CODEWITHSUNDEEP
google-compute-enginegoogle-cloud-sql
sthomps
sthomps

Reputation: 4840

Default Compute Engine service account cant access Cloud SQL

Im trying to get my compute engine instance to communicate with Cloud SQL using the Proxy. I keep getting this error when I try to start the proxy:

the default Compute Engine service account is not configured with sufficient permissions to access the Cloud SQL API from this VM. Please create a new VM with Cloud SQL access (scope) enabled under "Identity and API access". Alternatively, create a new "service account key" and specify it using the -credentials_file parameter

When I describe my instance using gcloud compute instances describe the service account and scopes are:

serviceAccounts:
- email: [email protected]
  scopes:
  - https://www.googleapis.com/auth/devstorage.full_control
  - https://www.googleapis.com/auth/logging.write
  - https://www.googleapis.com/auth/monitoring.write
  - https://www.googleapis.com/auth/sqlservice
  - https://www.googleapis.com/auth/sqlservice.admin

I can get this working if I create a new instance with full scope permissions:

serviceAccounts:
- email: [email protected]
  scopes:
  - https://www.googleapis.com/auth/cloud-platform

But this seems less secure than just specifying the scopes I need.

Upvotes: 3

Views: 3662

Answers (1)

Herman
Herman

Reputation: 2072

It is an issue fixed in https://github.com/GoogleCloudPlatform/cloudsql-proxy/pull/21.

We will roll out a new release on Monday (4/18). Or you can compile from the source on github. Sorry for the inconvenience.

Upvotes: 0

Related Questions