Configure new and existing instances for IAM database authentication

MySQL | PostgreSQL | SQL Server

This page has procedures for creating or editing Cloud SQL instances to allow users, service accounts, or groups that are configured to use Cloud SQL IAM database authentication. To learn more about the Cloud SQL IAM integration, see IAM authentication.

A newly-created instance has four system databases:

information_schema: Provides access to database metadata, information about the MySQL server.
mysql: The system schema. It contains tables that store information required by the MySQL server as it runs.
performance_schema: A feature for monitoring MySQL Server execution at a low level.
sys: Contains a set of objects that helps DBAs and developers interpret data collected by the performance schema.

Before you begin

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Go to project selector

Make sure that billing is enabled for your Google Cloud project.

Install the Google Cloud CLI.

To initialize the gcloud CLI, run the following command:

gcloud init

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Go to project selector

Make sure that billing is enabled for your Google Cloud project.

Install the Google Cloud CLI.

To initialize the gcloud CLI, run the following command:

gcloud init

Make sure you have the Cloud SQL Admin and Compute Viewer roles on your user account.
Go to the IAM page

Learn more about roles and permissions.

Configure new instances for IAM database authentication

To configure a new Cloud SQL instance for IAM database authentication, you need to enable the cloudsql_iam_authentication flag. After you enable this flag, you can add IAM users, service accounts, or groups to the Cloud SQL instance.

To configure a new Cloud SQL instance to use IAM database authentication:

Console

In the Google Cloud console, go to the Cloud SQL Instances page.

Go to Cloud SQL Instances
Click Create Instance.
Click Choose MySQL.
Enter a name for the Instance ID.
Enter a password for the root user.
From the Database version menu, select a database version.
In the Choose region and zonal availability section, select the region and zone for your instance. Place your instance in the same region as the resources that access it. The region you select can't be modified in the future. Usually, you don't need to specify a zone.
Note: If there's a resource location constraint on your organization policy, then you must select one of the regions that the organization policy allows. If a constraint exists, then a message appears about the constraint. Learn more.
In the Customize your instance section, click Show Configuration Options, and then expand Flags.
Click Add Flag.
From the Choose a flag menu, select the cloudsql_iam_authentication flag. Make sure that On is selected as the value for this flag, and then click Done.
Configure other instance settings, as needed. For more information about settings, see Settings.
Click Create Instance.

gcloud

Run gcloud sql instances create with the --database-flags parameter set to cloudsql_iam_authentication=on.

Replace the following:

INSTANCE_NAME: the name of the new instance.
MYSQL_VERSION: the MySQL version (such as MYSQL_5_7 or MYSQL_8_0).
Note: This feature does not support MYSQL_5_6.
NUMBER_OF_CORES: the number of cores in the machine.
AMOUNT_OF_MEMORY: the amount of memory in the machine. A size unit should be provided (such as, 3072MiB or 9GiB).
ZONE: preferred Compute Engine zone (such as us-central1-a, or us-central1-b).
PASSWORD: create a password for the root user.

gcloud sql instances create INSTANCE_NAME \
--database-version=MYSQL_VERSION \
--cpu=NUMBER_OF_CORES \
--memory=AMOUNT_OF_MEMORY \
--zone=ZONE_NAME \
--root-password=PASSWORD \
--database-flags=cloudsql_iam_authentication=on

Terraform

To create an instance with IAM database authentication enabled, use a Terraform resource.

resource "google_sql_database_instance" "default" {
  name             = "mysql-db-auth-instance-name-test"
  region           = "us-west4"
  database_version = "MYSQL_8_0"
  settings {
    tier = "db-f1-micro"
    database_flags {
      name  = "cloudsql_iam_authentication"
      value = "on"
    }
  }
  # set `deletion_protection` to true, will ensure that one cannot accidentally
  # delete this instance by use of Terraform whereas
  # `deletion_protection_enabled` flag protects this instance at the GCP level.
  deletion_protection = false
}

Apply the changes

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

Prepare Cloud Shell

Launch Cloud Shell.
Set the default Google Cloud project where you want to apply your Terraform configurations.

You only need to run this command once per project, and you can run it in any directory.
```
export GOOGLE_CLOUD_PROJECT=PROJECT_ID
```
Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (also called a root module).

In Cloud Shell, create a directory and a new file within that directory. The filename must have the .tf extension—for example main.tf. In this tutorial, the file is referred to as main.tf.
```
mkdir DIRECTORY && cd DIRECTORY && touch main.tf
```
If you are following a tutorial, you can copy the sample code in each section or step.

Copy the sample code into the newly created main.tf.

Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.
Review and modify the sample parameters to apply to your environment.
Save your changes.
Initialize Terraform. You only need to do this once per directory.
```
terraform init
```
Optionally, to use the latest Google provider version, include the -upgrade option:
```
terraform init -upgrade
```

Apply the changes

Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:
```
terraform plan
```
Make corrections to the configuration as necessary.
Apply the Terraform configuration by running the following command and entering yes at the prompt:
```
terraform apply
```
Wait until Terraform displays the "Apply complete!" message.
Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

Delete the changes

To delete your changes, do the following:

To disable deletion protection, in your Terraform configuration file set the deletion_protection argument to false.
```
deletion_protection =  "false"
```
Apply the updated Terraform configuration by running the following command and entering yes at the prompt:
```
terraform apply
```

Remove resources previously applied with your Terraform configuration by running the following command and entering yes at the prompt:
```
terraform destroy
```

REST v1

Don't include sensitive or personally identifiable information (PII) in your instance name; it is externally visible.

You don't need to include the project ID in the instance name. The project ID is included automatically where needed (for example, in the log files).

Before using any of the request data, make the following replacements:

INSTANCE_ID: the desired instance ID
REGION: the desired region, such as us-east-1
PROJECT_ID: the project ID
LOCATION_ID: the location ID
DATABASE_VERSION: enum string of the database version. For example: MYSQL_8_0
PASSWORD: the password for the root user
MACHINE_TYPE: enum string of the machine (tier) type, as: db-custom-[CPUS]-[MEMORY_MBS]

HTTP method and URL:

POST https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/instances

Request JSON body:

{
  "name": "INSTANCE_ID",
  "region": "REGION",
  "databaseVersion": "DATABASE_VERSION",
  "rootPassword": "PASSWORD",
  "settings": {
    "tier": "MACHINE_TYPE",
    "backupConfiguration": {
      "enabled": true
    },
    "databaseFlags": [
      {
        "name": "cloudsql_iam_authentication",
        "value": "on"
      }
    ]
  }
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login , or by using Cloud Shell, which automatically logs you into the gcloud CLI . You can check the currently active account by running gcloud auth list.

Save the request body in a file named request.json, and execute the following command:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/instances"

PowerShell (Windows)

Note: The following command assumes that you have logged in to the gcloud CLI with your user account by running gcloud init or gcloud auth login . You can check the currently active account by running gcloud auth list.

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/instances" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID",
  "status": "PENDING",
  "user": "[email protected]",
  "insertTime": "2020-01-01T19:13:21.834Z",
  "operationType": "CREATE",
  "name": "OPERATION_ID",
  "targetId": "INSTANCE_ID",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/operations/OPERATION_ID",
  "targetProject": "PROJECT_ID"
}

To see how the underlying REST API request is constructed for this task, see the APIs Explorer on the instances:insert page.

REST v1beta4

Don't include sensitive or personally identifiable information (PII) in your instance name; it is externally visible.

You don't need to include the project ID in the instance name. The project ID is included automatically where needed (for example, in the log files).

Before using any of the request data, make the following replacements:

INSTANCE_ID: the desired instance ID
REGION: the desired region, such as us-east-1
PROJECT_ID: the project ID
LOCATION_ID: the location ID
DATABASE_VERSION: enum string of the database version. For example: MYSQL_8_0
PASSWORD: the password for the root user
MACHINE_TYPE: enum string of the machine (tier) type, as: db-custom-[CPUS]-[MEMORY_MBS]

HTTP method and URL:

POST https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/locations/LOCATION_ID/instances

Request JSON body:

{
  "name": "INSTANCE_ID",
  "region": "REGION",
  "databaseVersion": "DATABASE_VERSION",
  "rootPassword": "PASSWORD",
  "settings": {
    "tier": "MACHINE_TYPE",
    "backupConfiguration": {
      "enabled": true
    },
    "databaseFlags": [
      {
        "name": "cloudsql_iam_authentication",
        "value": "on"
      }
    ]
  }
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Save the request body in a file named request.json, and execute the following command:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/locations/LOCATION_ID/instances"

PowerShell (Windows)

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/locations/LOCATION_ID/instances" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID",
  "status": "PENDING",
  "user": "[email protected]",
  "insertTime": "2020-01-01T19:13:21.834Z",
  "operationType": "CREATE",
  "name": "OPERATION_ID",
  "targetId": "INSTANCE_ID",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/operations/OPERATION_ID",
  "targetProject": "PROJECT_ID"
}

To see how the underlying REST API request is constructed for this task, see the APIs Explorer on the instances:insert page.

Configure existing instances for IAM database authentication

To configure an existing Cloud SQL instance for IAM database authentication, you need to enable the cloudsql_iam_authentication flag. After you enable this flag, you can add IAM users, service accounts, or groups to the Cloud SQL instance.

To configure an existing Cloud SQL instance to use IAM database authentication:

Console

In the Google Cloud console, go to the Cloud SQL Instances page.

Go to Cloud SQL Instances
To open the Overview page of an instance, click the instance name.
Click Edit.
In the Customize your instance section, expand Flags.
Click Add Flag.
From the Choose a flag menu, select the cloudsql_iam_authentication flag. Make sure that On is selected as the value for this flag, and then click Done.
Configure other instance settings, as needed. For more information about settings, see Settings.
Click Save.

gcloud

For information about installing and getting started with the gcloud CLI, see Install the gcloud CLI. For information about starting Cloud Shell, see Use Cloud Shell.

For this procedure, use gcloud sql instances patch.

Replace the following:

INSTANCE_NAME: the name of the new instance.

gcloud sql instances patch INSTANCE_NAME \
--database-flags=cloudsql_iam_authentication=on

This resets all other existing database flag settings. For further guidance on setting database flags, see Set a database flag.

REST v1

Before using any of the request data, make the following replacements:

PROJECT_ID: the project ID
LOCATION_ID: the location ID
INSTANCE_ID: the desired instance ID
REGION: the desired region
DATABASE_VERSION: enum string of the database version. For example: MYSQL_8_0
PASSWORD: the password for the root user
MACHINE_TYPE: enum string of the machine (tier) type, as: db-custom-[CPUS]-[MEMORY_MBS]

HTTP method and URL:

POST https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/instances

Request JSON body:

{
  "name": "INSTANCE_ID",
  "region": "REGION",
  "databaseVersion": "DATABASE_VERSION",
  "rootPassword": "PASSWORD",
  "settings": {
    "tier": "MACHINE_TYPE",
    "backupConfiguration": {
      "enabled": true
    }
    "databaseFlags":
    [
      {
        "name": "cloudsql_iam_authentication",
        "value": "on"
      }
    ]
  }
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Save the request body in a file named request.json, and execute the following command:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/instances"

PowerShell (Windows)

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION_ID/instances" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID",
  "status": "PENDING",
  "user": "[email protected]",
  "insertTime": "2020-01-01T19:13:21.834Z",
  "operationType": "CREATE",
  "name": "OPERATION_ID",
  "targetId": "INSTANCE_ID",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/operations/OPERATION_ID",
  "targetProject": "PROJECT_ID"
}

REST v1beta4

Before using any of the request data, make the following replacements:

PROJECT_ID: the project ID
LOCATION_ID: the location ID
INSTANCE_ID: the desired instance ID
REGION: the desired region
DATABASE_VERSION: enum string of the database version. For example: MYSQL_8_0
PASSWORD: the password for the root user
MACHINE_TYPE: enum string of the machine (tier) type, as: db-custom-[CPUS]-[MEMORY_MBS]

HTTP method and URL:

POST https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/locations/LOCATION_ID/instances

Request JSON body:

{
  "name": "INSTANCE_ID",
  "region": "REGION",
  "databaseVersion": "DATABASE_VERSION",
  "rootPassword": "PASSWORD",
  "settings": {
    "tier": "MACHINE_TYPE",
    "backupConfiguration": {
      "enabled": true
    }
    "databaseFlags":
    [
      {
        "name": "cloudsql_iam_authentication",
        "value": "on"
      }
    ]
  }
}

To send your request, expand one of these options:

curl (Linux, macOS, or Cloud Shell)

Save the request body in a file named request.json, and execute the following command:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/locations/LOCATION_ID/instances"

PowerShell (Windows)

Save the request body in a file named request.json, and execute the following command:

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/locations/LOCATION_ID/instances" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID",
  "status": "PENDING",
  "user": "[email protected]",
  "insertTime": "2020-01-01T19:13:21.834Z",
  "operationType": "CREATE",
  "name": "OPERATION_ID",
  "targetId": "INSTANCE_ID",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/operations/OPERATION_ID",
  "targetProject": "PROJECT_ID"
}

What's next

Learn more about IAM database authentication.
Learn how to configure read replica logins for IAM database authentication.
Learn how to create users and service accounts that use Cloud SQL IAM database authentication.
Learn how to add an IAM policy binding to a user or service account.
Learn how to log in to a Cloud SQL database using IAM database authentication.
Learn how to manage users and service accounts for IAM database authentication.