Console

This example shows how to modify the existing IAM binding for the project to give a service account a Cloud SQL Client role for a specific instance.

This example uses the following variables:

• PROJECT_ID: Your Google Cloud project.
• INSTANCE_ID: The name of the instance you want to grant access to.

1. In the Google Cloud console, go to theService accounts page.

   Go to IAM

2. ClickAdd.
3. In theNew Members input box, enter the service account email.
4. Click theRole dropdown list and select theCloud SQL Client role.
5. ClickAdd condition.
6. Enter a title and description.
7. Select theCondition editor tab.
8. In theCondition builder section:
   • ForCondition type - Resource - Name, enterprojects/PROJECT_ID/instances/INSTANCE_ID
   • Ensure that theAND conditional is selected.
   • ForCondition type - Resource - Service, selectsqladmin.googleapis.com.
9. ClickSave to save the condition.
10. ClickSave to save the policy.

gcloud

This example shows how to modify the existing IAM policy binding for the project to give a specific service account the Cloud SQL Client role, but only for a specific instance.

This example uses the following variables:

• PROJECT_ID: Your Google Cloud project.
• INSTANCE_ID: The name of the instance you want to grant access to.
• SERVICE_ACCOUNT_EMAIL: The complete email address of the service account whose access you want to modify.

1. Get the existing IAM policy bindings and output it to the filebindings.json:

gcloudprojectsget-iam-policyPROJECT_ID--format=json>bindings.json

2. Add the following conditional role binding to thebindings.json file:

   {"bindings":[{"role":"roles/cloudsql.client","members":["serviceAccount:SERVICE_ACCOUNT_EMAIL"],"condition":{"expression":"resource.name == 'projects/PROJECT_ID/instances/INSTANCE_ID'          && resource.service == 'sqladmin.googleapis.com'"}}],"etag":"BwWKmjvelug=","version":3}

3. Update the IAM policy with the newbindings.json file.

   gcloudprojectsset-iam-policyPROJECT_IDbindings.json

Terraform

To allow users to connect to specific instances, use aTerraformgoogle_iam_policy data resource and agoogle_project_iam_policy Terraform resource.

data "google_iam_policy" "sql_iam_policy" {  binding {    role = "roles/cloudsql.client"    members = [      "serviceAccount:${google_project_service_identity.gcp_sa_cloud_sql.email}",    ]    condition {      expression  = "resource.name == 'projects/${data.google_project.project.project_id}/instances/${google_sql_database_instance.default.name}' && resource.type == 'sqladmin.googleapis.com/Instance'"      title       = "created"      description = "Cloud SQL instance creation"    }  }}resource "google_project_iam_policy" "project" {  project     = data.google_project.project.project_id  policy_data = data.google_iam_policy.sql_iam_policy.policy_data}

1. LaunchCloud Shell.

2. Set the default Google Cloud project where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   export GOOGLE_CLOUD_PROJECT=PROJECT_ID

   Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (alsocalled aroot module).

1. InCloud Shell, create a directory and a new file within that directory. The filename must have the.tf extension—for examplemain.tf. In this tutorial, the file is referred to asmain.tf.

   mkdirDIRECTORY && cdDIRECTORY && touch main.tf

2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly createdmain.tf.

   Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   terraform init

   Optionally, to use the latest Google provider version, include the-upgrade option:

   terraform init -upgrade

Apply the changes

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   terraform plan

   Make corrections to the configuration as necessary.

2. Apply the Terraform configuration by running the following command and enteringyes at the prompt:

   terraform apply

   Wait until Terraform displays the "Apply complete!" message.

3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

Console

1. In the Google Cloud console, go to theService accounts page.

   Go to IAM

2. Click thePRINCIPALS tab.
3. Locate the user's email address or service account (principal) to which you want to restrict access.
4. Click theEdit principal icon to the right of the principal. This icon appears as a pencil.
5. In theEdit permissions dialog box, clickADD ANOTHER ROLE.

6. In theFilter field of the subsequent dialog box, enterCloud SQL Admin. Then, select theCloud SQL Admin role that appears.

   TheEdit permissions dialog box is active, and theCloud SQL Admin role now appears in the dialog box.

7. To the right of theCloud SQL Admin role, click theAdd condition link.
8. In theEdit condition dialog box, supply the following information:
   1. In theTitle field, enter a name for the condition that you're adding to limit access to backup operations for test instances. For example, you can enterLimit access to backup operations.

   2. Click theCONDITION EDITOR tab, and then add the following condition:

      resource.type=="sqladmin.googleapis.com/BackupRun"&&resource.name.startsWith("projects/PROJECT_ID/instances/test")

      This condition limits the scope of the Cloud SQL Admin role for the principal that you selected to those resources that have resource names that start withprojects/PROJECT_ID/instances/test. Also, replace thePROJECT_ID placeholder variable with the name of your Google Cloud project.

9. ClickSAVE.
10. In theEdit permissions dialog box, clickSAVE.

gcloud

This example uses the following variables:

• PROJECT_ID: Your Google Cloud project.
• USER_EMAIL: The user's email address.
• SERVICE_ACCOUNT_EMAIL:The complete email address of the service account whose access you want to limit.

Console

1. In the Google Cloud console, go to theService accounts page.

   Go to IAM

2. ClickAdd.
3. In theNew Members field, enter the service account email.
4. Click theRole dropdown list and select theCloud SQL Editor role. Add nothing further for this role.
5. ClickSave to save the condition.
6. Click theRole menu for the same account and select theCloud Cloud SQL Admin role.
7. ClickAdd condition.
8. Enter a title and description.
9. Select theCondition editor tab.
10. In theCondition builder section:
    • ForCondition type - Resource - Name, enter a name for the condition.
    • ForCondition type - Resource - Service, selectsqladmin.googleapis.com.
    • ForCondition type - Resource - Tag, enter the Tag key namespaced name. For this example, theOperator ismatches and the value is815471563813/env/test.
11. ClickSave to save the condition.
12. ClickSave to save the policy.

gcloud

This example uses the following variables:

• PROJECT_ID: Your Google Cloud project.
• INSTANCE_ID: Your Cloud SQL instance.
• REGION: The region your Cloud SQL instance is in.
• ORGANIZATION_ID: The ID of the organization to be the parent resource to this tag key; for example: 12345678901. To learn how to get your organization ID, seeCreating and managing organizations.
• SERVICE_ACCOUNT_EMAIL:The complete email address of the service account whose access you want to modify.

1. Create a tag key named `env` with tag values `prod` and `test`. For more information, see Creating and defining a new tag.

   gcloudalpharesource-managertagskeyscreateenv\--parent=organizations/ORGANIZATION_IDgcloudalpharesource-managertagsvaluescreateprod\--parent=envgcloudalpharesource-managertagsvaluescreatetest\--parent=env

2. Attach the `env` tag with value `test` to your test environment Cloud SQL instances. For more information, see the Cloud SQL tags page.

gcloudalpharesource-managertagsbindingscreate\--tag-value=test\--parent=//sqladmin.googleapis.com/projects/PROJECT_ID/instances/INSTANCE_ID\--location=REGION

3. Get the existing IAM policy bindings and output it to the filebindings.json:

   gcloudprojectsget-iam-policyPROJECT_ID--format=json>>bindings.json

4. Add the following conditional bindings to thebindings.json file:

   {"bindings":[{"role":"roles/cloudsql.editor","members":["serviceAccount:SERVICE_ACCOUNT_EMAIL"]},{"role":"roles/cloudsql.admin","members":["serviceAccount:SERVICE_ACCOUNT_EMAIL"],"condition":{"expression":"resource.matchTag('ORGANIZATION_ID/env', 'test')"}}],"etag":"BwWKmjvelug=""version":3}

5. Update the IAM policy bindings with the newbindings.json file.

   gcloudprojectsset-iam-policyPROJECT_IDbindings.json