Skip to content

Google Cloud SQL Auth Proxy Terraform Module#

This module provisions a managed instance group (MIG) of Compute Engine VMs running the Cloud SQL Auth Proxy. This provides a secure, reliable, and scalable way to connect to your Cloud SQL instances (MySQL, MSSQL) without needing to manage SSL certificates or expose your database to the public internet.

The proxy instances are configured with a dedicated service account and the necessary IAM roles to connect to Cloud SQL.

Compatibility#

This module is compatible with Terraform version ~> 1.0 and has been tested with the following provider versions:

  • Google Provider: >= 6.28.0, < 7.0.0
  • Google Beta Provider: >= 6.28.0, < 7.0.0

Features#

  • High Availability & Scalability: Deploys the proxy on a Managed Instance Group (MIG) for scalability and resilience.
  • Automated Setup: Configures the Cloud SQL Auth Proxy as a systemd service for automatic startup and restart.
  • Debugging Tools Included: The VM image comes pre-installed with both the mysql and mssql-tools command-line clients for easy troubleshooting.
  • Group-Based IAP Access: Supports assigning IAP access roles to a list of Google Groups for secure, centralized SSH access management.

Limitations#

  • IAP Access is Group-Based Only: The iap_user_list variable is designed to grant access to Google Groups. It does not support assigning roles to individual users or service accounts.

Example Usage#

module "sql_proxy" {
  source = "./modules/terraform-google-sql-proxy"

  project_id      = "acme-prod-shared-vpc"
  region          = "me-west1"
  name            = "sql-shared-proxy-prod"
  name_prefix     = "sql-shared-proxy-prod"
  subnet_link     = "/projects/acme-prod-shared-vpc/regions/me-west1/subnetworks/sql-proxy-shared-prod-me-west1"
  connection_name = "acme-prod-shared-vpc:me-west1:sql-shared-prod-me-west1"
  service_account = "prod-sql-proxy"

  # A list of Google Group emails to grant IAP access
  iap_user_list = ["gcp-admin-acme@example.com"]

  labels = {
    "owner"       = "company",
    "environment" = "prod"
  }
}

Connection Instructions#

  1. SSH into one of the proxy instances using IAP: 
    gcloud compute ssh --zone [zone] [instance-id] --tunnel-through-iap --project [project-id]
  2. Switch to the root user: 
    sudo su
  3. Connect to your database using the appropriate client. The proxy listens on 0.0.0.0:3306.
    • For MySQL: 
      mysql -u [DB_USER] --host 127.0.0.1 --password
    • For MSSQL: 
      sqlcmd -S 127.0.0.1,3306 -U [DB_USER] -P [DB_PASSWORD]

Software#

This module requires the following software dependencies:

Service Account#

The service account used to run this module must have the following IAM roles:

  • roles/compute.admin - To create and manage Compute Engine instances and MIGs
  • roles/iam.serviceAccountAdmin - To create and manage service accounts
  • roles/iam.serviceAccountUser - To use service accounts
  • roles/cloudsql.client - To connect to Cloud SQL instances via the proxy
  • roles/iap.admin - To configure Identity-Aware Proxy access

APIs#

The following GCP APIs must be enabled in the target project:

  • Compute Engine API (compute.googleapis.com)
  • Cloud SQL Admin API (sqladmin.googleapis.com)
  • Identity and Access Management (IAM) API (iam.googleapis.com)
  • Cloud Identity-Aware Proxy API (iap.googleapis.com)
  • Cloud Resource Manager API (cloudresourcemanager.googleapis.com)

License#

This module is covered by a commercial license. Please see LICENSE for details.

Support#

This module is developed and maintained by MyOps Limited. For any support inquiries, please contact us at info@myops.co.il.

Requirements#

Name Version
terraform ~> 1
google >= 6.28.0, < 7.0.0
google-beta >= 6.28.0, < 7.0.0

Providers#

No providers.

Modules#

Name Source Version
instance_template terraform-google-modules/vm/google//modules/instance_template ~> 13.0.0
mig terraform-google-modules/vm/google//modules/mig ~> 13.0.0
project_iam terraform-google-modules/iam/google//modules/projects_iam ~> 8.0.0
service-account git::https://github.com/GoogleCloudPlatform/cloud-foundation-fabric.git//modules/iam-service-account v38.1.0

Resources#

No resources.

Inputs#

Name Description Type Default Required
connection_name Please provide connection string to inject into the instance in format myproject:myregion:myinstance string n/a yes
iap_user_list List of users that will have access via IAP list(string) n/a yes
labels Labels, provided as a map map(string) {} no
machine_type Machine type to use for the proxy string "e2-standard-2" no
name Please provide instance name string "sql-proxy" no
name_prefix Please provide instance prefix string n/a yes
project_id Please provide instance project string n/a yes
proxy_version Please provide Cloud SQL Proxy version. https://github.com/GoogleCloudPlatform/cloud-sql-proxy/releases string "v2.18.2" no
region Please provide instance region string n/a yes
service_account Service account to create to attach to the instance. See https://www.terraform.io/docs/providers/google/r/compute_instance_template.html#service_account. string n/a yes
subnet_link Subnet link string n/a yes
tags Tags, provided as a map list(string) [] no
target_size n/a number 1 no

Outputs#

Name Description
instances n/a