Create instances

gcloud

For information about installing and getting started with the gcloud CLI, see Installing gcloud CLI. For information about starting Cloud Shell, see the Cloud Shell documentation.

1. Use the gcloud sql instances create command to create the instance:

For Cloud SQL Enterprise Plus edition instances:

    gcloud sql instances create INSTANCE_NAME \
    --region=REGION \
    --tier=TIER \
    --database-version=DATABASE_VERSION \
    --edition=ENTERPRISE_PLUS
    

For Cloud SQL Enterprise edition instances:

    gcloud sql instances create INSTANCE_NAME \
    --cpu=NUMBER_CPUS \
    --memory=MEMORY_SIZE \
    --region=REGION
    

Or, alternatively, you can use the --tier flag if you choose db-f1-micro or db-g1-small as the machine type:

    gcloud sql instances create INSTANCE_NAME \
      --tier=API_TIER_STRING \
      --region=REGION
  

There are restrictions on the values for vCPUs and memory size:

• vCPUs must be either 1 or an even number between 2 and 96.
• Memory must be:
  • 0.9 to 6.5 GB per vCPU
  • A multiple of 256 MB
  • At least 3.75 GB (3840 MB)

For example, the following command creates a Cloud SQL Enterprise edition instance with two vCPUs and 7,680 MB of memory:

  gcloud sql instances create myinstance \
  --database-version=MYSQL_8_0 \
  --cpu=2 \
  --memory=7680MB \
  --region=us-central1
  

The following command creates a Cloud SQL Enterprise Plus edition instance with four cores:

  gcloud sql instances create myinstance \
  --database-version=MYSQL_8_0_31 \
  --tier=db-perf-optimized-N-4 \
  --edition=ENTERPRISE_PLUS \
  --region=us-central1
  

The default value for REGION is us-central1.

Don't include sensitive or personally identifiable information in your instance name; it is externally visible.
You do not need to include the project ID in the instance name. This is done automatically where appropriate (for example, in the log files).

If you are creating an instance for high availability, you can specify both the primary and secondary zones, using the --zone and --secondary-zone parameters. The following conditions apply when the secondary zone is used during instance creation or edit:

• The zones must be valid zones.
• If the secondary zone is specified, the primary must also be specified.
• If the primary and secondary zones are specified, they must be distinct zones.
• If the primary and secondary zones are specified, they must belong to the same region.

You can add more parameters to determine other instance settings:

Setting	Parameter	Notes
Required parameters
Database version	--database-version	The database version, which is based on your Cloud SQL edition.
Region	--region	See valid values.
Set password policy
Enable password policy	--enable-password-policy	Enables the password policy when used. By default, the password policy is disabled. When disabled using the --clear-password-policy parameter, the other password policy parameters are reset.
Minimum length	--password-policy-min-length	Specifies the minimum number of characters that the password must have.
Password complexity	--password-policy-complexity	Enables the password complexity check to ensure that the password contains one of each of these types of characters: lowercase, uppercase, numeric, and non-alphanumeric. Set the value to COMPLEXITY_DEFAULT.
Restrict password reuse	--password-policy-reuse-interval	Specifies the number of previous passwords that you can't reuse. Supported only on Cloud SQL for MySQL 8.0 and later.
Disallow username	--password-policy-disallow-username-substring	Prevents the use of the username in the password. Use the --no-password-policy-disallow-username-substring parameter to disable the check.
Connectivity
Managed Connection Pooling	--enable-connection-pooling	Enables Managed Connection Pooling in the new instance. You can configure advanced Managed Connection Pooling settings after your instance is created. Note: This feature is only available for Cloud SQL Enterprise Plus edition instances that are configured to meet Managed Connection Pooling requirements.
Private IP	--network --no-assign-ip (optional) --allocated-ip-range-name (optional) --enable-google-private-path (optional)	--network: Specifies the name of the VPC network you want to use for this instance. Private services access must already be configured for the network. Available only for the beta command (gcloud beta sql instances create). --no-assign-ip: Instance will only have a private IP address. --allocated-ip-range-name: If specified, sets a range name for which an IP range is allocated. For example, google-managed-services-default. The range name should comply with RFC-1035 and be within 1-63 characters. (gcloud alpha sql instances create). --enable-google-private-path: If you use this parameter, then you allow other Google Cloud services, such as BigQuery, to access data in Cloud SQL and make queries against this data over a private connection. This parameter is valid only if: You use the --no-assign-ip parameter. You use the --network parameter to specify the name of the VPC network that you want to use to create a private connection.
Data API Access	--data-api-access	Controls connectivity to the instance using Data API. It's disallowed by default. Set the value to ALLOW_DATA_API to let users use the Data API to connect to the instance. For instances configured with a private IP address only, authorized users can call the Data API on the instance from the public internet. Set the value to DISALLOW_DATA_API to disallow using the Data API.
Public IP	--authorized-networks	For public IP connections, only connections from authorized networks can connect to your instance. Learn more.
SSL Enforcement	--ssl-mode --require-ssl	The ssl-mode parameter enforces the SSL/TLS enforcement for the connections. For more information, see Settings for Cloud SQL for MySQL. The require-ssl parameter determines whether SSL connections over IP are enforced or not. require-ssl is a legacy parameter. Use ssl-mode instead. For more information, see IpConfiguration.
Server CA mode	--server-ca-mode	The --server-ca-mode flag configures the type of server certificate authority (CA) for an instance. You can select one of the following options: GOOGLE_MANAGED_INTERNAL_CA: this is the default value. With this option, an internal CA dedicated to each Cloud SQL instance signs the server certificate for that instance. GOOGLE_MANAGED_CAS_CA: with this option, a CA hierarchy consisting of a root CA and subordinate server CAs managed by Cloud SQL and hosted on Google Cloud Certificate Authority Service (CA Service) is used. The subordinate server CAs in a region sign the server certificates and are shared across instances in the region. This option is supported only on MySQL 8.0.30 and later. CUSTOMER_MANAGED_CAS_CA: with this option, you define the CA hierarchy and manage the rotation of the CA certificates. You create a CA pool in CA Service in the same region of your instance. One of the CAs in the pool is used to sign the server certificate. This option is supported only on MySQL 8.0.30 and later. For more information, see Use a customer-managed CA.
Automatic server certificate rotation	--server-certificate-rotation-mode	The --server-certificate-rotation-mode flag configures the type of server certificate rotation mode of the instance. You can select one of the following options: NO_AUTOMATIC_ROTATION: this is the default value. With this option, there won't be no automatic server certificate rotation. Server certificates must be rotated manually. AUTOMATIC_ROTATION_DURING_MAINTENANCE: With this option, automatic server certificate rotation is enabled during Cloud SQL scheduled maintenance or self-service maintenance updates. Requires server_ca_mode to be GOOGLE_MANAGED_CAS_CA or CUSTOMER_MANAGED_CAS_CA.
Network architecture	--enforce-new-sql-network-architecture	Enforce the use of the new network architecture for the instance upon creation. Using this flag when you create an instance before that project has been fully upgraded to the new network architecture can lead to IP address overconsumption or a failure to create instances if there aren't sufficient IP addresses remaining in the allocated IP range. For more information, see Upgrade an instance to the new network architecture and Allocate an IP address range.
Machine type and storage
Machine type	--tier	Used to specify a shared-core instance (db-f1-micro or db-g1-small). For a custom instance configuration, use the --cpu or --memory parameters instead. See Custom instance configuration.
Storage type	--storage-type	Determines whether your instance uses SSD or HDD storage. Learn more.
Storage capacity	--storage-size	The amount of storage provisioned for the instance, in GB. Learn more.
Automatic storage increase	--storage-auto-increase	Determines whether Cloud SQL automatically provides more storage for your instance when free space runs low. Learn more.
Automatic storage increase limit	--storage-auto-increase-limit	Determines how large Cloud SQL can automatically grow storage. Available only for the beta command (gcloud beta sql instances create). Learn more.
Data cache (optional)	--enable-data-cache	Enables or deactivates the data cache for instances. For more information, see data cache.
Automatic backups and high availability
High availability	--availability-type	For a highly-available instance, set to REGIONAL. Learn more.
Secondary zone	--secondary-zone	If you're creating an instance for high availability, you can specify both the primary and secondary zones using the --zone and --secondary-zone parameters. The following restrictions apply when the secondary zone is used during instance creation or edit: The zones must be valid zones. If the secondary zone is specified, the primary must also be specified. If the primary and secondary zones are specified, they must be distinct zones. If the primary and secondary zones are specified, they must belong to the same region.
Automatic backups	--backup-start-time	The window of time when you would like backups to start. Learn more.
Retention settings for automated backups	--retained-backups-count	The number of automated backups to retain. Learn more.
Binary logging	--enable-bin-log	Binary logging enables replication and point-in-time recovery. Learn more.
Retention settings for binary logging	--retained-transaction-log-days	The number of days to retain binary logs for point-in-time recovery. Learn more.
Point-in-time recovery	--enable-point-in-time-recovery	Enables point-in-time recovery and write-ahead logging. Learn more.
Add database flags
Database flags	--database-flags	You can use database flags to control settings and parameters for your instance. Learn more about database flags. Learn more about how to format this parameter.
Maintenance schedule
Maintenance window	--maintenance-window-day, --maintenance-window-hour	Determines a one-hour window when Cloud SQL can perform disruptive maintenance on your instance. If you don't set the window, then disruptive maintenance can be done at any time. Learn more.
Maintenance timing	--maintenance-release-channel	Your preferred timing for instance updates, relative to other instances in the same project. Use preview for earlier updates, and production for later updates. Learn more.
Automatic minor version upgrade
Enable automatic minor version upgrade	--enable-auto-upgrade-minor-version	For MySQL 8.0 instances that you specify a minor version of 8.0.35 or later, for example --database-version=MYSQL_8_0_35. Enable automatic minor version upgrades to the default minor version of Cloud SQL for MySQL 8.0 during each regular scheduled maintenance update. If you create your instance without specifying a minor version (--database-version=MYSQL_8_0), then automatic minor version upgrades are enabled for your instance by default.
Custom SAN
Add a custom subject alternative name (SAN)	--custom-subject-alternative-names=DNS_NAMES	If you want to use a custom DNS name to connect to a Cloud SQL instance instead of using an IP address, then configure the custom subject alternative name (SAN) setting while creating the instance. The custom DNS name that you insert into the custom SAN setting is added to the SAN field of the server certificate of the instance. This lets you use the custom DNS name with hostname validation securely. Before you can use the custom DNS name in your clients and applications, you must set up the mapping between the DNS name and the IP address. This is known as DNS resolution. You can add a comma-separated list of up to three custom DNS names to the custom SAN setting.

2. Note the automatically assigned IP address.

   If you are not using the Cloud SQL Auth Proxy, you will use this address as the host address that your applications or tools use to connect to the instance.

3. Set the password for the "root@%" MySQL user:

         gcloud sql users set-password root \
         --host=% \
         --instance INSTANCE_NAME \
         --password PASSWORD
         

Terraform

To create an instance, use a Terraform resource.

resource "google_sql_database_instance" "mysql_pvp_instance_name" {
  name             = "mysql-pvp-instance-name"
  region           = "asia-northeast1"
  database_version = "MYSQL_8_0"
  root_password    = "abcABC123!"
  settings {
    tier = "db-f1-micro"
    password_validation_policy {
      min_length                  = 6
      complexity                  = "COMPLEXITY_DEFAULT"
      reuse_interval              = 2
      disallow_username_substring = true
      enable_password_policy      = true
    }
  }
  # set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
  # use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
  deletion_protection = false
}

Apply the changes

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

Prepare Cloud Shell

1. Launch Cloud Shell.

2. Set the default Google Cloud project where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   export GOOGLE_CLOUD_PROJECT=PROJECT_ID

   Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (also called a root module).

1. In Cloud Shell, create a directory and a new file within that directory. The filename must have the .tf extension—for example main.tf. In this tutorial, the file is referred to as main.tf.

   mkdir DIRECTORY && cd DIRECTORY && touch main.tf

2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly created main.tf.

   Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   terraform init

   Optionally, to use the latest Google provider version, include the -upgrade option:

   terraform init -upgrade

Apply the changes

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   terraform plan

   Make corrections to the configuration as necessary.

2. Apply the Terraform configuration by running the following command and entering yes at the prompt:

   terraform apply

   Wait until Terraform displays the "Apply complete!" message.

3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

Delete the changes

To delete your changes, do the following:

1. To disable deletion protection, in your Terraform configuration file set the deletion_protection argument to false.

   deletion_protection =  "false"

2. Apply the updated Terraform configuration by running the following command and entering yes at the prompt:

   terraform apply

3. Remove resources previously applied with your Terraform configuration by running the following command and entering yes at the prompt:

   terraform destroy

REST v1

Create the instance

This example creates an instance. Some optional parameters, such as backups and binary logging are also included. For a complete list of parameters for this call, see the Instances:insert page. For information about instance settings, including valid values for region, see Instance settings.

Don't include sensitive or personally identifiable information in your instance ID; it is externally visible.
You do not need to include the project ID in the instance name. This is done automatically where appropriate (for example, in the log files).

Before using any of the request data, make the following replacements:

• PROJECT_ID: your project ID
• INSTANCE_ID: your instance ID
• DATABASE_VERSION: the database version. For example: MYSQL_8_4 or MYSQL_8_0_37. If you don't specify a database version, the default database version is MYSQL_8_4.
• REGION: the region
• MACHINE_TYPE: your machine type
• EDITION_TYPE: your Cloud SQL edition
• DATA_CACHE_ENABLED: (optional) set to true to enable data cache for your instance
• PRIVATE_NETWORK: specify the name of the Virtual Private Cloud (VPC) network that you want to use for this instance. Private services access must already be configured for the network.
• AUTHORIZED_NETWORKS: For public IP connections, specify the connections from authorized networks that can connect to your instance.
• CA_MODE: specify a certificate authority hierarchy for the instance, either GOOGLE_MANAGED_INTERNAL_CA or GOOGLE_MANAGED_CAS_CA. If you don't specify serverCaMode, then the default configuration is GOOGLE_MANAGED_INTERNAL_CA. This feature is in Preview.
• SERVER_CERTIFICATE_ROTATION_MODE: For automatic server certificate rotation for your instance, specify AUTOMATIC_ROTATION_DURING_MAINTENANCE. If you don't specify serverCertificateRotationMode, then the default configuration is NO_AUTOMATIC_ROTATION.
• DNS_NAMES: add a comma-separated list of up to three DNS names to the server certificate of your Cloud SQL instance. You can secure multiple DNS names with a single certificate. This feature is available in Preview and for CUSTOMER_MANAGED_CAS_CA instances only.

To set a password policy while creating an instance, include the passwordValidationPolicy object in the request. Set the following parameters, as required:

• enablePasswordPolicy: Enables the password policy when set to true.

  To remove the password policy, you can use a PATCH request with null as the value for enablePasswordPolicy. In this case, the other password policy parameters are reset.

• minLength: Specifies the minimum number of characters that the password must have.
• complexity: Checks if the password is a combination of lowercase, uppercase, numeric, and non-alphanumeric characters. The default value is COMPLEXITY_DEFAULT.
• reuseInterval: Specifies the number of previous passwords that you can't reuse.

  Supported only on Cloud SQL for MySQL 8.0 and later.

• disallowUsernameSubstring: Prevents the use of the username in the password when set to true.

You can use the sqlNetworkArchitecture field to enforce the use of the new network architecture for the instance upon creation, even if the project isn't fully upgraded. For more details about the new network architecture and its implications, see Upgrade an instance to the new network architecture and Allocate an IP address range.

HTTP method and URL:

POST https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances

Request JSON body:

{
  "name": "INSTANCE_ID",
  "region": "REGION",
  "databaseVersion": "DATABASE_VERSION",
  "settings": {
    "tier": "MACHINE_TYPE",
    "edition": "EDITION_TYPE",
    "dataCacheConfig": {
      "dataCacheEnabled": DATA_CACHE_ENABLED
    },
    "backupConfiguration": {
      "binaryLogEnabled": true,
      "enabled": true
    },
    "passwordValidationPolicy": {
      "enablePasswordPolicy": true
      "minLength": "MIN_LENGTH",
      "complexity": COMPLEXITY_DEFAULT,
      "reuseInterval": "REUSE_INTERVAL",
      "disallowUsernameSubstring": "DISALLOW_USERNAME_SUBSTRING"
    },
    "ipConfiguration": {
      "privateNetwork": "PRIVATE_NETWORK",
      "authorizedNetworks": [AUTHORIZED_NETWORKS],
      "ipv4Enabled": false,
      "enablePrivatePathForGoogleCloudServices": true,
      "serverCaMode": "CA_MODE",
      "serverCertificateRotationMode": "SERVER_CERTIFICATE_ROTATION_MODE",
      "customSubjectAlternativeNames": "DNS_NAMES"
    },
    "dataApiAccess": "ALLOW_DATA_API"
  },
  "sqlNetworkArchitecture": "NEW_NETWORK_ARCHITECTURE"
}

To send your request, expand one of these options:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2019-09-25T22:19:33.735Z",
  "operationType": "CREATE",
  "name": "OPERATION_ID",
  "targetId": "INSTANCE_ID",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/operations/OPERATION_ID",
  "targetProject": "PROJECT_ID"
}

The response is a long-running operation, which might take a few minutes to complete.

Update the root password

When the instance finishes initializing, update the root password:

Before using any of the request data, make the following replacements:

• project-id: your project ID
• instance-id: instance ID created in prior step
• root-password: desired root password

HTTP method and URL:

PUT https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/users?host=%25&name=root

Request JSON body:

{
  "name": "root",
  "host": "%",
  "password": "root-password"
}

To send your request, expand one of these options:

curl -X PUT \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/users?host=%25&name=root"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method PUT `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id/users?host=%25&name=root" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id",
  "status": "DONE",
  "user": "user@example.com",
  "insertTime": "2019-09-26T14:32:30.592Z",
  "startTime": "2019-09-26T14:32:30.594Z",
  "endTime": "2019-09-26T14:32:33.518Z",
  "operationType": "UPDATE_USER",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

Retrieve the IPv4 address

Retrieve the automatically assigned IPv4 address for the new instance:

Before using any of the request data, make the following replacements:

• project-id: your project ID
• instance-id: instance ID created in prior step

HTTP method and URL:

GET https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id

To send your request, expand one of these options:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#instance",
  "state": "RUNNABLE",
  "databaseVersion": "MYSQL_8_0_18",
  "settings": {
    "authorizedGaeApplications": [],
    "tier": "db-f1-micro",
    "kind": "sql#settings",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration": {
      "authorizedNetworks": [],
      "ipv4Enabled": true
    },
    "locationPreference": {
      "zone": "us-west1-a",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "backupConfiguration": {
      "startTime": "18:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "1",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  },
  "etag": "--redacted--",
  "ipAddresses": [
    {
      "type": "PRIMARY",
      "ipAddress": "10.0.0.1"
    }
  ],
  "serverCaCert": {
    ...
  },
  "instanceType": "CLOUD_SQL_INSTANCE",
  "project": "project-id",
  "serviceAccountEmailAddress": "redacted@gcp-sa-cloud-sql.iam.gserviceaccount.com",
  "backendType": "SECOND_GEN",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id",
  "connectionName": "project-id:region:instance-id",
  "name": "instance-id",
  "region": "us-west1",
  "gceZone": "us-west1-a"
}

Look for the ipAddress field in the response.

REST v1beta4

Create the instance

This example creates an instance. Some optional parameters, such as backups and binary logging are also included. For a complete list of parameters for this call, see the instances:insert page. For information about instance settings, including valid values for region, see Instance settings

Don't include sensitive or personally identifiable information in your instance ID; it is externally visible.
You do not need to include the project ID in the instance name. This is done automatically where appropriate (for example, in the log files).

You can use the sqlNetworkArchitecture field to enforce the use of the new network architecture for the instance upon creation, even if the project isn't fully upgraded. For more details about the new network architecture and its implications, see Upgrade an instance to the new network architecture and Allocate an IP address range.

Before using any of the request data, make the following replacements:

• PROJECT_ID: your project ID
• INSTANCE_ID: your instance ID
• DATABASE_VERSION: the database version. For example: MYSQL_8_4 or MYSQL_8_0_37. If you don't specify a database version, the default database version is MYSQL_8_4.
• REGION: the region
• MACHINE_TYPE: your machine type
• EDITION_TYPE: your Cloud SQL edition .
• DATA_CACHE_ENABLED: (optional) set to true to enable data cache for your instance
• PRIVATE_NETWORK: specify the name of the Virtual Private Cloud (VPC) network that you want to use for this instance. Private services access must already be configured for the network.
• AUTHORIZED_NETWORKS: For public IP connections, specify the connections from authorized networks that can connect to your instance.
• CA_MODE: specify a certificate authority hierarchy for the instance, either GOOGLE_MANAGED_INTERNAL_CA or GOOGLE_MANAGED_CAS_CA. If you don't specify serverCaMode, then the default configuration is GOOGLE_MANAGED_INTERNAL_CA. This feature is in Preview.
• SERVER_CERTIFICATE_ROTATION_MODE: For automatic server certificate rotation for your instance, specify AUTOMATIC_ROTATION_DURING_MAINTENANCE. If you don't specify serverCertificateRotationMode, then the default configuration is NO_AUTOMATIC_ROTATION.
• DNS_NAMES: add a comma-separated list of up to three DNS names to the server certificate of your Cloud SQL instance. You can secure multiple DNS names with a single certificate. This feature is available in Preview and for CUSTOMER_MANAGED_CAS_CA instances only.

To set a password policy while creating an instance, include the passwordValidationPolicy object in the request. Set the following parameters, as required:

• enablePasswordPolicy: Enables the password policy when set to true.

  To remove the password policy, you can use a PATCH request with null as the value for enablePasswordPolicy. In this case, the other password policy parameters are reset.

• minLength: Specifies the minimum number of characters that the password must have.
• complexity: Checks if the password is a combination of lowercase, uppercase, numeric, and non-alphanumeric characters. The default value is COMPLEXITY_DEFAULT.
• reuseInterval: Specifies the number of previous passwords that you can't reuse.

  Supported only on Cloud SQL for MySQL 8.0 and later.

• disallowUsernameSubstring: Prevents the use of the username in the password when set to true.

HTTP method and URL:

POST https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances

Request JSON body:

{
  "name": "INSTANCE_ID",
  "region": "REGION",
  "databaseVersion": "DATABASE_VERSION",
  "settings": {
    "tier": "MACHINE_TYPE",
    "edition": "EDITION_TYPE",
    "dataCacheConfig" {
      "dataCacheEnabled": DATA_CACHE_ENABLED
    },
    "backupConfiguration": {
      "binaryLogEnabled": true,
      "enabled": true
    },
    "passwordValidationPolicy": {
      "enablePasswordPolicy": true
      "minLength": "MIN_LENGTH",
      "complexity": COMPLEXITY_DEFAULT,
      "reuseInterval": "REUSE_INTERVAL",
      "disallowUsernameSubstring": "DISALLOW_USERNAME_SUBSTRING",
    },
    "ipConfiguration": {
      "privateNetwork": "PRIVATE_NETWORK",
      "authorizedNetworks": [AUTHORIZED_NETWORKS],
      "ipv4Enabled": false,
      "enablePrivatePathForGoogleCloudServices": true,
      "serverCaMode": "CA_MODE",
      "serverCertificateRotationMode": "SERVER_CERTIFICATE_ROTATION_MODE",
      "customSubjectAlternativeNames": "DNS_NAMES"
    },
    "dataApiAccess": "ALLOW_DATA_API"
  },
  "sqlNetworkArchitecture": "NEW_NETWORK_ARCHITECTURE"
}

To send your request, expand one of these options:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2019-09-25T22:19:33.735Z",
  "operationType": "CREATE",
  "name": "OPERATION_ID",
  "targetId": "INSTANCE_ID",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/operations/OPERATION_ID",
  "targetProject": "PROJECT_ID"
}

The response is a long-running operation, which might take a few minutes to complete.

Update the root password

When the instance finishes initializing, update the root password:

Before using any of the request data, make the following replacements:

• project-id: your project ID
• instance-id: instance ID created in prior step
• root-password: desired root password

HTTP method and URL:

PUT https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/users?host=%25&name=root

Request JSON body:

{
  "name": "root",
  "host": "%",
  "password": "root-password"
}

To send your request, expand one of these options:

curl -X PUT \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/users?host=%25&name=root"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method PUT `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id/users?host=%25&name=root" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "status": "DONE",
  "user": "user@example.com",
  "insertTime": "2019-09-26T14:32:30.592Z",
  "startTime": "2019-09-26T14:32:30.594Z",
  "endTime": "2019-09-26T14:32:33.518Z",
  "operationType": "UPDATE_USER",
  "name": "operation-id",
  "targetId": "instance-id",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/operations/operation-id",
  "targetProject": "project-id"
}

The response is a long-running operation, which might take a few minutes to complete.

Retrieve the IPv4 address

Retrieve the automatically assigned IPv4 address for the new instance:

Before using any of the request data, make the following replacements:

• project-id: your project ID
• instance-id: instance ID created in prior step

HTTP method and URL:

GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

To send your request, expand one of these options:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#instance",
  "state": "RUNNABLE",
  "databaseVersion": "MYSQL_8_0_18",
  "settings": {
    "authorizedGaeApplications": [],
    "tier": "db-f1-micro",
    "kind": "sql#settings",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration": {
      "authorizedNetworks": [],
      "ipv4Enabled": true
    },
    "locationPreference": {
      "zone": "us-west1-a",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "backupConfiguration": {
      "startTime": "18:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "1",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  },
  "etag": "--redacted--",
  "ipAddresses": [
    {
      "type": "PRIMARY",
      "ipAddress": "10.0.0.1"
    }
  ],
  "serverCaCert": {
    ...
  },
  "instanceType": "CLOUD_SQL_INSTANCE",
  "project": "project-id",
  "serviceAccountEmailAddress": "redacted@gcp-sa-cloud-sql.iam.gserviceaccount.com",
  "backendType": "SECOND_GEN",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "connectionName": "project-id:region:instance-id",
  "name": "instance-id",
  "region": "us-west1",
  "gceZone": "us-west1-a"
}

Look for the ipAddress field in the response.