genai-toolbox/docs/en/resources/sources/cloud-sql-pg.md

title, linkTitle, type, weight, description

title	linkTitle	type	weight	description
Cloud SQL for PostgreSQL	Cloud SQL (Postgres)	docs	1	Cloud SQL for PostgreSQL is a fully-managed database service for Postgres.

About

Cloud SQL for PostgreSQL is a fully-managed database service that helps you set up, maintain, manage, and administer your PostgreSQL relational databases on Google Cloud Platform.

If you are new to Cloud SQL for PostgreSQL, you can try creating and connecting to a database by following these instructions.

Available Tools

• postgres-sql Execute SQL queries as prepared statements in PostgreSQL.

• postgres-execute-sql Run parameterized SQL statements in PostgreSQL.

• postgres-list-tables List tables in a PostgreSQL database.

• postgres-list-active-queries List active queries in a PostgreSQL database.

• postgres-list-available-extensions List available extensions for installation in a PostgreSQL database.

• postgres-list-installed-extensions List installed extensions in a PostgreSQL database.

• postgres-list-views List views in a PostgreSQL database.

Pre-built Configurations

• Cloud SQL for Postgres using MCP Connect your IDE to Cloud SQL for Postgres using Toolbox.

Requirements

IAM Permissions

By default, this source uses the Cloud SQL Go Connector to authorize and establish mTLS connections to your Cloud SQL instance. The Go connector uses your Application Default Credentials (ADC) to authorize your connection to Cloud SQL.

In addition to setting the ADC for your server, you need to ensure the IAM identity has been given the following IAM roles (or corresponding permissions):

• roles/cloudsql.client

{{< notice tip >}} If you are connecting from Compute Engine, make sure your VM also has the proper scope to connect using the Cloud SQL Admin API. {{< /notice >}}

Networking

Cloud SQL supports connecting over both from external networks via the internet (public IP), and internal networks (private IP). For more information on choosing between the two options, see the Cloud SQL page Connection overview.

You can configure the ipType parameter in your source configuration to public or private to match your cluster's configuration. Regardless of which you choose, all connections use IAM-based authorization and are encrypted with mTLS.

Authentication

This source supports both password-based authentication and IAM authentication (using your Application Default Credentials).

Standard Authentication

To connect using user/password, create a PostgreSQL user and input your credentials in the user and password fields.

user: ${USER_NAME}
password: ${PASSWORD}

IAM Authentication

To connect using IAM authentication:

1. Prepare your database instance and user following this guide.

2. You could choose one of the two ways to log in:

   • Specify your IAM email as the user.
   • Leave your user field blank. Toolbox will fetch the ADC automatically and log in using the email associated with it.

3. Leave the password field blank.

Example

sources:
    my-cloud-sql-pg-source:
        kind: cloud-sql-postgres
        project: my-project-id
        region: us-central1
        instance: my-instance
        database: my_db
        user: ${USER_NAME}
        password: ${PASSWORD}
        # ipType: "private"

{{< notice tip >}} Use environment variable replacement with the format ${ENV_NAME} instead of hardcoding your secrets into the configuration file. {{< /notice >}}

Reference

field	type	required	description
kind	string	true	Must be "cloud-sql-postgres".
project	string	true	Id of the GCP project that the cluster was created in (e.g. "my-project-id").
region	string	true	Name of the GCP region that the cluster was created in (e.g. "us-central1").
instance	string	true	Name of the Cloud SQL instance within the cluster (e.g. "my-instance").
database	string	true	Name of the Postgres database to connect to (e.g. "my_db").
user	string	false	Name of the Postgres user to connect as (e.g. "my-pg-user"). Defaults to IAM auth using ADC email if unspecified.
password	string	false	Password of the Postgres user (e.g. "my-password"). Defaults to attempting IAM authentication if unspecified.
ipType	string	false	IP Type of the Cloud SQL instance; must be one of public, private, or psc. Default: public.