This page discusses the two levels of access control for Cloud SQL instances. You must configure both levels of access control before you can manage your instance.

Levels of access control

Configuring access control involves controlling who or what can access the instance. Access control occurs on two levels:

Instance-level access

Instance-level access authorizes access to your Cloud SQL instance from an application or client (running on an App Engine standard environment or externally) or from another Google Cloud service, such as Compute Engine.

Database access

Database access uses MySQL's access control system to allow MySQL users to have access to the data in your instance.

Instance-level access

Configuring instance-level access depends on the connection source:

Connection source	Configuration method	More information
Compute Engine	Cloud SQL Auth Proxy Authorize static IP address	Connecting from Compute Engine
App Engine standard environment	Same project: preconfigured Between projects: configure IAM	Connecting from App Engine standard environment
App Engine flexible environment	Same project: preconfigured Between projects: configure IAM	Connecting from App Engine flexible environment
External applications	Cloud SQL Auth Proxy Authorize client IP address	Connecting overview
Cloud Run	A Cloud SQL instance set up with a public IP. Between projects: also configure IAM	Connecting Using Cloud Run
Google Kubernetes Engine	Private IP If Public IP, Cloud SQL Auth Proxy is required	Connecting Using Google Kubernetes Engine

Database access

After a user or application connects to a database instance, the user or application must log in with a user or service account. As part of creating a Cloud SQL instance, you set up the default user (root) account. You can also create more users to give you finer-grained control over access to your instance.

For more information, see MySQL users and Configuring the default user account.

What's next

• Learn more about how Cloud SQL works with MySQL users.
• Learn more about the MySQL Access Privilege System.
• Learn more about your options for connecting from an external application.
• Learn about controlling who can manage your Google Cloud Platform project.