Installing a Cloud SQL database

Install P0 on a Google Cloud SQL for PostgreSQL instance to grant just-in-time database access through a Cloud Run connector and GCP IAM database authentication.

Google Cloud SQL is a preview integration.

Follow this guide to install P0 on a Google Cloud SQL for PostgreSQL instance. P0 grants just-in-time, time-limited access to the instance using GCP IAM database authentication, reached through a P0-managed Cloud Run connector that runs inside your VPC.

Cloud SQL for MySQL is not yet supported. This integration manages PostgreSQL instances only.

How it works

P0 reaches your Cloud SQL instances through a connector: a Cloud Run service that P0 deploys into your project with direct access to the VPC your instances run on. The connector provisions database users and enforces access on P0's behalf.

When a user requests access to a Cloud SQL instance:

1. P0 provisions a dedicated IAM database user for that identity on the instance. P0 creates the user once, and it persists across requests.

2. After approval, P0 delegates the roles/cloudsql.instanceUser role to the requestor for the approved duration.

3. The requestor connects to the instance as their IAM database user using GCP IAM database authentication.

4. When the access duration expires or an approver revokes access, P0 removes the delegated role. The IAM database user remains in place for future requests.

Prerequisites

Before you begin, ensure you have:

• A P0 Google Cloud integration with IAM management installed on the project.

• A VPC and subnetwork that your Cloud SQL instances run on.

• Admin access to the Cloud SQL instance.

• IAM database authentication enabled on the instance. Set the cloudsql.iam_authentication database flag to on.

• Permissions to deploy a Cloud Run service, create IAM bindings, and reserve a Private Service Access range in the project.

• These Google Cloud APIs enabled on the project: compute, iam, run, servicenetworking, and sqladmin.

Private-IP Cloud SQL instances require a Private Service Access connection that peers a reserved internal IP range to servicenetworking.googleapis.com on the VPC. Establish this connection before you create the instance.

Install the GCP CloudSQL connector

Install the connector on the VPC that hosts your Cloud SQL instances. This step deploys the Cloud Run connector and grants it the roles it needs to manage database users.

Via the P0 app

1. Navigate to Integrations on p0.app and select the GCP CloudSQL integration.

2. Select the IAM management component.

3. Select the GCP project ID that hosts the VPC.

4. Enter the Subnetwork name that the connector should have direct VPC access to.

5. Click Next. P0 generates the connector's Cloud Run service name and service account, along with the Terraform to deploy them.

6. Apply the generated Terraform. It deploys the connector, grants the connector's service account the roles/cloudsql.admin and roles/cloudsql.instanceUser roles, and grants P0's service account the roles/run.invoker role on the connector.

7. Click Next. P0 verifies that the connector is reachable, then completes the install.

Via the P0 Terraform provider

1. Ensure you have configured the P0 Terraform provider with the root p0_gcp integration and p0_gcp_iam_write installed on the project.

2. Use the p0_gcp_cloudsql_staged resource to stage the install. Staging generates the connector identifiers you need to deploy the connector.

resource "p0_gcp_cloudsql_staged" "example" {
  id         = google_compute_network.example.name
  project_id = local.project
  subnetwork = google_compute_subnetwork.example.name
  depends_on = [p0_gcp_iam_write.example]
}

1. Deploy the connector with the p0-security/p0-connector/google module, then grant the connector's service account the required Cloud SQL roles.

module "gcp_cloudsql_vpc" {
  source  = "p0-security/p0-connector/google"
  version = "0.0.3"

  project_id                     = local.project
  service                        = "cloudsql"
  connector_name                 = p0_gcp_cloudsql_staged.example.connector_service_name
  connector_service_account_name = split("@", p0_gcp_cloudsql_staged.example.connector_service_account)[0]
  region                         = p0_gcp_cloudsql_staged.example.region
  vpc_network                    = google_compute_network.example.name
  vpc_subnetwork                 = google_compute_subnetwork.example.name
  invoker_service_account_email  = p0_gcp.example.service_account_email
}

resource "google_project_iam_member" "connector_cloudsql_admin" {
  project = local.project
  role    = "roles/cloudsql.admin"
  member  = "serviceAccount:${p0_gcp_cloudsql_staged.example.connector_service_account}"
}

resource "google_project_iam_member" "connector_instance_user" {
  project = local.project
  role    = "roles/cloudsql.instanceUser"
  member  = "serviceAccount:${p0_gcp_cloudsql_staged.example.connector_service_account}"
}

1. Register the connector's service account as an IAM database user on the instance.

resource "google_sql_user" "connector" {
  name     = trimsuffix(p0_gcp_cloudsql_staged.example.connector_service_account, ".gserviceaccount.com")
  instance = google_sql_database_instance.example.name
  project  = local.project
  type     = "CLOUD_IAM_SERVICE_ACCOUNT"
}

1. Use the p0_gcp_cloudsql resource to complete the install. Creating it verifies that the connector is reachable.

resource "p0_gcp_cloudsql" "example" {
  id         = p0_gcp_cloudsql_staged.example.id
  project_id = p0_gcp_cloudsql_staged.example.project_id
  subnetwork = p0_gcp_cloudsql_staged.example.subnetwork
  depends_on = [
    module.gcp_cloudsql_vpc,
    google_project_iam_member.connector_cloudsql_admin,
    google_project_iam_member.connector_instance_user,
    google_sql_user.connector,
  ]
}

1. Run terraform init and terraform apply.

For a complete, runnable example that also enables the required APIs and provisions the VPC, subnetwork, Private Service Access range, and a sample instance, see the p0_gcp_cloudsql provider documentation.

Requesting access

Users request access to a Cloud SQL instance through the P0 app or a P0 notifier such as Slack. Select the GCP CloudSQL resource, choose the VPC and instance, and submit the request. After an approver grants the request, P0 provisions the requestor's IAM database user and delegates the roles/cloudsql.instanceUser role for the approved duration.

The requestor then connects to the instance as their IAM database user using GCP IAM database authentication.

The P0 CLI does not yet provide a Cloud SQL connection command. Request Cloud SQL access from the P0 app or a notifier.

Troubleshooting

P0 reports that it could not reach the connector during install. The connector's Cloud Run service can be briefly unreachable right after deployment. Wait a moment and click Next again to retry verification. If the error persists, confirm that:

• The connector's Cloud Run service is deployed and running.

• P0's service account holds the roles/run.invoker role on the connector service.

• Cloud Run has direct VPC access to the configured subnetwork.