Roles and permissions in Cloud SQL

This page provides information about Cloud Identity and Access Management (Cloud IAM) roles and permissions and how they are used when connecting to a Cloud SQL instance.

Introduction

Access control for Google Cloud APIs encompasses authentication, authorization, and auditing. Authentication determines who you are. Application developers use Cloud IAM service and user accounts for authentication in Google Cloud. Accounts use roles, which include sets of permissions. See Project access control for a complete list of all the roles and permissions available in Cloud SQL.

When you use an account to connect to a Cloud SQL instance, the account must have the Cloud SQL > Client role, which includes the following permissions required for connecting:

  • roles/cloudsql.instances.connect
  • roles/cloudsql.instances.get

You can add roles to an account in the Console on the IAM & Admin > IAM page, and see which permissions belong to which roles on the IAM & Admin > Roles page.

Cloud SQL uses service accounts for authentication between Cloud SQL and other Google Cloud products. Service accounts provide credentials in JSON format, which you download from the Console and use for authentication in various scenarios.

Cloud SQL roles and permissions with Cloud SQL Proxy

If you are connecting to a Cloud SQL instance from a Compute Engine instance using Cloud SQL Proxy, you can use the default Compute Engine service account associated with the Compute Engine instance.

As with all accounts connecting to a Cloud SQL instance, the service account must have the Cloud SQL > Client role.

Cloud SQL roles and permissions with serverless options

You use a service account to authorize access from these options. The service account authorizes access to all Cloud SQL in a specific project. When you create an application or a Cloud Functions, this service creates this account for you. You can find the account on the IAM & Admin > IAM page, with the appropriate suffix:

Serverless option Service account suffix
App Engine @gae-api-prod.google.com.iam.gserviceaccount.com
Cloud Functions @gcf-admin-robot.iam.gserviceaccount.com
Cloud Run compute@developer.gserviceaccount.com

As with all accounts connecting to a Cloud SQL instance, the service account must have the Cloud SQL > Client role.

Cloud SQL roles and permissions with Cloud Storage

The import and export features in Cloud SQL work together. Exports write to Cloud Storage and imports read from there. For this reason, the service account you use for these operations needs both read and write permissions to Cloud Storage:

  • To import data to, and export data from, Cloud Storage, the Cloud SQL instance's service account must have the storage.objectAdmin Cloud IAM role set in the project.
  • You can use the gsutil iam command to grant this Cloud IAM role to the service account for the bucket.
  • For help with setting Cloud IAM roles and permissions, see Using Cloud IAM permissions.
  • For more information, see Cloud IAM for Cloud Storage.

Cloud SQL roles and permissions with other scenarios

Cloud SQL interacts with other Google Cloud products and tools. These interactions also require specific roles and permissions which can vary between scenarios. Cloud SQL documentation provides detailed information about these requirements for each case below:

What's next