Im trying to get my compute engine instance to communicate with Cloud SQL using the Proxy. I keep getting this error when I try to start the proxy:
the default Compute Engine service account is not configured with sufficient permissions to access the Cloud SQL API from this VM. Please create a new VM with Cloud SQL access (scope) enabled under "Identity and API access". Alternatively, create a new "service account key" and specify it using the -credentials_file parameter
When I describe my instance using gcloud compute instances describe the service account and scopes are:
serviceAccounts:
- email: [email protected]
scopes:
- https://www.googleapis.com/auth/devstorage.full_control
- https://www.googleapis.com/auth/logging.write
- https://www.googleapis.com/auth/monitoring.write
- https://www.googleapis.com/auth/sqlservice
- https://www.googleapis.com/auth/sqlservice.admin
I can get this working if I create a new instance with full scope permissions:
serviceAccounts:
- email: [email protected]
scopes:
- https://www.googleapis.com/auth/cloud-platform
But this seems less secure than just specifying the scopes I need.
