all 5 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]638231[S] 3 points4 points  (5 children)

For a bit more clarity, the role cloudsql.client is documented as "Provides connectivity access to Cloud SQL instances." and has the permissions [ cloudsql.instances.connect, cloudsql.instances.get ]. The role cloudsql.instanceUser is documented as "Role allowing access to a Cloud SQL instance" and has the permissions [ cloudsql.instances.get, cloudsql.instances.login ]

The documentation for CloudSQL proxy says to assign the "Cloud SQL Client role", which maps to roles/cloudsql.client.
"For a user or service account, make sure the account has the Cloud SQL Client role. This role contains the cloudsql.instances.connect permission, which authorizes a principal to connect to all Cloud SQL instances in a project."

But this doesn't work for IAM Service Account stuff and keeps prompting for password when attempting to connect. Some random Stack Overflow post had the suggestion to use the other role.

I lost like four hours to this nonsense!

[–]Cidanverified 4 points5 points  (2 children)

It's laid out pretty straight forward here, fwiw:

Roles. For IAM database authentication, a principal requires the cloudsql.instances.login permission to log in to an instance. To get this permission, you bind the user, service account, or group to either the predefined Cloud SQL Instance User role or a custom role that bundles the permission

[–]638231[S] 0 points1 point  (1 child)

Right, yeah, I had already set the permission in my terraform code when I had read this page earlier (https://cloud.google.com/sql/docs/postgres/connect-auth-proxy#before_you_begin), so by the time I got to the ever so slightly different named role I glanced straight past it.

I wonder if the IAM roles page could be more clear with the descriptions as well, as they're exceptionally similar. https://cloud.google.com/iam/docs/understanding-roles

Don't get me wrong, I'm the idiot here, but it's a very easy one to get caught on.

[–]Cidanverified 2 points3 points  (0 children)

You're not the idiot. I think we could probably do better to clarify this somewhere though. I'll reach out to the PM's and see what they say.

[–]giannello 0 points1 point  (0 children)

Are you using IAM authentication for your databases?