-
Notifications
You must be signed in to change notification settings - Fork 350
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Can't connect to instance using SA impersonation and Cloud IAM authentication #2338
Comments
Something I find strange is that the cloud-sql-proxy binary seems to connect normally even if I make up the SA EMAIL. Running this command:
Still shows this output:
Obviously |
Thanks for raising this issue @hsuabina 😄 Let me try and reproduce it, the fact |
I've reviewed my setup and while I found an error in the permissions being granted to the SA I'm trying to connect with... fixing it didn't help. Right now I'm trying to simplify the problem and I'm using a credentials key file to authenticate the SA with cloud-sql-proxy. So, basically I'm running with this command, which seems to work:
But then when trying to connect with
The SA has the |
Does the SA also have the Mentioned on our Log in using IAM Database Authentication. If we are missing it somewhere else, let me know and I will update our documentation accordingly. |
I had granted that role earlier instead of Anyway, now the SA has both, yet I'm still unable to connect, same output. |
Here is a summary of the setup, I'm also not redacting names in case I'm missing something:
Then, opening the proxy with this command:
And then trying to connect with psql:
In the proxy logs, there is simply a connection that's closed immediately:
|
Your service account IAM database user's username is not formatted properly, try removing the trailing dot "." from the end. i.e. "my-sa@my-project.iam.gserviceaccount.com" -> "my-sa@my-project.iam" with no dot after "iam" |
Great, I was finally able to connect to the PG DB. Also, I was able to impersonate the SA without the credentials file as well. For the record, these are the key steps I had to take:
Thanks for the help Jack, much appreciated! I'm closing this issue. |
Glad you were able to get it working @hsuabina 👏 👍 Thanks for leaving the detailed steps for future users, they are super useful. I'll add a detailed section to our Google Cloud docs and README for service account impersonation to make life easier 😄 Have a great weekend! |
Bug Description
I'm trying to connect to a Cloud SQL Instance using the cloud-sql-proxy binary with service account impersonation and Cloud IAM authentication in the Cloud SQL side, but I'm unable to get it working.
Example code (or command)
I'm running this command to start the proxy:
The output I get after start the proxy:
Then in another terminal I try to connect to the instance with
psql
running this command:Stacktrace
And in the proxy's terminal I can see this error as well:
Steps to reproduce?
See examples above
Environment
2.14.0+darwin.amd64
Additional Details
Something that I think could be relevant is that the principal I'm using to impersonate the service account has permissions to do so by being member of a Cloud Identity group. It's the group that has the permission to impersonate the service account and the service account what was granted the Cloud SQL Instance user role.
The same principal also has permissions to access the cloud sql instance directly without SA impersonation, because the group it belongs to also was granted the Cloud SQL Instance user role. When trying to connect this way, the connection works without issues.
The idea behind this approach is two support two ways of connecting to the instance:
The text was updated successfully, but these errors were encountered: