This page discusses the two levels of access control for Cloud SQLinstances. You must configure both levels of access control before you canmanage your instance.

Levels of access control

Configuring access control involves controlling who orwhat can access the instance. Access control occurs on two levels:

Instance-level access

Instance-level access authorizes access to your Cloud SQL instance from an application or client (running on an App Engine standard environment or externally) or from another Google Cloud service, such as Compute Engine.

Database access

Database access uses server-level roles to control which SQL Server users can access the data in your instance.

Note: For information about controlling who canmanage your instance, seeProject access control.

Instance-level access

How you configure instance-level access depends on where you are connectingfrom:

Connection source	Access configuration options	More information
Google Kubernetes Engine	Cloud SQL Auth Proxy Docker image	Connecting from Google Kubernetes Engine
App Engine standard environment	Same project: configure IAM Between projects: configure IAM	Connecting from standard environment standard environment
flexible environment	Same project: preconfigured Between projects: configure IAM	Connecting from standard environment flexible environment
sqlcmd client	Cloud SQL Auth Proxy Authorize client IP address	Connecting a client using the Cloud SQL Auth Proxy Connecting a client using public IP
External applications	Cloud SQL Auth Proxy Authorize client IP address	Connecting to Cloud SQL from external applications
Cloud Run	A Cloud SQL instance set up with a public IP. Between projects: also configure IAM	Connecting from Cloud Run (fully managed) to Cloud SQL
Google Kubernetes Engine	Private IP If Public IP, Cloud SQL Auth Proxy is required	Connecting from Google Kubernetes Engine

Database access

After a user or application connects to a database instance, the user orapplication must log in with a user or service account.As part of creating a Cloud SQL instance, you set up the default user(root) account. You can also create more users to give you finer-grained controlover access to your instance.

For more information,seeSQL Server users and Creating and managing SQL Server users.

What's next

• Learn more abouthow Cloud SQL works with SQL Server users.
• Learn more aboutSQL Server roles.
• Learn more about youroptions for connecting from an external application.
• Learn aboutcontrolling who can manage your Google Cloud Platform project.