Console

1. In the Google Cloud console, go to theCloud SQL Instances page.

   Go to Cloud SQL Instances

2. To open theOverview page of an instance, click the instance name.
3. From the SQL navigation menu, selectConnections.
4. Click theNetworking tab.
5. Select thePublic IP checkbox.
6. In theAuthorized networks section, expandNew IP range.
7. In theName field, enter a name for theNew IP range.
8. In theIP range field, enter the public IPv4 address or address range from which you want to allow connections.
   Alternatively, clickUse My IP to let Cloud SQL populate the IPv4 address of the client machine from which you are accessing Google Cloud.
   TheUse my IP option isn't available for clients that use IPv6 addresses.

   For the address range, you must use a validCIDR notation (for example, 10.10.10.0/24).

9. ClickDone.
10. ClickSave.

gcloud

Configuring authorized networks replaces the existing authorized networks list.

gcloudsqlinstancespatchINSTANCE_ID\--authorized-networks=NETWORK_RANGE_1,NETWORK_RANGE_2...

Terraform

To configure authorized networks, use aTerraform resource.

resource "google_sql_database_instance" "default" {  name             = "postgres-instance-with-authorized-network"  region           = "us-central1"  database_version = "POSTGRES_14"  settings {    tier = "db-custom-2-7680"    ip_configuration {      authorized_networks {        name            = "Network Name"        value           = "192.0.2.0/24"        expiration_time = "3021-11-15T16:19:00.094Z"      }    }  }}

Apply the changes

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

Prepare Cloud Shell

1. LaunchCloud Shell.

2. Set the default Google Cloud project where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   export GOOGLE_CLOUD_PROJECT=PROJECT_ID

   Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (alsocalled aroot module).

1. InCloud Shell, create a directory and a new file within that directory. The filename must have the.tf extension—for examplemain.tf. In this tutorial, the file is referred to asmain.tf.

   mkdirDIRECTORY && cdDIRECTORY && touch main.tf

2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly createdmain.tf.

   Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   terraform init

   Optionally, to use the latest Google provider version, include the-upgrade option:

   terraform init -upgrade

Apply the changes

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   terraform plan

   Make corrections to the configuration as necessary.

2. Apply the Terraform configuration by running the following command and enteringyes at the prompt:

   terraform apply

   Wait until Terraform displays the "Apply complete!" message.

3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

REST v1

Configuring authorized networks replaces the existing authorized networks list.

Before using any of the request data, make the following replacements:

• project-id: The project ID
• instance-id: The instance ID
• network_range_1 An authorized ip address or range
• network_range_2 Another authorized ip address or range

HTTP method and URL:

PATCH https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id

Request JSON body:

{  "settings":  {    "ipConfiguration":    {      "authorizedNetworks":        [{"value": "network_range_1"}, {"value": "network_range_2"}]    }  }}

To send your request, expand one of these options:

curl -X PATCH \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method PATCH `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{  "kind": "sql#operation",  "targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id",  "status": "PENDING",  "user": "user@example.com",  "insertTime": "2020-01-21T22:43:37.981Z",  "operationType": "UPDATE",  "name": "operation-id",  "targetId": "instance-id",  "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/operations/operation-id",  "targetProject": "project-id"}

REST v1beta4

Configuring authorized networks replaces the existing authorized networks list.

Before using any of the request data, make the following replacements:

• project-id: The project ID
• instance-id: The instance ID
• network_range_1 An authorized ip address or range
• network_range_2 Another authorized ip address or range

HTTP method and URL:

PATCH https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

Request JSON body:

{  "settings":  {    "ipConfiguration":    {      "authorizedNetworks":        [{"value": "network_range_1"}, {"value": "network_range_2"}]    }  }}

To send your request, expand one of these options:

curl -X PATCH \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method PATCH `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{  "kind": "sql#operation",  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",  "status": "PENDING",  "user": "user@example.com",  "insertTime": "2020-01-21T22:43:37.981Z",  "operationType": "UPDATE",  "name": "operation-id",  "targetId": "instance-id",  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",  "targetProject": "project-id"}