Search code examples
google-cloud-platformgoogle-cloud-sqlgoogle-alloydb

Does AlloyDB support authenticating to Postgres databases with IAM service accounts like Cloud SQL does?

I'm really confused about how IAM login works with AlloyDB. I don't see anything in the docs about mapping postgres users to IAM service accounts.

With Cloud SQL Postgres I can do this: https://cloud.google.com/sql/docs/postgres/authentication

  1. I create a service account
  2. Create a cloud sql user of type CLOUD_IAM_SERVICE_ACCOUNT, (gcloud sql users create <GSA> --type=CLOUD_IAM_SERVICE_ACCOUNT)
  3. Log in to postgres and give that postgres user access to only its own database.

Applications auth to their own postgres DB through their IAM service account (via the proxy) and cannot access other DBs on the postgres server.

How do I do this with AlloyDB?

Looking at the docs I see some mention of CLOUD_IAM_USER https://cloud.google.com/alloydb/docs/database-users/about#view-list

But I cannot see how to create AlloyDB users via the API:

enter image description here

Does the sql users API also support AlloyDB? With Cloud SQL I can create IAM service account users via the Cloud SQL API.

Solution

  • Manual IAM authentication is now available.

    https://cloud.google.com/alloydb/docs/manage-iam-authn

    Automatic IAM Authentication (where the AlloyDB Proxy handles the OAuth2 token for you) isn't available yet, though.