To access Google Cloud SQL resources, grant the following IAM role to the Google Cloud service account:
-
Role:
-
PostgreSQL: roles/cloudsql.viewer
-
AlloyDB: roles/alloydb.viewer
-
-
Google Cloud IAM Role
-
Postgres: Cloud SQL Viewer (Provides read-only access to Cloud SQL resources).
-
AlloyDB: Cloud AlloyDB Viewer (Provides read-only access to all AlloyDB resources).
-
You can create a custom IAM role instead of using the predefined Cloud SQL Viewer role. The following permissions are required to perform these operations successfully.
Permissions for PostgreSQL
Cloud SQL Permissions
| Permission | Description |
|---|---|
| cloudsql.instances.get | View Cloud SQL instance details. |
| cloudsql.instances.list | List Cloud SQL instances. |
Resource Manager Permissions
| Permission | Description |
|---|---|
| resourcemanager.projects.get | View Google Cloud project information. |
Permissions for AlloyDB
AlloyDB Permissions
| Permission | Description |
|---|---|
| alloydb.clusters.list | Lists AlloyDB clusters. |
| alloydb.instances.list | Lists AlloyDB instances. |
Resource Manager Permissions
| Permission | Description |
|---|---|
| resourcemanager.projects.get | View Google Cloud project information. |