This document describes the options you have for configuring a Cloud SQL instance to support private IP connections.
Private IP connections offer better security and lower latency than public IP connections. You can use private IP connections to provide access across regions to your Cloud SQL instance as well as connections to external sources.
You can connect to your instance using a Shared VPC between projects.
For Terraform solutions for Cloud SQL networking, see Simplified cloud networking configuration solutions.
Private IP connection options
Use one or both of the following two methods to configure a Cloud SQL instance with a private IP address:
Private Service Connect: gives you the flexibility of connecting from multiple VPC networks, including cross-cloud and on-premise VPC networks. Private Service Connect is recommended over private services access because it provides better IP address space management, scalability and security controls. Private Service Connect is the default private IP connectivity option in the Cloud de Confiance console for new projects. For more information, see the Overview of Private Service Connect in Cloud SQL.
Private services access: is an earlier type of private IP connectivity, based on VPC Network Peering. Private services access only allows connections from one VPC network. You need additional configuration to connect from multiple VPC networks. For more information, see the Overview of private services access in Cloud SQL. VPC networks.
When you use the Cloud de Confiance console to create a Cloud SQL instance, if you choose Private IP under Connections, then, depending on your use case, you can select either Private Service Connect (PSC) (default), Private Service Access (PSA), or both.
Restrictions for private IP connection options
The following restrictions apply to private IP connections:
- Instances configured with Private Service Connect don't have visibility into the IP addresses of clients.
- Instances configured with both Private Service Connect and private services access can't change the associated VPC network for private services access.
Requirements for private IP connections
To create and manage private IP connections using either private services access or Private Service Connect, your network and application environment must meet certain requirements, and you need to have the right Identity and Access Management permissions. For the full list of API and IAM requirements, see the following pages: