Authorize with authorized networks

This page describes how to use the authorized networks settings for connecting to Cloud SQL instances that use IP addresses.

Configure authorized networks

Your client application's IP address or address range must be configured as authorized networks for the following conditions:

  • Your client application is connecting directly to a Cloud SQL instance on its public IP address.
  • Your client application is connecting directly to a Cloud SQL instance on its private IP address, and your client's IP address is a non-RFC 1918 address

The IP address can be either a single endpoint or consist of a range in CIDR notation.

Console

  1. In the Google Cloud console, go to the Cloud SQL Instances page.

    Go to Cloud SQL Instances

  2. To open the Overview page of an instance, click the instance name.
  3. From the SQL navigation menu, select Connections.
  4. Click the Network tab.
  5. Select the Public IP checkbox.
  6. Click Add a network.
  7. In the Name field, enter a name for the New network.
  8. In the Network* field, enter the public IPv4 address or address range from which you want to allow connections.

    For the address range, you must use a valid CIDR notation (for example, 10.10.10.0/24).

  9. Click Done.
  10. Click Save.

gcloud

Configuring authorized networks replaces the existing authorized networks list.

gcloud sql instances patch INSTANCE_ID \
--authorized-networks=NETWORK_RANGE_1,NETWORK_RANGE_2...

Terraform

To configure authorized networks, use a Terraform resource.

resource "google_sql_database_instance" "default" {
  name             = "sqlserver-instance-with-authorized-network"
  region           = "us-central1"
  database_version = "SQLSERVER_2019_STANDARD"
  root_password    = "INSERT-PASSWORD-HERE"
  settings {
    tier = "db-custom-2-7680"
    ip_configuration {
      authorized_networks {
        name            = "Network Name"
        value           = "192.0.2.0/24"
        expiration_time = "3021-11-15T16:19:00.094Z"
      }
    }
  }
  # set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
  # use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
  deletion_protection = false
}

Apply the changes

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

Prepare Cloud Shell

  1. Launch Cloud Shell.

  2. Set the default Google Cloud project where you want to apply your Terraform configurations.

    You only need to run this command once per project, and you can run it in any directory.

    export GOOGLE_CLOUD_PROJECT=PROJECT_ID

    Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (also called a root module).

  1. In Cloud Shell, create a directory and a new file within that directory. The filename must have the .tf extension—for example main.tf. In this tutorial, the file is referred to as main.tf. 
    mkdir DIRECTORY && cd DIRECTORY && touch main.tf

  2. If you are following a tutorial, you can copy the sample code in each section or step.

    Copy the sample code into the newly created main.tf.

    Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

  3. Review and modify the sample parameters to apply to your environment.
  4. Save your changes.
  5. Initialize Terraform. You only need to do this once per directory. 
    terraform init

    Optionally, to use the latest Google provider version, include the -upgrade option: 

    terraform init -upgrade

Apply the changes

  1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations: 
    terraform plan

    Make corrections to the configuration as necessary.

  2. Apply the Terraform configuration by running the following command and entering yes at the prompt: 
    terraform apply

    Wait until Terraform displays the "Apply complete!" message.

  3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

Delete the changes

To delete your changes, do the following:

  1. To disable deletion protection, in your Terraform configuration file set the deletion_protection argument to false. 
    deletion_protection =  "false"
  2. Apply the updated Terraform configuration by running the following command and entering yes at the prompt: 
    terraform apply

  1. Remove resources previously applied with your Terraform configuration by running the following command and entering yes at the prompt:

    terraform destroy

REST v1

Configuring authorized networks replaces the existing authorized networks list.

Before using any of the request data, make the following replacements:

  • project-id: The project ID
  • instance-id: The instance ID
  • network_range_1 An authorized ip address or range
  • network_range_2 Another authorized ip address or range

HTTP method and URL: 

PATCH https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id

Request JSON body: 

{
  "settings":
  {
    "ipConfiguration":
    {
      "authorizedNetworks":
        [{"value": "network_range_1"}, {"value": "network_range_2"}]
    }
  }
}

To send your request, expand one of these options:

You should receive a JSON response similar to the following:

REST v1beta4

Configuring authorized networks replaces the existing authorized networks list.

Before using any of the request data, make the following replacements:

  • project-id: The project ID
  • instance-id: The instance ID
  • network_range_1 An authorized ip address or range
  • network_range_2 Another authorized ip address or range

HTTP method and URL: 

PATCH https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

Request JSON body: 

{
  "settings":
  {
    "ipConfiguration":
    {
      "authorizedNetworks":
        [{"value": "network_range_1"}, {"value": "network_range_2"}]
    }
  }
}

To send your request, expand one of these options:

You should receive a JSON response similar to the following:

Limitations

Some IP address ranges can't be added as authorized networks.

Address range Notes
10.0.0.0/8 RFC 1918 address range. These are automatically and implicitly included in the authorized networks by Cloud SQL
172.16.0.0/12 RFC 1918 address range. These are automatically and implicitly included in the authorized networks by Cloud SQL
192.168.0.0/16 RFC 1918 address range. These are automatically and implicitly included in the authorized networks by Cloud SQL

What's next