Is there a way to restrict which compute engine instance can connect to my Cloud SQL instance? It looks like as long as the compute engine is connecting to my Cloud SQL instance using private IP, it goes thru.
Is there a way to restrict it by saying only allow those compute engine instances to connect to my Cloud SQL instance that has specified service account attached?
Cloud SQL now supports IAM Conditions for MySQL, PostgreSQL, and SQL Server. You can use IAM conditions to specify in an IAM policy binding the specific instances by name for which a user has permissions, such as the cloudsql.instances.connect for authorizing the Cloud SQL Auth proxy. https://cloud.google.com/sql/docs/release-notes#August_21_2021
https://cloud.google.com/sql/docs/mysql/project-access-control#iam-conditions