options, expand Flags.
  9. Select + Add item.
  10. Enter cloudsql.iam_authentication for the flag name. Make sure that On is selected for this flag.
  11. Configure other instance settings, as needed. For more information about settings, see Settings.
  12. Click Create.

gcloud

Run gcloud sql instances create with the cloudsql.iam_authentication database flag set to on.

Replace the following:

  • INSTANCE_NAME: The name of the new instance.
  • POSTGRES_VERSION: The PosgreSQL version (such as POSTGRES_9_6, POSTGRES_10, POSTGRES_11, or POSTGRES_12).
  • NUMBER_OF_CORES: The number of cores in the machine.
  • AMOUNT_OF_MEMORY: The amount of memory in the machine. A size unit should be provided (such as, 3072MiB or 9GiB).
  • ZONE: Preferred Compute Engine zone (such as us-central1-a, or us-central1-b).
  • PASSWORD: Create a password for the root user.
gcloud sql instances create INSTANCE_NAME
--database-version=POSTGRES_VERSION --cpu=NUMBER_OF_CORES
--memory=AMOUNT_OF_MEMORY --zone=ZONE_NAME
--root-password=PASSWORD --database-flags cloudsql.iam_authentication=on

Configuring existing instances for Cloud SQL IAM database authentication

To configure IAM database authentication on an existing instance:

Console

  1. Go to the Cloud SQL Instances page in the Google Cloud Console.

    Go to the Cloud SQL Instances page

  2. Click the name of the instance you want to edit.
  3. Click EDIT.
  4. Under Configuration options, expand Flags.
  5. Select + Add item.
  6. Enter cloudsql.iam_authentication for the flag name. Make sure that On is selected for this flag.
  7. Configure other instance settings, as needed. For more information about settings, see Settings.
  8. Click Save.

gcloud

For information about installing and getting started with the gcloud command-line tool, see Installing Cloud SDK. For information about starting Cloud Shell, see the Cloud Shell documentation.

Run gcloud sql instances patch with the cloudsql.iam_authentication database flag set to on.

Replace the following:

  • INSTANCE_NAME: The name of the new instance.
gcloud sql instances patch INSTANCE_NAME --database-flags
    cloudsql.iam_authentication=on

What's next