> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/resource-integrations/postgresql-new/installing-a-cloudsql-database.md).

# Installing a Cloud SQL database

{% hint style="info" %}
Google Cloud SQL is a **preview** integration.
{% endhint %}

Follow this guide to install P0 on a Google Cloud SQL for PostgreSQL instance. P0 grants just-in-time, time-limited access to the instance using GCP IAM database authentication, reached through a P0-managed Cloud Run connector that runs inside your VPC.

{% hint style="warning" %}
Cloud SQL for MySQL is not yet supported. This integration manages PostgreSQL instances only.
{% endhint %}

## How it works

P0 reaches your Cloud SQL instances through a **connector**: a Cloud Run service that P0 deploys into your project with direct access to the VPC your instances run on. The connector provisions database users and enforces access on P0's behalf.

When a user requests access to a Cloud SQL instance:

1. P0 provisions a dedicated IAM database user for that identity on the instance. P0 creates the user once, and it persists across requests.
2. After approval, P0 delegates the `roles/cloudsql.instanceUser` role to the requestor for the approved duration.
3. The requestor connects to the instance as their IAM database user using GCP IAM database authentication.
4. When the access duration expires or an approver revokes access, P0 removes the delegated role. The IAM database user remains in place for future requests.

## Prerequisites

Before you begin, ensure you have:

* A P0 [Google Cloud integration](/integrations/resource-integrations/google-cloud.md) with **IAM management** installed on the project.
* A VPC and subnetwork that your Cloud SQL instances run on.
* Admin access to the Cloud SQL instance.
* IAM database authentication enabled on the instance. Set the `cloudsql.iam_authentication` database flag to `on`.
* Permissions to deploy a Cloud Run service, create IAM bindings, and reserve a Private Service Access range in the project.
* These Google Cloud APIs enabled on the project: `compute`, `iam`, `run`, `servicenetworking`, and `sqladmin`.

{% hint style="info" %}
Private-IP Cloud SQL instances require a Private Service Access connection that peers a reserved internal IP range to `servicenetworking.googleapis.com` on the VPC. Establish this connection before you create the instance.
{% endhint %}

## Install the GCP CloudSQL connector

Install the connector on the VPC that hosts your Cloud SQL instances. This step deploys the Cloud Run connector and grants it the roles it needs to manage database users.

### Via the P0 app

1. Navigate to **Integrations** on [p0.app](https://p0.app) and select the **GCP CloudSQL** integration.
2. Select the **IAM management** component.
3. Select the **GCP project ID** that hosts the VPC.
4. Enter the **Subnetwork** name that the connector should have direct VPC access to.
5. Click **Next**. P0 generates the connector's Cloud Run service name and service account, along with the Terraform to deploy them.
6. Apply the generated Terraform. It deploys the connector, grants the connector's service account the `roles/cloudsql.admin` and `roles/cloudsql.instanceUser` roles, and grants P0's service account the `roles/run.invoker` role on the connector.
7. Click **Next**. P0 verifies that the connector is reachable, then completes the install.

### Via the P0 Terraform provider

1. Ensure you have configured the [P0 Terraform provider](https://registry.terraform.io/providers/p0-security/p0/latest/docs) with the root [`p0_gcp`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/gcp) integration and [`p0_gcp_iam_write`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/gcp_iam_write) installed on the project.
2. Use the [`p0_gcp_cloudsql_staged`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/gcp_cloudsql_staged) resource to stage the install. Staging generates the connector identifiers you need to deploy the connector.

```terraform
resource "p0_gcp_cloudsql_staged" "example" {
  id         = google_compute_network.example.name
  project_id = local.project
  subnetwork = google_compute_subnetwork.example.name
  depends_on = [p0_gcp_iam_write.example]
}
```

3. Deploy the connector with the [`p0-security/p0-connector/google`](https://registry.terraform.io/modules/p0-security/p0-connector/google/latest) module, then grant the connector's service account the required Cloud SQL roles.

```terraform
module "gcp_cloudsql_vpc" {
  source  = "p0-security/p0-connector/google"
  version = "0.0.3"

  project_id                     = local.project
  service                        = "cloudsql"
  connector_name                 = p0_gcp_cloudsql_staged.example.connector_service_name
  connector_service_account_name = split("@", p0_gcp_cloudsql_staged.example.connector_service_account)[0]
  region                         = p0_gcp_cloudsql_staged.example.region
  vpc_network                    = google_compute_network.example.name
  vpc_subnetwork                 = google_compute_subnetwork.example.name
  invoker_service_account_email  = p0_gcp.example.service_account_email
}

resource "google_project_iam_member" "connector_cloudsql_admin" {
  project = local.project
  role    = "roles/cloudsql.admin"
  member  = "serviceAccount:${p0_gcp_cloudsql_staged.example.connector_service_account}"
}

resource "google_project_iam_member" "connector_instance_user" {
  project = local.project
  role    = "roles/cloudsql.instanceUser"
  member  = "serviceAccount:${p0_gcp_cloudsql_staged.example.connector_service_account}"
}
```

4. Register the connector's service account as an IAM database user on the instance.

```terraform
resource "google_sql_user" "connector" {
  name     = trimsuffix(p0_gcp_cloudsql_staged.example.connector_service_account, ".gserviceaccount.com")
  instance = google_sql_database_instance.example.name
  project  = local.project
  type     = "CLOUD_IAM_SERVICE_ACCOUNT"
}
```

5. Use the [`p0_gcp_cloudsql`](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/gcp_cloudsql) resource to complete the install. Creating it verifies that the connector is reachable.

```terraform
resource "p0_gcp_cloudsql" "example" {
  id         = p0_gcp_cloudsql_staged.example.id
  project_id = p0_gcp_cloudsql_staged.example.project_id
  subnetwork = p0_gcp_cloudsql_staged.example.subnetwork
  depends_on = [
    module.gcp_cloudsql_vpc,
    google_project_iam_member.connector_cloudsql_admin,
    google_project_iam_member.connector_instance_user,
    google_sql_user.connector,
  ]
}
```

6. Run `terraform init` and `terraform apply`.

{% hint style="info" %}
For a complete, runnable example that also enables the required APIs and provisions the VPC, subnetwork, Private Service Access range, and a sample instance, see the [`p0_gcp_cloudsql` provider documentation](https://registry.terraform.io/providers/p0-security/p0/latest/docs/resources/gcp_cloudsql).
{% endhint %}

## Requesting access

Users request access to a Cloud SQL instance through the P0 app or a P0 notifier such as Slack. Select the **GCP CloudSQL** resource, choose the VPC and instance, and submit the request. After an approver grants the request, P0 provisions the requestor's IAM database user and delegates the `roles/cloudsql.instanceUser` role for the approved duration.

The requestor then connects to the instance as their IAM database user using [GCP IAM database authentication](https://docs.cloud.google.com/sql/docs/postgres/iam-logins).

{% hint style="info" %}
The P0 CLI does not yet provide a Cloud SQL connection command. Request Cloud SQL access from the P0 app or a notifier.
{% endhint %}

## Troubleshooting

**P0 reports that it could not reach the connector during install.** The connector's Cloud Run service can be briefly unreachable right after deployment. Wait a moment and click **Next** again to retry verification. If the error persists, confirm that:

* The connector's Cloud Run service is deployed and running.
* P0's service account holds the `roles/run.invoker` role on the connector service.
* Cloud Run has direct VPC access to the configured subnetwork.