Encrypting network traffic

It is a best practice to encrypt network traffic between the Looker application and your database. Consider one of the options that are described on theEnabling secure database access documentation page.

Connect using Application Default Credentials (ADC)

ForLooker (Google Cloud core) instances,Application Default Credentials (ADC) is supported as a method of authentication for Google Cloud SQL for MySQL.

When you set up ADC for Google Cloud SQL for MySQL, you must do the following procedures:

• Add the impersonated service account to your Cloud SQL database
• Set up service account impersonation on your Cloud SQL database
• Run additional configuration commands for Cloud SQL for MySQL

See theLooker (Google Cloud core) documentation for the full procedure.

Users and security

To perform actions on your database, Looker needs to have a user account on your database.

Note: Skip this procedure if you are on a Looker (Google Cloud core) instance and you want to use Application Default Credentials to authenticate into your database. You will instead use an existing Identity and Access Management (IAM) principal account. See theConnecting Looker (Google Cloud core) to your database documentation page for the procedure.

To configure a database user for Looker to use, perform the following steps on your database:

1. Create a database user.

   CREATEUSERUSERNAME;SETPASSWORDFORUSERNAME=PASSWORD('PASSWORD');

2. GrantSELECT privileges to the database user on the database that you want Looker to query. Replacedatabase_name with the name of your database.

   GRANTSELECTONDATABASE_NAME.*TOUSERNAME;

Once you create the database user, you can enter the database user account credentials in theUsername andPassword fields of the Looker UI when youcreate the Looker connection to your database.

Creating the Looker connection to your database

To create the connection from Looker to your database, follow these steps:

1. In theAdmin section of Looker, selectConnections, and then clickAdd Connection.
2. From theDialect drop-down menu, selectGoogle Cloud SQL.

3. Fill out the connection details. The majority of the settings are common to most database dialects. See theConnecting Looker to your database documentation page for information. Some of the settings are described next:

   • Host: The database hostname that is used to connect to the Google Cloud SQL for MySQL database. For an SSH tunnel, uselocalhost.
   • Port: The port used that is to connect to the Google Cloud SQL for MySQL database.
   • Database: The name of the Google Cloud SQL for MySQL database instance.

   • Username:The username of the account that Looker will use to sign in to Google Cloud SQL for MySQL.

     Note:Looker (Google Cloud core) instances also supportApplication Default Credentials (ADC) as a method of authentication for Google Cloud SQL for MySQL. See theLooker (Google Cloud core) documentation for more information.

   • Password:The password of the account that Looker will use to sign in to Google Cloud SQL for MySQL.

   • Additional JDBC parameters: Additional JDBC parameters (optional).

   • SSL: If checked, enables an SSL connection; however, SSL connections to Google Cloud SQL for MySQL are not supported by default.

     Note: Google Cloud SQL for MySQL requires additional steps for configuring SSL connections; seeConfiguring SSL/TLS certificates. Google Cloud SQL for MySQL creates a server certificate on the creation of each instance, so the custom certificate must be installed on the Looker server for successful SSL connections. This option is available only forcustomer-hosted Looker deployments that have access to the Looker server.
     Because of this requirement, a better alternative to SSL is to connect Looker to Google Cloud SQL for MySQL through aCloud SQL for MySQL Proxy.

   • Verify SSL: If checked, SSL verification is enforced. However, SSL connections to Google Cloud are not supported by default.

4. To verify that the connection is successful, clickTest. See theTesting database connectivity documentation page for troubleshooting information.

5. To save these settings, clickConnect.

PDT support

Google Cloud SQL for MySQL does not supportCREATE TABLE AS SELECT statements, so you must use thecreate_process LookML parameter to define PDTs.

Feature support

For Looker to support some features, your database dialect must also support them.

Google Cloud SQL supports the following features as of Looker 26.2:

Feature	Supported?
Looker (Google Cloud core)
Symmetric aggregates
Derived tables
Persistent SQL derived tables
Persistent native derived tables
Stable views
Query killing
SQL-based pivots
Timezones
SSL
Subtotals
JDBC additional params
Case sensitive
Location type
List type
Percentile
Distinct percentile
SQL Runner Show Processes
SQL Runner Describe Table
SQL Runner Show Indexes
SQL Runner Select 10
SQL Runner Count
SQL Explain
OAuth 2.0 credentials
Context comments
Connection pooling
HLL sketches
Aggregate awareness
Incremental PDTs
Milliseconds
Microseconds
Materialized views
Period-over-period measures
Approximate count distinct

Next steps

After you have created your database connection,set authentication options.