GCP Cloud SQL required proxy permissions

Question

What are the actual set of permissions required for a service account used to authenticate the Cloud SQL proxy? The documentation says that the proxy needs the Project Editor role, but I find it hard to believe that a simple proxy could require such a broad permission scope.

Also, does a dedicated service account need to be created or can the Compute Engine default service account just be used to provide this authentication?

As you said the documentation says that you need project editor permission for authorizing SQL proxy. Regarding service account in GCE, the default service account of GCE has scopes only to read from google cloud storage and write logs to stack driver. — Lakshman Diwaakar

ajsmith007 ajsmith007 · Accepted Answer · 2017-07-26T19:40:46

According to the docs CloudSQL Client role should have enough permissions. https://cloud.google.com/sql/docs/mysql/connect-admin-proxy#service-account

GCP Cloud SQL required proxy permissions

1 Answers