This page provides a basic introduction to the Cloud SQL Proxy, and describes the proxy options.
For step-by-step instructions on using the proxy, follow the link for your environment:
- How to connect using the proxy from Google Compute Engine
- How to connect using the proxy from an external application
- How to connect a psql client using the proxy from an client machine
- How to connect a psql client using the proxy Docker client
- How to connect using the proxy from Google Container Engine
What the proxy providesThe Cloud SQL Proxy provides secure access to your Cloud SQL instances without having to whitelist IP addresses or configure SSL.
Accessing your Cloud SQL instance using the Cloud SQL Proxy offers these advantages:
- Secure connections: The proxy automatically encrypts traffic to and from the database; SSL certificates are used to verify client and server identities.
- Easier connection management: The proxy handles authentication with Google Cloud SQL, removing the need to provide static IP addresses.
The proxy uses the Cloud SQL API to authenticate with the Google Cloud Platform; you must enable the API before using the proxy. You must also provide the proxy with a valid user account.
Options for authenticating the Cloud SQL Proxy
The Cloud SQL Proxy provides several alternatives for authentication, depending on your environment. The proxy checks for each of the following items, in this order, using the first one it finds to attempt to authenticate:
- Credentials supplied in the proxy invocation command
- Credentials supplied by the local environment
- Credentials associated with the Compute Engine instance
- Credentials from an authenticated Cloud SDK client
Credentials supplied in the proxy invocation command
You can create a credential file using the Google Cloud Platform Console and provide it on
the command line when you start the Cloud SQL Proxy with the
The service account must have the required permissions
for the Cloud SQL instance.
The advantage of this authentication method is that you can create a credential file specifically for the proxy, and it is explicitly and permanently linked to the proxy as long as it is running. For this reason, this is the recommended method for production instances not running on a Compute Engine instance.
The credential file can be duplicated in a system image if you need to invoke the Cloud SQL Proxy from multiple machines.
To use this method, you must create and manage the credential file. For information about creating a credential file, see Creating a service account.
Credentials supplied by the local environment
This method is identical to supplying a credential file on the command line,
except that the location of the credential file is supplied using the
GOOGLE_APPLICATION_CREDENTIALS environment variable.
Credentials associated with the Compute Engine instance
If you are connecting to Cloud SQL from a Compute Engine instance, the proxy can use the service account associated with the Compute Engine instance. If the service account has the required permissions for the Cloud SQL instance, the proxy authenticates successfully.
If the Compute Engine instance is in the same project as the Cloud SQL instance, the default service account for the Compute Engine instance has the necessary permissions for authenticating the proxy. If the two instances are in different projects, you must add the Compute Engine instance's service account to the project containing the Cloud SQL instance.
Credentials from an authenticated Cloud SDK client
If you have installed the Cloud SDK and used it to authenticate to the Google Cloud Platform, the Cloud SQL Proxy can use the same credentials. This method is especially helpful for getting a development environment up and running quickly. For a production environment, you should use one of the other methods to authenticate.
You can determine what your current Cloud SDK credentials are by using the
gcloud auth list command.
Required permissions for service accounts
When you use a service account to provide the credentials for the proxy, you must create it with sufficient permissions. If you are using the finer-grained Identity Access and Management (IAM) roles to manage your Cloud SQL permissions, you must give the service account the Cloud SQL Client role.
If you are using the legacy roles (Viewer, Editor, Owner), the service account must have at least the Editor role.
Options for specifying Cloud SQL instances
There are several ways to tell the proxy which instances you want to connect to. Some are explicit and some are implicit. In some configurations, you do not have to tell the proxy ahead of time which instances you want to connect to, because the proxy connects based on connection requests.
Your options for instance specification depend on your operating system and environment:
|Option||Benefits||Caveats and Requirements||Linux/OS X
|Automatic instance discovery||No need to specify instances; sockets created for all instances in default project.||Proxy API usage is increased. Must have Cloud SDK installed and authenticated, with a default project set. Must restart proxy to add new instance.||Supported||No||No||Not recommended for production instances.|
|Project discovery||No need to specify instances; sockets created for all instances in specified projects.||Proxy API usage is increased. Must have Cloud SDK installed and authenticated. Must restart proxy to add new instance.||Supported||No||No||
|Instances specified on proxy invocation||Instance list known and static.||Must restart proxy to add new instance.||Supported||Supported with TCP sockets||Supported with TCP sockets||
|Instances specified using Compute Engine metadata||Instance list can be updated by changing the metadata value without restarting the proxy.||Available only on Compute Engine.||Supported||Supported with TCP sockets||Supported with TCP sockets||
Tips for working with Cloud SQL Proxy
Invoking the Cloud SQL Proxy
All of the example proxy invocations start the proxy in the background, so a prompt is returned. It is preferable to reserve that terminal for the proxy, to avoid having its output mixed with the output from other programs.
The Cloud SQL Proxy issues requests to the Cloud SQL API.
If you are using automatic instance discovery or the
-projects parameter, the
proxy's API usage is increased, in some cases significantly.
These requests count against the API quota for your project. This is one reason
why you should not use automatic instance discovery or the
Cloud SQL Proxy parameters and flags
The Cloud SQL Proxy accepts several flags and parameters when it is started. These options determine where and how the Cloud SQL Proxy creates the sockets it uses for communicating with Cloud SQL, and how it authenticates.
For help with proxy options, see the following information:
- Options for authenticating the Cloud SQL Proxy
- Options for specifying Cloud SQL instances
- Example proxy invocations
- Cloud SQL Proxy GitHub page
- The proxy help, displayed with
Example proxy invocations and psql client connection strings
The instance connection name is listed in the instance properties in the Google Cloud Platform Console.Using automatic instance discovery with gcloud credentials:
Using project discovery with gcloud credentials:
./cloud_sql_proxy -dir=/cloudsql & psql -U [USER_NAME] -h /cloudsql/[INSTANCE_CONNECTION_NAME]
For a Google Compute Engine instance, with explicit instance specification:
./cloud_sql_proxy -dir=/cloudsql -projects=[PROJECT-ID]& psql -U [USER_NAME] -h /cloudsql/[INSTANCE_CONNECTION_NAME]
For Unix, using TCP:
./cloud_sql_proxy -dir=/cloudsql -instances=[INSTANCE_CONNECTION_NAME] & psql -U [USER_NAME] -h /cloudsql/[INSTANCE_CONNECTION_NAME]
For Windows (at the command line prompt):
./cloud_sql_proxy -instances=[INSTANCE_CONNECTION_NAME]=tcp:5432 & psql -U [USER_NAME] -h 127.0.0.1
cloud_sql_proxy.exe -instances=[INSTANCE_CONNECTION_NAME]=tcp:5432 psql -U [USER_NAME] -h 127.0.0.1
For more information about Cloud SQL Proxy options and connection strings, see the Cloud SQL Proxy GitHub page.
Creating a service account
To create a service account:
- Go to the Cloud SQL Service accounts page of the Google Cloud Platform Console.
- If needed, select the project that contains your Cloud SQL instance.
- Click Create service account.
- In the Create service account dialog, provide a descriptive name for the service account.
For Role, select Cloud SQL > Cloud SQL Client.
Alternatively, you can use the primitive Editor role by selecting Roles > Editor, but the Editor role includes permissions across Google Cloud Platform.
- Change the Service account ID to a shorter value if needed.
- Click Furnish a new private key.
The default key type is
JSON, the correct value.
The private key file is downloaded to your machine. You can move it to another location. Keep the key file secure.
For more information about service accounts, see User accounts and service accounts.
- Learn more about the Cloud SQL Proxy
- Connect using the proxy from Google Compute Engine
- Connect using the proxy from an external application
- Connect a psql client using the proxy from a client machine
- Connect a psql client using the proxy Docker client
- Connect using the proxy from Google Container Engine