如何创建 GCP Cloud SQL IAM 用户

Question

这里的第一个答案是有关如何为您的 Google Platform Cloud SQL 实例创建 Cloud SQL IAM 用户的指南。

Here is a guide on how to connect after you've created the user.

Answer 1

1. 点击“编辑“在您的实例上部工具栏上。转到“旗帜“并设置”云 sql.iam 身份验证“ 至 ”上“
   2. 转到“用户“左侧导航窗格中的选项卡 > 单击“添加用户帐户“
   3. 在主体字段中使用人员的 GCP 电子邮件地址。任何人都可以创建此帐户，但只有 IAM 编辑才能更改 IAM 权限。 IAM 权限影响 GCP 对象，而不是数据库对象。无需设置IAM权限即可连接数据库.
   4. 使用实例IP地址和postgres用户连接到数据库。使用此用户，我们可以将权限分配为IAM 用户创建时对数据库对象的权限为零.

   grant connect on database database_name to "username@email.com";
   
   -- Grant usage on current objects in a schema
   grant all on SCHEMA schema_name to "username@email.com";
   grant all on all TABLES in SCHEMA schema_name to "username@email.com";
   grant all on all FUNCTIONS IN SCHEMA schema_name to "username@email.com";
   grant all on all PROCEDURES IN SCHEMA schema_name to "username@email.com";
   grant all on all ROUTINES IN SCHEMA schema_name to "username@email.com";
   grant all on all SEQUENCES IN SCHEMA schema_name to "username@email.com";
   
   -- Grant usage of any newly created objects in the future
   ALTER DEFAULT PRIVILEGES IN SCHEMA schema_name GRANT all ON FUNCTIONS TO "username@email.com";
   ALTER DEFAULT PRIVILEGES IN SCHEMA schema_name GRANT all ON ROUTINES TO "username@email.com";
   ALTER DEFAULT PRIVILEGES IN SCHEMA schema_name GRANT all ON SEQUENCES TO "username@email.com";
   ALTER DEFAULT PRIVILEGES IN SCHEMA schema_name GRANT all ON TABLES TO "username@email.com";
   ALTER DEFAULT PRIVILEGES IN SCHEMA schema_name GRANT all ON types TO "username@email.com";
   

   5. 通过更改会话测试用户权限

   set session authorization "username@email.com";
   

   • 重置回来

   reset session authorization;
   

   6. Now you can connect to the database using the IAM details and Cloud SQL Proxy

Answer 2

问题：是否可以通过 Terraform 向云 IAM 用户和服务帐户授予所需的权限？如果这些可以通过 TF 进行管理和跟踪，那就太好了，它比登录数据库和运行 SQL 命令具有更好的可见性......