This page provides information about Identity and Access Management (IAM) roles and permissions and how they are used when connecting to a Cloud SQL instance.
Introduction
Access control for Google Cloud APIs encompasses authentication, authorization, and auditing. Authentication determines who you are. Application developers use IAM service and user accounts for authentication in Google Cloud. Accounts use roles, which include sets of permissions. See Project access control for a complete list of all the roles and permissions available in Cloud SQL.
When you use an account to connect to a Cloud SQL
instance, the account must have the Cloud SQL > Client role (roles/cloudsql.client
), which
includes the permissions
required for connecting.
You can add roles to an account in the Console on the IAM & Admin > IAM page, and see which permissions belong to which roles on the IAM & Admin > Roles page.
Cloud SQL uses service accounts for authentication between Cloud SQL
and other Google Cloud products. Service accounts provide credentials
in
JSON format, which you download from the Console and use for authentication
in various scenarios.
Cloud SQL roles and permissions with Cloud SQL Proxy
If you are connecting to a Cloud SQL instance from a Compute Engine instance using Cloud SQL Proxy, you can use the default Compute Engine service account associated with the Compute Engine instance.
As with all accounts connecting to a Cloud SQL instance, the service account must have the Cloud SQL > Client role.
Cloud SQL roles and permissions with serverless options
You use a service account to authorize access from these options. The service account authorizes access to all Cloud SQL in a specific project. When you create an application or a Cloud Functions, this service creates this account for you. You can find the account on the IAM & Admin > IAM page, with the appropriate suffix:
Serverless option | Service account suffix |
---|---|
App Engine | @gae-api-prod.google.com.iam.gserviceaccount.com |
Cloud Functions | @gcf-admin-robot.iam.gserviceaccount.com |
Cloud Run | compute@developer.gserviceaccount.com |
As with all accounts connecting to a Cloud SQL instance, the service account must have the Cloud SQL > Client role.
Cloud SQL roles and permissions with Cloud Storage
The import and export features in Cloud SQL work together. Exports write to Cloud Storage and imports read from there. For this reason, the service account you use for these operations needs both read and write permissions to Cloud Storage:
- To import data to, and export data from, Cloud Storage, the Cloud SQL
instance's service account must have the
storage.objectAdmin
IAM role set in the project. You can find the instance's service account name in the Google Cloud Console on your instance's Overview page. - You can use the
gsutil iam
command to grant this IAM role to the service account for the bucket. - For help with setting IAM roles and permissions, see Using IAM permissions.
- For more information, see IAM for Cloud Storage.
Cloud SQL roles and permissions with other scenarios
Cloud SQL interacts with other Google Cloud products and tools. These interactions also require specific roles and permissions which can vary between scenarios. Cloud SQL documentation provides detailed information about these requirements for each case below:
What's next
- Learn more about instance access control
- Learn more about project access control