At a glance
| Product type | Authentication and TLS proxy for Cloud SQL; not a pooler or load balancer |
| Supported databases | Cloud SQL for MySQL, PostgreSQL and SQL Server |
| Pooling modes | None; Google documents that the proxy does not pool connections |
| Routing and read/write splitting | No; each instance connection name maps to one local listener |
| Load balancing and failover | No load balancing; failover is handled by Cloud SQL high availability behind the same instance |
| Authentication and TLS | IAM authorisation, TLS 1.3, optional automatic IAM database authentication (MySQL and PostgreSQL) |
| Deployment | Binary or container next to the app, Kubernetes sidecar, or as a persistent service |
| Licensing | Apache 2.0; no charge for the proxy, Cloud SQL is billed |
Run the Cloud SQL Auth Proxy when you want IAM-controlled, encrypted connections to Cloud SQL without managing SSL certificates or authorised IP lists, for example from a laptop, a VM outside Google Cloud or a Kubernetes pod. It does not pool connections or balance load; add PgBouncer or Cloud SQL Managed Connection Pooling for that, and consider the in-process Language Connectors for Java, Python, Go and Node.js.
Overview
The Cloud SQL Auth Proxy is a small program you run next to your application. The application connects to it on localhost (or a Unix socket); the proxy checks the caller's IAM permissions, opens an encrypted TLS 1.3 tunnel to the Cloud SQL instance and manages the short-lived certificates on both ends. It does not create a network path: it uses the instance's existing public IP, private IP (--private-ip) or other connectivity. With --auto-iam-authn it can also log in to MySQL and PostgreSQL using IAM database authentication, refreshing OAuth 2.0 tokens for you.
Google states plainly that the proxy does not provide connection pooling, and the README suggests a pooler such as PgBouncer or ProxySQL for large deployments. Cloud SQL Language Connectors for Java, Python, Go and Node.js do the same job inside the application process, and Google recommends them over the proxy for those languages. Version 2 (v2.27.0, 29 October 2026) is the current line, with a migration guide for v1 users. For Cloud SQL itself, see Google Cloud SQL; the AWS counterpart for pooling is Amazon RDS Proxy, which is a different kind of tool.
Key features
- IAM-based authorisation for who can connect, without authorised networks
- TLS 1.3 encryption with automatic certificate management
- Automatic IAM database authentication for MySQL and PostgreSQL (--auto-iam-authn)
- Public IP or private IP connections (--private-ip), over TCP or Unix sockets (not on Windows)
- Prometheus metrics (--prometheus) and HTTP health checks for Kubernetes probes
- Prebuilt binaries for Linux, macOS and Windows, and container images in Artifact Registry
Integrations and ecosystem
Pros and cons
Pros
- Removes the need to manage SSL certificates and IP allowlists for Cloud SQL
- Access is controlled through IAM roles rather than network rules
- Works from outside Google Cloud as well as from GKE and Compute Engine
- Open source with frequent releases
Cons
- No connection pooling, load balancing or read/write splitting
- Works only with Cloud SQL, not other PostgreSQL or MySQL hosts
- Admin API calls count against the project quota; very large fleets may hit quota errors
- Unix sockets are not supported on Windows, and automatic IAM authentication does not cover SQL Server
Pricing
The proxy binary and container images are free and open source under Apache 2.0, and Google charges nothing for the proxy itself. It is only useful with a Cloud SQL instance, which is billed under Cloud SQL pricing, so it is listed here as Paid. The proxy calls the Cloud SQL Admin API (about two calls per hour per connected instance, per Google), which counts against the project's API quota.
Pricing checked on the vendor's official page on 7 November 2026. Prices change; confirm before buying.
Who it is best for
Teams on Google Cloud SQL that want secure, IAM-controlled connections from tools, VMs, Kubernetes pods or developer laptops without handling certificates.
Typical use cases
- Connecting a desktop SQL client to a Cloud SQL instance over a public IP without an IP allowlist
- Running as a sidecar in GKE so pods reach Cloud SQL with workload IAM identities
- Logging in with IAM database users instead of stored passwords (MySQL and PostgreSQL)
- Securing connections from on-premises or other-cloud servers to Cloud SQL
Who should look elsewhere
- Fixing connection exhaustion: use a pooler such as PgBouncer or Cloud SQL Managed Connection Pooling (Enterprise Plus edition, PostgreSQL).
- Databases outside Cloud SQL, where a general proxy such as HAProxy or a database access platform fits better.
Verdict
The Cloud SQL Auth Proxy is the standard way to reach Cloud SQL securely without certificate and allowlist management, and it costs nothing beyond the instance. Treat it as an authentication and encryption layer only: it does not reduce connection counts, so combine it with a pooler when connections are the problem, and prefer a Language Connector when your application language has one.
Frequently asked questions
Does the Cloud SQL Auth Proxy pool connections?
No. Google's documentation says it does not provide connection pooling. Use PgBouncer or ProxySQL alongside it, or Cloud SQL Managed Connection Pooling, which requires an Enterprise Plus edition instance and is documented for Cloud SQL for PostgreSQL.
Proxy or Language Connector?
For Java, Python, Go and Node.js applications Google offers Cloud SQL Language Connectors that provide the same IAM authorisation and encryption inside the application, without a separate process. The proxy suits other languages, tools and desktop clients.
Do I need the proxy for private IP?
No. The proxy can connect over private IP if it runs where the VPC is reachable, but it is not required; Google's Cloud SQL guidance for private IP is a direct connection with SSL enforced.
Is it the same as Amazon RDS Proxy?
No. RDS Proxy is a managed connection pooler for RDS and Aurora. The Cloud SQL Auth Proxy is a client-side authentication and TLS tunnel that does not pool connections.
Sources
- Google Cloud: About the Cloud SQL Auth Proxy
- Google Cloud: Cloud SQL Language Connectors
- Google Cloud: Managed Connection Pooling
- cloud-sql-proxy GitHub repository (README)
- cloud-sql-proxy releases
Checked November 2026.
Listed in: Database Proxy & Connection Pooling.
How we research reviews and what star ratings mean: our editorial method.