Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://cloud.google.com/sql/docs/postgres/iam-logins below:

Log in using IAM database authentication | Cloud SQL for PostgreSQL

Stay organized with collections Save and categorize content based on your preferences.

This page describes how users and service accounts can log in to Cloud SQL databases using Cloud SQL IAM database authentication. For more information, see IAM authentication.

• Configure the instance to use IAM database authentication. For more information, see Configure new instances for IAM database authentication.
• Add an IAM user, service account, or group to the database. For more information, see Add an IAM user or service account to the database and Add a group to the database.
• Add the roles/cloudsql.instanceUser IAM role to your IAM user, service account, or group. It's a predefined role that contains the necessary Cloud SQL IAM cloudsql.instances.login permission. You need this permission to login to a database instance with IAM database authentication. For more information, see Roles and permissions.

• When an IAM user is added to a database, the new database user has no privileges to any database by default. You need to use the GRANT command to give the IAM database user any required permissions. For more information, see Grant database privileges to the IAM User and Grant database privileges to a group.

• If you're using IAM group authentication, then the IAM user or service account must be a member of a group that has been granted an IAM role or permissions to log in to the Cloud SQL instance. Cloud SQL creates an account after the user or service account logs in to the instance for the first time.

You can configure a Cloud SQL connector to automatically handle authentication to the Cloud SQL instance on behalf of a user or an application. Connectors include the Cloud SQL Auth Proxy, the Go connector, the Java connector, and the Python connector, all of which support automatic IAM database authentication. When using a Cloud SQL connector with automatic IAM database authentication, the IAM account that you use to start the connector must be the same account that authenticates to the database.

Note: You must allow outgoing (or egress) TCP connections to ports 443 and 3307.

• Cloud SQL Connectors call APIs through the sqladmin.googleapis.com domain name. This domain name doesn't have a fixed IP address. Therefore, you must allow all egress TCP connections on port 443. (Port 443 is the standard HTTPS port. Whenever you go to a website or make an API request, the secure connection goes through port 443 of the IP address to which the website or endpoint resolves.)
• While Cloud SQL Connectors can listen on any port, they create outgoing (or egress) connections to your Cloud SQL instance only on port 3307. If your client machine has an outbound firewall policy, then make sure it allows outgoing connections to port 3307 on your Cloud SQL instance's IP address. For more information, see Options for authenticating Cloud SQL Connectors.

To log in using automatic IAM database authentication:

1. Authenticate to Google Cloud.

   User

   Authenticate to Google Cloud using Application Default Credentials (ADC).

   Use the gcloud auth application-default login command. For more information, see Set up Application Default Credentials.

   Service account

   To authenticate to Google Cloud using ADC with a service account, you can use service account impersonation or use a service account key. To use service account impersonation, replace SERVICE_ACCOUNT_EMAIL_ADDRESS, and run the following command:

   gcloud auth application-default login --impersonate-service-account SERVICE_ACCOUNT_EMAIL_ADDRESS

   For more information, see Set up Application Default Credentials.

2. Start the Cloud SQL Auth Proxy with the --auto-iam-authn flag.

   Replace the following:

   • INSTANCE_CONNECTION_NAME: The connection string to identify a Cloud SQL instance. If you use a port other than the default PostgreSQL port, then specify the port number. For more information on how to find and construct this string, see Options for authenticating the Cloud SQL Auth Proxy.

   ./cloud-sql-proxy --auto-iam-authn INSTANCE_CONNECTION_NAME

   For more information on how to start the proxy, see Start the Cloud SQL Auth Proxy.

   Warning: If you run the Cloud SQL Auth Proxy as a service, keep in mind that it requests the access tokens on behalf of your applications. For this reason, ensure that only trusted users are able to access the address and port or the Unix socket that the Cloud SQL Auth Proxy is listening on.

3. When you are ready to connect to the instance by using the Cloud SQL Auth Proxy, log in with the psql client.

   Replace the following:

   • HOSTNAME: IP address used by the Cloud SQL Auth Proxy. By default, the Cloud SQL Auth Proxy uses the localhost address of 127.0.0.1, but you can assign a different IP address when you start the Cloud SQL Auth Proxy.
   • USERNAME: For an IAM, the username is the full email address of the user. For a service account, this is the service account's email without the .gserviceaccount.com domain suffix.
   • PORT_NUMBER: Optional. If you specified a different port in the instance connection string, then specify that port number.
   • DATABASE_NAME: The name of the database to connect to.

   Run the following command:

   psql -h HOSTNAME \
    -U USERNAME \
    --port PORT_NUMBER \
    --dbname=DATABASE_NAME
    

   For more information on how to connect to the Cloud SQL Auth Proxy, see Connect with the psql client.

A user or an application can authenticate to the database using IAM by manually requesting an access token from Google Cloud and presenting it to the database. Using the gcloud CLI, you can explicitly request an OAuth 2.0 token with the Cloud SQL Admin API scope that is used to log in to the database. When you log in as a database user with manual IAM database authentication, you use your email address as the username and the access token as the password. You can use this method with either a direct connection to the database or with a Cloud SQL connector.

In this procedure, you authenticate to Google Cloud, request an access token, and then connect to the database by passing in the token as the password for the IAM database user. Use these steps to connect without the Cloud SQL Auth Proxy.

For these steps, you must:

To log in using manual IAM database authentication:

1. Authenticate to Google Cloud.

   User

   Authenticate to IAM using gcloud auth login. For more information, see Authorize with a user account.

   Service account

   Authenticate to IAM using gcloud auth activate-service-account. For more information, see Authorize with a service account.

2. Request the access token, and log in with a client.

   Warning: You can use your OAuth 2.0 token to make authenticated requests on your behalf. Make sure to keep it secure, and be careful where you store it.

   Replace the following:

   • HOSTNAME: The IP address of the instance, either the public IP address or private IP address.
   • USERNAME: For an IAM, the username is the full email address of the user. For a service account, this is the service account's email without the .gserviceaccount.com domain suffix.
   • DATABASE_NAME: The name of the database to connect to.

    PGPASSWORD=`gcloud sql generate-login-token` \
    psql "sslmode=require \
    hostaddr=HOSTNAME \
    user=USERNAME \
    dbname=DATABASE_NAME" \
    --no-password
    

   If ssl_mode on your Cloud SQL instance is configured to TRUSTED_CLIENT_CERTIFICATE_REQUIRED, then we recommend that you log in with automatic IAM database authentication to enforce client identity validation.

   Note: The OAuth 2.0 token can't be entered or pasted directly into a password field, because that token is longer than the field's maximum size. Use an environment variable to pass the authentication token to the command. The provided command is for Unix/Linux environments. If you use Microsoft Windows, substitute Windows environment variable settings.

• Learn more about IAM database authentication.
• Learn how to enable and view login information in audit logs.
• Learn how to create users and service accounts that use Cloud SQL IAM database authentication.
• Learn how to manage users and service accounts for IAM database authentication.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2025-08-14 UTC.

[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-14 UTC."],[],[]]

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4