Cloud Run: Connecting to a CloudSQL database on another GCP Project

Question

I am having trouble connecting my [Project A] Cloud Run instance to a [Project B] Cloud SQL instance.

I already set up the service account permissions as told on this article: https://cloud.google.com/sql/docs/mysql/connect-run

Which are like this:

I created a service account on [Project B] that has Cloud SQL Admin and Cloud SQL Client permissions.
I created a service account on [Project A] for the Cloud Run instance, this account has a user role on the service account for [Project B]

Both projects have the Cloud SQL Admin API active, and if I build the same Cloud Run instance on [Project B] it connects without any hitches, so I imagine this is a permission issue.

The error I get on the logs from [Project A] Cloud Run is: googleapi: Error 403: The client is not authorized to make this request., notAuthorized

I don't get this at all this account has a user role on the service account for [Project B] Can you clarify this? — Puteri
– Puteri, Commented Jul 12, 2022 at 18:17
The service account for the cloud run instance has a Service Account User permission on the cloud sql service account, I imagine this is how you link both of them — Gustavo Lima
– Gustavo Lima, Commented Jul 12, 2022 at 18:29
Actually not, the Service Account created in [Project A] should have Cloud SQL user role in [Project B] unless you want to impersonalize the SA from project B using the one in Project A. If you want to impersonalize can you show the code you're using for this? — Puteri
– Puteri, Commented Jul 12, 2022 at 18:38

Darwin · Accepted Answer · 2022-07-13 00:28:04Z

8

I replicated your error and managed to fix it without creating a Service Account manually on project A (Cloud Run) and project B(Cloud SQL).

When you deploy a service in Cloud Run, it uses the default Compute Engine service account which is like this: [email protected].

Then I open the Cloud IAM page on project B where the Cloud SQL is located then I grant the role of Service Account from Project A (Cloud run) with a Cloud SQL Client or Cloud SQL Admin permission.

Sample screenshot of Project B Cloud IAM Page where I grant the [email protected] service account from Cloud Run:

You can also see what Service Account your Cloud run uses in revisions tab -> Security tab

answered Jul 13, 2022 at 0:28

Darwin

4904 silver badges11 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Gustavo Lima Over a year ago

Thanks so much!!, that fixed the problem. I thought I needed a service account and couldn't do it directly on the IAM page.

Collectives™ on Stack Overflow

Cloud Run: Connecting to a CloudSQL database on another GCP Project

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related