I have a few small Google App Engine apps that are accessing the same Cloud SQL Instance (to save resources) and I wan't to restrict the access of these individual databases per app; eg.
1. CoolApp5 ---> global_db_instance -> coolapp5_db
2. EatFood ----> global_db_instance -> eatfood_db
3. WebsiteCo --> global_db_instance -> websiteco_db
Configuring Google Could SQL Instance Access
The current system seems to allow for apps to have access to the global instance databases but creates a security vulnerability. If a intruder get's access to the database true a single app (coolapp5/eatfood or websiteco) he will have access to the all the databases.
Eg. Wordpress sites for CoolApp5
<?php // wp-config.php
define('DB_HOST', ':/cloudsql/global_db_instance:db'); //
define('DB_USER', 'root');
define('DB_PASSWORD', '');
define('DB_NAME', 'coolapp5_db');
?>
As you can see, the app coolapp5 has access to coolapp5_db and could gain access other database (eatfood_db, websiteco_db) as the app has root access.
Google seems to allow this through an external IP address
An obvious solution might be to have many individual instance for each app, but this is inefficient for small apps as a Cloud SQL database can run multiple websites at once.
Is there any other solution or is my strategy simply will not work for Google Cloud SQL ?
