About the Cloud SQL Proxy

MySQL | PostgreSQL

This page provides a basic introduction to the Cloud SQL Proxy, and describes the proxy options.

For step-by-step instructions on using the proxy, follow the link for your environment:

What the proxy provides

The Cloud SQL Proxy provides secure access to your Cloud SQL instances without having to whitelist IP addresses or configure SSL.

Accessing your Cloud SQL instance using the Cloud SQL Proxy offers these advantages:

Secure connections: The proxy automatically encrypts traffic to and from the database; SSL certificates are used to verify client and server identities.
Easier connection management: The proxy handles authentication with Google Cloud SQL, removing the need to provide static IP addresses.

The proxy uses the Cloud SQL API to authenticate with the Google Cloud Platform; you must enable the API before using the proxy. You must also provide the proxy with a valid user account.

Options for authenticating the Cloud SQL Proxy

The Cloud SQL Proxy provides several alternatives for authentication, depending on your environment. The proxy checks for each of the following items, in this order, using the first one it finds to attempt to authenticate:

Credentials supplied in the proxy invocation command
Credentials supplied by the local environment
Credentials associated with the Compute Engine instance
Credentials from an authenticated Cloud SDK client

See sample invocations and connection strings.

Credentials supplied in the proxy invocation command

You can create a credential file using the Google Cloud Platform Console and provide it on the command line when you start the Cloud SQL Proxy with the -credential_file parameter. The service account must have the required permissions for the Cloud SQL instance.

The advantage of this authentication method is that you can create a credential file specifically for the proxy, and it is explicitly and permanently linked to the proxy as long as it is running. For this reason, this is the recommended method for production instances not running on a Compute Engine instance.

The credential file can be duplicated in a system image if you need to invoke the Cloud SQL Proxy from multiple machines.

To use this method, you must create and manage the credential file. For information about creating a credential file, see Creating a service account.

Credentials supplied by the local environment

This method is identical to supplying a credential file on the command line, except that the location of the credential file is supplied using the GOOGLE_APPLICATION_CREDENTIALS environment variable.

Credentials associated with the Compute Engine instance

If you are connecting to Cloud SQL from a Compute Engine instance, the proxy can use the service account associated with the Compute Engine instance. If the service account has the required permissions for the Cloud SQL instance, the proxy authenticates successfully.

If the Compute Engine instance is in the same project as the Cloud SQL instance, the default service account for the Compute Engine instance has the necessary permissions for authenticating the proxy. If the two instances are in different projects, you must add the Compute Engine instance's service account to the project containing the Cloud SQL instance.

Credentials from an authenticated Cloud SDK client

If you have installed the Cloud SDK and used it to authenticate to the Google Cloud Platform, the Cloud SQL Proxy can use the same credentials. This method is especially helpful for getting a development environment up and running quickly. For a production environment, you should use one of the other methods to authenticate.

You can determine what your current Cloud SDK credentials are by using the gcloud auth list command.

Required permissions for service accounts

When you use a service account to provide the credentials for the proxy, you must create it with sufficient permissions. If you are using the finer-grained Identity Access and Management (IAM) roles to manage your Cloud SQL permissions, you must give the service account the Cloud SQL Client role.

If you are using the legacy roles (Viewer, Editor, Owner), the service account must have at least the Editor role.

Options for specifying Cloud SQL instances

There are several ways to tell the proxy which instances you want to connect to. Some are explicit and some are implicit. In some configurations, you do not have to tell the proxy ahead of time which instances you want to connect to, because the proxy connects based on connection requests.

Your options for instance specification depend on your operating system and environment:

Option	Benefits	Caveats and Requirements	Linux/OS X (Unix sockets)	Java	Windows	Notes
Automatic instance discovery	No need to specify instances; sockets created for all instances in default project.	Proxy API usage is increased. Must have Cloud SDK installed and authenticated, with a default project set. Must restart proxy to add new instance.	Supported	No	No	Not recommended for production instances.
Project discovery	No need to specify instances; sockets created for all instances in specified projects.	Proxy API usage is increased. Must have Cloud SDK installed and authenticated. Must restart proxy to add new instance.	Supported	No	No	Use `-projects` parameter. Not recommended for production instances.
Instances specified on proxy invocation	Instance list known and static.	Must restart proxy to add new instance.	Supported	Supported with TCP sockets	Supported with TCP sockets	Use `-instances` parameter. For multiple instances, use a comma-separated list.
Instances specified using Compute Engine metadata	Instance list can be updated by changing the metadata value without restarting the proxy.	Available only on Compute Engine.	Supported	Supported with TCP sockets	Supported with TCP sockets	Use `-instances_metadata` flag. Learn more.

See sample invocations and connection strings.

Tips for working with Cloud SQL Proxy

Invoking the Cloud SQL Proxy

All of the example proxy invocations start the proxy in the background, so a prompt is returned. It is preferable to reserve that terminal for the proxy, to avoid having its output mixed with the output from other programs.

Keeping the Cloud SQL Proxy up to date

Google occasionally releases new versions of the proxy. You can see what the current version is by checking the Cloud SQL Proxy Github releases page. Future proxy releases will also be noted in the Google Groups Cloud SQL announce forum.

API usage

The Cloud SQL Proxy issues requests to the Cloud SQL API. If you are using automatic instance discovery or the -projects parameter, the proxy's API usage is increased, in some cases significantly. These requests count against the API quota for your project. This is one reason why you should not use automatic instance discovery or the -projects parameter in production.

Cloud SQL Proxy parameters and flags

The Cloud SQL Proxy accepts several flags and parameters when it is started. These options determine where and how the Cloud SQL Proxy creates the sockets it uses for communicating with Cloud SQL, and how it authenticates.

For help with proxy options, see the following information:

Options for authenticating the Cloud SQL Proxy
Options for specifying Cloud SQL instances
Example proxy invocations
Cloud SQL Proxy GitHub page
The proxy help, displayed with ./cloud_sql_proxy -help

Example proxy invocations and psql client connection strings

The instance connection name is listed in the instance properties in the Google Cloud Platform Console.

Using automatic instance discovery with gcloud credentials:

./cloud_sql_proxy -dir=/cloudsql &
 psql -U [USER_NAME] -h /cloudsql/[INSTANCE_CONNECTION_NAME]

Using project discovery with gcloud credentials:

./cloud_sql_proxy -dir=/cloudsql -projects=[PROJECT-ID]&
psql -U [USER_NAME] -h /cloudsql/[INSTANCE_CONNECTION_NAME]

For a Google Compute Engine instance, with explicit instance specification:

./cloud_sql_proxy -dir=/cloudsql -instances=[INSTANCE_CONNECTION_NAME] &
psql -U [USER_NAME] -h /cloudsql/[INSTANCE_CONNECTION_NAME]

For Unix, using TCP:

./cloud_sql_proxy -instances=[INSTANCE_CONNECTION_NAME]=tcp:5432 &
psql -U [USER_NAME] -h 127.0.0.1

For Windows (at the command line prompt):

cloud_sql_proxy.exe -instances=[INSTANCE_CONNECTION_NAME]=tcp:5432
psql -U [USER_NAME] -h 127.0.0.1

For more information about Cloud SQL Proxy options and connection strings, see the Cloud SQL Proxy GitHub page.

Creating a service account

To create a service account:

Go to the Cloud SQL Service accounts page of the Google Cloud Platform Console.
Go to the Service accounts page
If needed, select the project that contains your Cloud SQL instance.
Click Create service account.
In the Create service account dialog, provide a descriptive name for the service account.
For Role, select Cloud SQL > Cloud SQL Client.
Alternatively, you can use the primitive Editor role by selecting Roles > Editor, but the Editor role includes permissions across Google Cloud Platform.
Change the Service account ID to a shorter value if needed.
Click Furnish a new private key.
The default key type is JSON, the correct value.
Click Create.
The private key file is downloaded to your machine. You can move it to another location. Keep the key file secure.

For more information about service accounts, see User accounts and service accounts.