How to connect from external machine to a SQL instance hosted on a shared VPC subnetwork

Question

I have deployed a SQL instance on a shared VPC subnet to host a PostgreSQL database in GCP. Now I want to connect to this instance from a machine whose network is private and external to google cloud. I am using Cloud SQL Python connector to do that, but when I run the python script on the machine it gets stuck at "Requesting ephemeral certificate". Is this the right approach to establish such a connection?

More details on the setup:

• The SQL instance deployment was done using Terraform

• I reserved an internal IP address (Shared VPC subnet) for the Private Service Connect endpoint and I created a forwarding rule to point the PSC endpoint to the Cloud SQL service attachment, following the public documentation (https://cloud.google.com/sql/docs/mysql/configure-private-service-connect#create-cloud-sql-instance-psc-enabled)

• I attempt the connection with IAM authentication after exporting the SQL instance credentials (service account)

• In the /etc/hosts file of the machine I added a line with the IP of the SQL instance followed by its DNS name

I tested this setup and the python script on a Virtual Machine in google cloud hosted within the same subnetwork as the SQL instance and I successfully connected to the PostgreSQL database. The same exact script on the external machine cannot establish the connection. The firewalls between the machine and the SQL instance private IP have been opened. The connectivity to on-prem is interconnect/vlan attachment with BGP running on top and the reachability is fine, based on the firewall logs showing that the connections are allowed. So, I don’t see where the issue is if this is the right approach...

I have followed this connection issues checklist, and everything seems alright in my setup... (https://cloud.google.com/sql/docs/debugging-connectivity#connection_issues_checklist)

Answer 1

The issue here is that the private IP of the Cloud SQL instance is not within your VPC but on the Google managed services side. And since transitive peering is not supported by Google (any two networks that are not directly peered are not able to communicate with each other) you will not be able to access Cloud SQL directly from your external host.

Solutions for this:

• Allow a public IP for the Cloud SQL instance (but do NOT whitelist any IPs) and use the Cloud SQL Auth proxy client (https://cloud.google.com/sql/docs/mysql/sql-proxy) to connect securely to the Cloud SQL instance.

• Set up a VM in the VPC and run the Cloud SQL Auth proxy there (use --private-ip). Your external clients can now connect to this proxy VM. No public IP needed in this case.