1. In the Google Cloud console, go to theCloud SQL Instances page.

   Go to Cloud SQL Instances

2. To open theOverview page of an instance, click the instance name.
3. ClickConnections from the SQL navigation menu.
4. Select theSecurity tab.
5. Select one of the following:
   • Allow unencrypted network traffic (not recommended)
   • Allow only SSL connections. This option only allows connections using SSL/TLS encryption.

gcloud

   gcloud sql instances patchINSTANCE_NAME \   --ssl-mode=SSL_ENFORCEMENT_MODE

ReplaceSSL_ENFORCEMENT_MODE with one of the following options:

• ALLOW_UNENCRYPTED_AND_ENCRYPTED allows non-SSL/non-TLS and SSL/TLS connections. This is the default value.
• ENCRYPTED_ONLY only allows connections encrypted with SSL/TLS.

Terraform

To enforce SSL/TLS encryption, use aTerraform resource:

resource "google_sql_database_instance" "sqlserver_instance" {  name             = "sqlserver-instance"  region           = "asia-northeast1"  database_version = "SQLSERVER_2019_STANDARD"  root_password    = "INSERT-PASSWORD-HERE"  settings {    tier = "db-custom-2-7680"    ip_configuration {      ssl_mode = "ENCRYPTED_ONLY"    }  }  # set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by  # use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.  deletion_protection = false}

Apply the changes

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

Prepare Cloud Shell

1. LaunchCloud Shell.

2. Set the default Google Cloud project where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   export GOOGLE_CLOUD_PROJECT=PROJECT_ID

   Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (alsocalled aroot module).

1. InCloud Shell, create a directory and a new file within that directory. The filename must have the.tf extension—for examplemain.tf. In this tutorial, the file is referred to asmain.tf.

   mkdirDIRECTORY && cdDIRECTORY && touch main.tf

2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly createdmain.tf.

   Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   terraform init

   Optionally, to use the latest Google provider version, include the-upgrade option:

   terraform init -upgrade

Apply the changes

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   terraform plan

   Make corrections to the configuration as necessary.

2. Apply the Terraform configuration by running the following command and enteringyes at the prompt:

   terraform apply

   Wait until Terraform displays the "Apply complete!" message.

3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

REST v1

1. Before using any of the request data, make the following replacements:

   • PROJECT_ID: The project ID
   • SSL_ENFORCEMENT_MODE: Use one of the following options:
     • ALLOW_UNENCRYPTED_AND_ENCRYPTED: allows non-SSL/non-TLS and SSL/TLS connections.
     • ENCRYPTED_ONLY: only allows connections encrypted with SSL/TLS.
   • INSTANCE_ID: The instance ID

   HTTP method and URL:

   PATCH https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID

   Request JSON body:

   {  "settings": {    "ipConfiguration": {"sslMode": "SSL_ENFORCEMENT_MODE"}  }}

   To send your request, expand one of these options:

   curl (Linux, macOS, or Cloud Shell)

   Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login , or by usingCloud Shell, which automatically logs you into thegcloud CLI . You can check the currently active account by runninggcloud auth list.

   Save the request body in a file namedrequest.json, and execute the following command:

   curl -X PATCH \
        -H "Authorization: Bearer $(gcloud auth print-access-token)" \
        -H "Content-Type: application/json; charset=utf-8" \
        -d @request.json \
        "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID"

   PowerShell (Windows)

   Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login . You can check the currently active account by runninggcloud auth list.

   Save the request body in a file namedrequest.json, and execute the following command:

   $cred = gcloud auth print-access-token
   $headers = @{ "Authorization" = "Bearer $cred" }
   
   Invoke-WebRequest `
       -Method PATCH `
       -Headers $headers `
       -ContentType: "application/json; charset=utf-8" `
       -InFile request.json `
       -Uri "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID" | Select-Object -Expand Content

   You should receive a JSON response similar to the following:

   Response

   {  "kind": "sql#operation",  "targetLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID",  "status": "PENDING",  "user": "user@example.com",  "insertTime": "2020-01-20T21:30:35.667Z",  "operationType": "UPDATE",  "name": "OPERATION_ID",  "targetId": "INSTANCE_ID",  "selfLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/operations/OPERATION_ID",  "targetProject": "PROJECT_ID"}

REST v1beta4

1. Before using any of the request data, make the following replacements:

   • PROJECT_ID: The project ID
   • SSL_ENFORCEMENT_MODE: Use one of the following options:
     • ALLOW_UNENCRYPTED_AND_ENCRYPTED: allows non-SSL/non-TLS and SSL/TLS connections.
     • ENCRYPTED_ONLY: only allows connections encrypted with SSL/TLS.
   • INSTANCE_ID: The instance ID

   HTTP method and URL:

   PATCH https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID

   Request JSON body:

   {  "settings": {    "ipConfiguration": {"sslMode": "SSL_ENFORCEMENT_MODE"}  }}

   To send your request, expand one of these options:

   curl (Linux, macOS, or Cloud Shell)

   Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login , or by usingCloud Shell, which automatically logs you into thegcloud CLI . You can check the currently active account by runninggcloud auth list.

   Save the request body in a file namedrequest.json, and execute the following command:

   curl -X PATCH \
        -H "Authorization: Bearer $(gcloud auth print-access-token)" \
        -H "Content-Type: application/json; charset=utf-8" \
        -d @request.json \
        "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID"

   PowerShell (Windows)

   Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login . You can check the currently active account by runninggcloud auth list.

   Save the request body in a file namedrequest.json, and execute the following command:

   $cred = gcloud auth print-access-token
   $headers = @{ "Authorization" = "Bearer $cred" }
   
   Invoke-WebRequest `
       -Method PATCH `
       -Headers $headers `
       -ContentType: "application/json; charset=utf-8" `
       -InFile request.json `
       -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID" | Select-Object -Expand Content

   You should receive a JSON response similar to the following:

   Response

   {  "kind": "sql#operation",  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID",  "status": "PENDING",  "user": "user@example.com",  "insertTime": "2020-01-20T21:30:35.667Z",  "operationType": "UPDATE",  "name": "OPERATION_ID",  "targetId": "INSTANCE_ID",  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/operations/OPERATION_ID",  "targetProject": "PROJECT_ID"}

Console

For instances that use self-signed server certificates (per-instance CA):

1. In the Google Cloud console, go to theCloud SQL Instances page.

   Go to Cloud SQL Instances

2. To open theOverview page of an instance, click the instance name.
3. ClickConnections from the SQL navigation menu.
4. Select theSecurity tab.
5. Go to theManage server CA certificates section.
6. Click to expandManage certificates.
7. ClickCreate new CA certificate.

The new server CA certificate appears in theUpcoming slot. If you want to rotate to the new server CA certificate immediately, proceed withserver CA certificate rotation by updating your clients and completing the rotation.

For instances that use server certificates issued by a shared CA:

1. In the Google Cloud console, go to theCloud SQL Instances page.

   Go to Cloud SQL Instances

2. To open theOverview page of an instance, click the instance name.
3. ClickConnections from the SQL navigation menu.
4. Select theSecurity tab.
5. Go to theManage server certificates section.
6. Click to expandManage certificates.
7. ClickCreate server certificate.

The new server certificate appears in theUpcoming slot. If you want to use the new server certificate immediately, proceed withserver certificate rotation by updating your clients and completing the rotation.

gcloud

For instances that use self-signed server certificates (per-instance CA):

1. To get information about the server certificate, use thesql ssl server-ca-certs list command:

   gcloudsqlsslserver-ca-certslist\--instance=INSTANCE_NAME

2. To create a server certificate, use thesql ssl server-ca-certs create command:

   gcloudsqlsslserver-ca-certscreate\--instance=INSTANCE_NAME

3. Download the certificate information to a local PEM file:

   gcloudsqlsslserver-ca-certslist\--format="value(cert)"\--instance=INSTANCE_NAME>\FILE_PATH/FILE_NAME.pem

4. Update all of your clients to use the new information by copying the downloaded file to your client host machines, replacing the existingserver-ca.pem files.

For instances that use server certificates issued by a shared CA:

1. To get information about the server certificate, use thesql ssl server-certs list command:

   gcloudsqlsslserver-certslist\--instance=INSTANCE_NAME

2. To create a server certificate, use thesql ssl server-certs create command:

   gcloudsqlsslserver-certscreate\--instance=INSTANCE_NAME

3. Download the certificate information to a local PEM file:

   gcloudsqlsslserver-certslist\--format="value(ca_cert.cert)"\--instance=INSTANCE_NAME>\FILE_PATH/FILE_NAME.pem

4. Update all of your clients to use the new information by copying the downloaded file to your client host machines, replacing the existingserver-ca.pem files.

Terraform

To provide server certificate information as an output, use aTerraform data source:

1. Add the following to your Terraform configuration file:

      data "google_sql_ca_certs" "ca_certs" {     instance = google_sql_database_instance.default.name   }   locals {     furthest_expiration_time = reverse(sort([for k, v in data.google_sql_ca_certs.ca_certs.certs : v.expiration_time]))[0]     latest_ca_cert           = [for v in data.google_sql_ca_certs.ca_certs.certs : v.cert if v.expiration_time == local.furthest_expiration_time]   }   output "db_latest_ca_cert" {     description = "Latest CA certificate used by the primary database server"     value       = local.latest_ca_cert     sensitive   = true   }

2. To create theserver-ca.pem file, run the following command:

      terraform output db_latest_ca_cert > server-ca.pem