The Cloud SQL Connectors are libraries that provide encryption and Identity and Access Management (IAM)-based authorization when connecting to a Cloud SQL instance. They can't provide a network path to a Cloud SQL instance if one is not already present.
Other ways to connect to a Cloud SQL instance include using a database client or the Cloud SQL Auth Proxy. See the About connection options page for more information about connecting to a Cloud SQL instance.
This page discusses the following Cloud SQL Connectors:
- The Cloud SQL Java Connector
- The Cloud SQL Python Connector (Open in Colab)
- The Cloud SQL Go Connector
- The Cloud SQL Node.js Connector
Benefits
Using a Cloud SQL connector provides the following benefits:
- IAM authorization: Uses IAM permissions to control who or what can connect to your Cloud SQL instances.
- Convenience: Removes the requirement to manage SSL certificates, configure firewall rules, or enable authorized networks.
Before you begin
- Enable the Cloud SQL Admin API.
- Create a Cloud SQL instance, including configuring the default user.
For more information about creating instances, see Create instances.
For more information about configuring the default user, see Set the password for the default user account.
- Configure the roles and permissions required to connect to a Cloud SQL instance.
Setup
Java
The Cloud SQL Java Connector is a library that provides IAM-based authorization and encryption when connecting to a Cloud SQL instance. It can not provide a network path to a Cloud SQL instance if one is not already present.
Install
For instructions on building and using the drivers for JDBC and R2DBC with the Cloud SQL Java Connector, see the following links:
For examples of this library being used in the context of an application, check out these sample applications.
Authenticate
This library uses Application Default Credentials to authenticate the connection to the Cloud SQL server.
To activate credentials locally, use the following gcloud command:
gcloud auth application-default login
Connect with Intellij
In order to connect IntelliJ to your Cloud SQL instance, you will need to add the library as a jar with dependencies in the Additional Files section on the driver settings page. For example, prebuilt fat jars can be found on the Cloud SQL Java Connector Releases page for this purpose.
Python
The Cloud SQL Python Connector is a library that can be used alongside a database driver to allow users with sufficient permissions to connect to a Cloud SQL database without having to manually allowlist IPs or manage SSL certificates.
For interactive examples of using the Cloud SQL Python Connector, open the Cloud SQL Python Connector notebook.
The driver that MySQL supports is pymysql.
Install
To install the latest release of the Cloud SQL Python Connector, use the pip install
command and specify the pymysql
driver for your database:
pip install "cloud-sql-python-connector[pymysql]"
Authenticate
This library uses Application Default Credentials to authenticate the connection to the Cloud SQL server.
To activate credentials locally, use the following gcloud command:
gcloud auth application-default login
Go
The Cloud SQL Go connector is a Cloud SQL connector designed for use with the Go language. For improved security, this connector uses robust, manually authenticated TLS 1.3 encryption between the client connector and the server-side proxy, independent of the database protocol.
Install
You can install this repo with go get
:
go get cloud.google.com/go/cloudsqlconn
Node.js
The Node.js Connector is a library designed for use with the Node.js runtime that allows you to connect securely to your Cloud SQL instance.
Install
You can install the library with npm install
:
npm install @google-cloud/cloud-sql-connector
Use
Java
To see this snippet in the context of a web application, view the README on GitHub.
Python
See How to use this Connector for detailed instructions on using the library. View example connection test code on GitHub.
Go
See Usage for detailed instructions on using the library. View example connection test code on GitHub.
Node.js
For detailed instructions on using the library, see Usage.
Enforce
By using connector enforcement, you can enforce using only the Cloud SQL Auth Proxy or Cloud SQL Language Connectors to connect to Cloud SQL instances. With connector enforcement, Cloud SQL rejects direct connections to the database.
If you're using a Private Service Connect-enabled instance, then there's a limitation. If the instance has connector enforcement enabled, then you can't create read replicas for the instance. Similarly, if the instance has read replicas, then you can't enable connector enforcement for the instance.
gcloud
To enforce using only the Cloud SQL Auth Proxy or Cloud SQL Language Connectors to connect to an instance, use the gcloud sql instances patch
command:
gcloud sql instances patch INSTANCE_NAME \ --connector-enforcement=REQUIRED
Replace INSTANCE_NAME
with the name of your Cloud SQL instance.
REST
Before using any of the request data, make the following replacements:
- PROJECT_ID: the ID or project number of the Google Cloud project that contains the instance
- INSTANCE_NAME: the name of your Cloud SQL instance
HTTP method and URL:
PATCH https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_NAME
Request JSON body:
{ "kind": "sql#instance", "name": INSTANCE_NAME, "project": PROJECT_ID, "settings": { "connectorEnforcement": "REQUIRED", "kind": "sql#settings" } }
To send your request, expand one of these options:
You should receive a JSON response similar to the following:
{ "kind": "sql#operation", "targetLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_NAME", "status": "PENDING", "user": "[email protected]", "insertTime": "2020-01-16T02:32:12.281Z", "operationType": "UPDATE", "name": "OPERATION_ID", "targetId": "INSTANCE_NAME", "selfLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/operations/OPERATION_ID", "targetProject": "PROJECT_ID" }
Troubleshoot
Driver versions
Make sure you are using the latest version of the Cloud SQL Connectors and your database driver to avoid incompatibilities. Some older versions of drivers are not supported.
Connection paths
The Cloud SQL Connectors provide authorization for connections, but they don't provide new paths to connectivity. For example, in order to connect to a Cloud SQL instance using a Private IP address, your application must already have VPC access.
Debug connection issues
For additional help with connection issues, see the Troubleshoot and Debug connection issues pages.
What's next
- See the Cloud SQL Java Connector home page on GitHub.
- See the Cloud SQL Python Connector home page on GitHub.
- Learn more about the Cloud SQL Auth Proxy.
- Learn more about IAM.
- Learn about options for support.