Which permission is needed to configure GCP Cloud SQL meintenance notification settings?

user_13914809 0
Viewed 106

In GCP Cloud SQL, the instance sometimes will have to reboot for maintenance. The doc mentions we can receive a maintenance notification email.

However, I cannot enable it even if I follow the instruction. The setting page I am referring to is this.

In the setting page I can choose the project but the production project I want to configure doesn't show up in the list. However, other projects such as development or staging are shown up. Our organization configures IAM settings to prevent employees to see the real production data. So I guess I don't have enough permission to configure it.

I already obtained cloudsql.editor for the production project but I still don't see the project in the list.

The problem is I don't know which permission is exactly needed to set up the CloudSQL maintenance notification. I don't find it is mentioned in the doc. Does someone know which permission I still need?

google-cloud-iam google-cloud-sql google-cloud-platform
1 Answers

Role you mentioned is not enough to use Cloud SQL. To be able to administer this feature you need (besides having cloudsql.editor role) some roles that are required for general GCP use such as:

  • resourcemanager.projects.get
  • resourcemanager.projects.list
  • serviceusage.quotas.get
  • serviceusage.services.get
  • serviceusage.services.use

Have a look at the documentation describing roles for Cloud SQL use; it describes all the permissions that you need to perform specific tasks.

To check if you have those for the production project run this gcloud command:

gcloud projects get-iam-policy <YOUR GCLOUD PROJECT>  \
--flatten="bindings[].members" \
--format='table(bindings.role)' \
--filter="bindings.members:<YOUR SERVICE ACCOUNT>"
user_122572500
Related