Search code examples
google-cloud-platformgoogle-compute-enginegoogle-cloud-sql

Why is it required to provide external IPs to Cloud SQL services for authorization?

I am taking the Google's GCP Fundamentals: Core Infrastructure course on Coursera. In the demonstration video of the Google Storage module, the presenter authorizes a compute engine instance to access a MySQL instance via it's external IP address.

Aren't these two resources part of the same VPC if they are part of the same project ? Why can't this authorization be done using the vm instance's internal IP address ?

Solution

  • Aren't these two resources part of the same VPC if they are part of the same project ?

    A Cloud SQL instance isn't created in one of your project's VPC network but in a Google-managed project, within its own network.

    What happens when you enable private IP is that this network will be peered with the network of your choice in your project, where your Compute Engine instance resides: enter image description here You can then connect to the Cloud SQL instance from your VM via the internal IP address. The VM is considered trusted if your network configuration allows it to reach the Cloud SQL instance.

    When you set an external IP address on the Cloud SQL instance, it means that the instance is accessible to the internet and the connection needs to be authorized. One way to do it is to whitelist the IP address of the caller as you mentioned. This works well if the caller's IP doesn't change. Another (easier) option is to connect via the cloud_sql_proxy, which handles authorization and encryption for you. You then don't need to whitelist the IP.