Configure database flags
This page describes how to configure database flags for Cloud SQL, andlists the flags that you can set for your instance. You use database flagsfor many operations, including adjusting SQL Server parameters, adjustingoptions, and configuring and tuning an instance.
When you set, remove, or modify a flag for a database instance, the databasemight be restarted. The flag value is then persisted for the instance until youremove it. If the instance is the source of a replica, and the instance isrestarted, the replica is also restarted to align with the current configurationof the instance.
Configure database flags
The following sections cover common flag management tasks.
Set a database flag
Console
- In theGoogle Cloud console,select the project that contains the Cloud SQL instance for which you want to set a database flag.
- Open the instance and clickEdit.
- Go to theFlags section.
- To set a flag that has not been set on the instance before, clickAdd item, choose the flag from the drop-down menu, and set its value.
- ClickSave to save your changes.
- Confirm your changes underFlags on the Overview page.
gcloud
Edit the instance:
gcloudsqlinstancespatchINSTANCE_NAME--database-flags=FLAG1=VALUE1,FLAG2=VALUE2
This command will overwrite all database flagspreviously set. To keep those and add new ones, include the values for allflags you want set on the instance; any flag not specifically included isset to its default value. For flags that don't take a value, specify theflag name followed by an equals sign ("=").
For example, to set the1204,remote access, andremote query timeout (s) flags, youcan use the following command:
gcloudsqlinstancespatchINSTANCE_NAME\--database-flags="1204"=on,"remote access"=on,"remote query timeout (s)"=300
Terraform
To add database flags, use aTerraform resource.
resource "google_sql_database_instance" "instance" { name = "sqlserver-instance-flags" region = "us-central1" database_version = "SQLSERVER_2019_STANDARD" root_password = "INSERT-PASSWORD-HERE" settings { database_flags { name = "1204" value = "on" } database_flags { name = "remote access" value = "on" } database_flags { name = "remote query timeout (s)" value = "300" } tier = "db-custom-2-7680" } # set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by # use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level. deletion_protection = false}Apply the changes
To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.
Prepare Cloud Shell
- LaunchCloud Shell.
Set the default Google Cloud project where you want to apply your Terraform configurations.
You only need to run this command once per project, and you can run it in any directory.
export GOOGLE_CLOUD_PROJECT=PROJECT_ID
Environment variables are overridden if you set explicit values in the Terraform configuration file.
Prepare the directory
Each Terraform configuration file must have its own directory (alsocalled aroot module).
- InCloud Shell, create a directory and a new file within that directory. The filename must have the
.tfextension—for examplemain.tf. In this tutorial, the file is referred to asmain.tf.mkdirDIRECTORY && cdDIRECTORY && touch main.tf
If you are following a tutorial, you can copy the sample code in each section or step.
Copy the sample code into the newly created
main.tf.Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.
- Review and modify the sample parameters to apply to your environment.
- Save your changes.
- Initialize Terraform. You only need to do this once per directory.
terraform init
Optionally, to use the latest Google provider version, include the
-upgradeoption:terraform init -upgrade
Apply the changes
- Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:
terraform plan
Make corrections to the configuration as necessary.
- Apply the Terraform configuration by running the following command and entering
yesat the prompt:terraform apply
Wait until Terraform displays the "Apply complete!" message.
- Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.
Delete the changes
To delete your changes, do the following:
- To disable deletion protection, in your Terraform configuration file set the
deletion_protectionargument tofalse.deletion_protection = "false"
- Apply the updated Terraform configuration by running the following command and entering
yesat the prompt:terraform apply
Remove resources previously applied with your Terraform configuration by running the following command and entering
yesat the prompt:terraform destroy
REST v1
To set a flag for an existing database:
Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
PATCH https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id
Request JSON body:
{ "settings": { "databaseFlags": [ { "name": "flag_name", "value": "flag_value" } ] }}To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login , or by usingCloud Shell, which automatically logs you into thegcloud CLI . You can check the currently active account by runninggcloud auth list. Save the request body in a file namedrequest.json, and execute the following command:
curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id"
PowerShell (Windows)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login . You can check the currently active account by runninggcloud auth list. Save the request body in a file namedrequest.json, and execute the following command:
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `
-Method PATCH `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{ "kind": "sql#operation", "targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id", "status": "PENDING", "user": "user@example.com", "insertTime": "2020-01-21T22:43:37.981Z", "operationType": "UPDATE", "name": "operation-id", "targetId": "instance-id", "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/operations/operation-id", "targetProject": "project-id"}If there are existing flags configured for the database, modify the previouscommand to include them. ThePATCH command overwrites the existingflags with the ones specified in the request.
REST v1beta4
To set a flag for an existing database:
Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
PATCH https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id
Request JSON body:
{ "settings": { "databaseFlags": [ { "name": "flag_name", "value": "flag_value" } ] }}To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login , or by usingCloud Shell, which automatically logs you into thegcloud CLI . You can check the currently active account by runninggcloud auth list. Save the request body in a file namedrequest.json, and execute the following command:
curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id"
PowerShell (Windows)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login . You can check the currently active account by runninggcloud auth list. Save the request body in a file namedrequest.json, and execute the following command:
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `
-Method PATCH `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{ "kind": "sql#operation", "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id", "status": "PENDING", "user": "user@example.com", "insertTime": "2020-01-21T22:43:37.981Z", "operationType": "UPDATE", "name": "operation-id", "targetId": "instance-id", "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id", "targetProject": "project-id"}If there are existing flags configured for the database, modify the previouscommand to include them. ThePATCH command overwrites the existingflags with the ones specified in the request.
Clear all flags to their default values
Console
- In theGoogle Cloud console,select the project that contains the Cloud SQL instance for which you want to clear all flags.
- Open the instance and clickEdit.
- Open theDatabase flags section.
- Click theX next to all of the flags shown.
- ClickSave to save your changes.
gcloud
Clear all flags to their default values on an instance:
gcloudsqlinstancespatchINSTANCE_NAME\--clear-database-flagsYou are prompted to confirm that the instance will be restarted.
REST v1
To clear all flags for an existing instance:
Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
PATCH https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id
Request JSON body:
{ "settings": { "databaseFlags": [] }}To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login , or by usingCloud Shell, which automatically logs you into thegcloud CLI . You can check the currently active account by runninggcloud auth list. Save the request body in a file namedrequest.json, and execute the following command:
curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id"
PowerShell (Windows)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login . You can check the currently active account by runninggcloud auth list. Save the request body in a file namedrequest.json, and execute the following command:
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `
-Method PATCH `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{ "kind": "sql#operation", "targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id", "status": "PENDING", "user": "user@example.com", "insertTime": "2020-01-21T22:43:37.981Z", "operationType": "UPDATE", "name": "operation-id", "targetId": "instance-id", "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/operations/operation-id", "targetProject": "project-id"}REST v1beta4
To clear all flags for an existing instance:
Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
PATCH https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id
Request JSON body:
{ "settings": { "databaseFlags": [] }}To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login , or by usingCloud Shell, which automatically logs you into thegcloud CLI . You can check the currently active account by runninggcloud auth list. Save the request body in a file namedrequest.json, and execute the following command:
curl -X PATCH \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json; charset=utf-8" \
-d @request.json \
"https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id"
PowerShell (Windows)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login . You can check the currently active account by runninggcloud auth list. Save the request body in a file namedrequest.json, and execute the following command:
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `
-Method PATCH `
-Headers $headers `
-ContentType: "application/json; charset=utf-8" `
-InFile request.json `
-Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{ "kind": "sql#operation", "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id", "status": "PENDING", "user": "user@example.com", "insertTime": "2020-01-21T22:43:37.981Z", "operationType": "UPDATE", "name": "operation-id", "targetId": "instance-id", "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id", "targetProject": "project-id"}Determine which database flags have been set for an instance
To see which flags have been set for a Cloud SQL instance:
Console
- In theGoogle Cloud console,select the project that contains the Cloud SQL instance for which you want to see the database flags that have been set.
- Select the instance to open itsInstance Overview page.
The database flags that have been set are listed under theDatabase flags section.
gcloud
Get the instance state:
gcloudsqlinstancesdescribeINSTANCE_NAME
In the output, database flags are listed under thesettings asthe collectiondatabaseFlags. For more information about the representation of the flags in the output, seeInstances Resource Representation.
REST v1
To list flags configured for an instance:
Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login , or by usingCloud Shell, which automatically logs you into thegcloud CLI . You can check the currently active account by runninggcloud auth list.Execute the following command:
curl -X GET \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
"https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id"
PowerShell (Windows)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login . You can check the currently active account by runninggcloud auth list.Execute the following command:
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `
-Method GET `
-Headers $headers `
-Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{ "settings": { "authorizedGaeApplications": [], "tier": "machine-type", "kind": "sql#settings", "availabilityType": "REGIONAL", "pricingPlan": "PER_USE", "replicationType": "SYNCHRONOUS", "activationPolicy": "ALWAYS", "ipConfiguration": { "privateNetwork": "projects/project-id/global/networks/default", "authorizedNetworks": [], "ipv4Enabled": false }, "locationPreference": { "zone": "zone", "kind": "sql#locationPreference" }, "databaseFlags": [ { "name": "general_log", "value": "on" } ], "dataDiskType": "PD_SSD", "maintenanceWindow": { "kind": "sql#maintenanceWindow", "hour": 0, "day": 0 }, "backupConfiguration": { "startTime": "03:00", "kind": "sql#backupConfiguration", "enabled": true, "binaryLogEnabled": true }, "settingsVersion": "54", "storageAutoResizeLimit": "0", "storageAutoResize": true, "dataDiskSizeGb": "10" }}In the output, look for thedatabaseFlags field.
REST v1beta4
To list flags configured for an instance:
Before using any of the request data, make the following replacements:
- project-id: The project ID
- instance-id: The instance ID
HTTP method and URL:
GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id
To send your request, expand one of these options:
curl (Linux, macOS, or Cloud Shell)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login , or by usingCloud Shell, which automatically logs you into thegcloud CLI . You can check the currently active account by runninggcloud auth list.Execute the following command:
curl -X GET \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
"https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id"
PowerShell (Windows)
Note: The following command assumes that you have logged in to thegcloud CLI with your user account by runninggcloud init orgcloud auth login . You can check the currently active account by runninggcloud auth list.Execute the following command:
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }
Invoke-WebRequest `
-Method GET `
-Headers $headers `
-Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content
You should receive a JSON response similar to the following:
Response
{ "settings": { "authorizedGaeApplications": [], "tier": "machine-type", "kind": "sql#settings", "availabilityType": "REGIONAL", "pricingPlan": "PER_USE", "replicationType": "SYNCHRONOUS", "activationPolicy": "ALWAYS", "ipConfiguration": { "privateNetwork": "projects/project-id/global/networks/default", "authorizedNetworks": [], "ipv4Enabled": false }, "locationPreference": { "zone": "zone", "kind": "sql#locationPreference" }, "databaseFlags": [ { "name": "general_log", "value": "on" } ], "dataDiskType": "PD_SSD", "maintenanceWindow": { "kind": "sql#maintenanceWindow", "hour": 0, "day": 0 }, "backupConfiguration": { "startTime": "03:00", "kind": "sql#backupConfiguration", "enabled": true, "binaryLogEnabled": true }, "settingsVersion": "54", "storageAutoResizeLimit": "0", "storageAutoResize": true, "dataDiskSizeGb": "10" }}In the output, look for thedatabaseFlags field.
Supported flags
Cloud SQL supports only those flags that are listed in this section.
Note: When you create an instance, you can set a permanent time zone for the instance.Learn more.Special flags
This section contains additional information about Cloud SQL for SQL Server flags.
max degree of parallelism (MAXDOP)
Max degree of parallelism (MAXDOP) is a Microsoft database flagavailable for use in Cloud SQL for SQL Server. This flag lets you limit the maximumnumber of threads used when running a single query in a parallel plan.
If left to the default value of0, then the database instance usesall available processors. However, this might not always be efficient or evenpractical if managing instances with hundreds of databases.
We recommend following Microsoft documentation recommendations when setting theflag's value, which can vary based on the number of numa nodes and thenumber of available logical processors.
You can check the numa node configuration using thedynamic management view (DMV)fromsys.dm_os_sys_info.To check the numa node configuration, use a code snippet similar to the following:
SELECT socket_count,cores_per_socket,numa_node_count
FROM sys.dm_os_sys_info
While you can use MAXDOP to limit the maximum number of processors you want toallow for parallel plan execution, you can also use thecost threshold for parallelismfeature to indicate the minimum cost you want to set for a single processorbefore expanding parallel operations to another processor. These features letyou better control the efficiency and cost of parallel plan execution.
Recommended values for these features vary on a case-by-case basis, and willbe influenced by your server and application workload needs.
For help determining the best MAXDOP and cost threshold for parallelism valuesfor your servers, see the following resources:
Changing the default value helps address the following potential issues:
- If the
max degree of parallelism (MAXDOP)flag is set to0, then instances or client applications that require SharePoint downloads fail. The SharePoint download runs a pre-check that requires a numeric value for the flag and won't accept a value less than 1. - Leaving the MAXDOP flag to the default of
0, effectively indicates that there is no limit and that all available processors can be used for parallel operations. While this value might be fine for servers routinely running small queries, it might pose a cost issue if you also need to periodically run very large queries.
Using themax degree of parallelism (MAXDOP) flag, you can controlthe number of threads at three levels:
- Instance level, using database flags
- Database scope, using TSQL
- Query level, using query hints
Note that if the instance is resized, then the flag value remains unchanged.
max server memory (mb)
Themax server memory (mb) flag limits the amount of memory thatCloud SQL can allocate for its internal pools.
We recommend you not configure a value for this flag and that you let Cloud SQLmanage the value for you. If you must manually manage this value, as a generalrecommendation, set themax server memory (mb) value to roughly 80%of available memory to help prevent SQL Server from consuming all memory.
Conversely, for instances with large amounts of memory, 80% of available memorymight be too low of a value and might lead to wasted memory usage.
If you don't set a value for this flag, then Cloud SQL manages thevalue automatically, based on the size of the RAM for your instance. Also, ifyou resize your instance, then Cloud SQL adjusts the value of the flagautomatically to meet our recommendations for the new instance size. This resizeoperation also removes any manually set value for this flag. This helps yourdatabase utilize resources more effectively by helping prevent overallocation,reducing the likelihood of a crash due to out-of-memory issues, and helping toavoid performance degradation for your instance.
For more information, seeMaximum server memoryandOptimize high memory usage.
Troubleshooting
| Issue | Troubleshooting |
|---|---|
| You want to modify the time zone for a Cloud SQL instance. | To see how to update an instance's time zone, seeInstance settings. In Cloud SQL for SQL Server, you can use the |
What's next
- Learn more aboutSQL Server configuration options.
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-11-24 UTC.