{"id":51508221,"url":"https://github.com/boozt-platform/terraform-google-cloud-sql-iam","last_synced_at":"2026-07-08T03:02:08.529Z","repository":{"id":365708152,"uuid":"1273241744","full_name":"boozt-platform/terraform-google-cloud-sql-iam","owner":"boozt-platform","description":"Terraform module to manage Cloud SQL (MySQL \u0026 PostgreSQL) database users and grants using IAM database authentication, with automatic engine detection.","archived":false,"fork":false,"pushed_at":"2026-06-18T13:14:26.000Z","size":39,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-18T15:16:13.011Z","etag":null,"topics":["cloud-sql","database","gcp","google-cloud","iam","mysql","opentofu","postgresql","terraform","terraform-module"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/boozt-platform/cloud-sql-iam/google/latest","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/boozt-platform.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"docs/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"docs/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"docs/CODEOWNERS","security":"docs/SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-18T10:35:53.000Z","updated_at":"2026-06-18T13:15:01.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/boozt-platform/terraform-google-cloud-sql-iam","commit_stats":null,"previous_names":["boozt-platform/terraform-google-cloud-sql-iam"],"tags_count":2,"template":false,"template_full_name":"boozt-platform/quickstart-template","purl":"pkg:github/boozt-platform/terraform-google-cloud-sql-iam","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/boozt-platform%2Fterraform-google-cloud-sql-iam","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/boozt-platform%2Fterraform-google-cloud-sql-iam/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/boozt-platform%2Fterraform-google-cloud-sql-iam/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/boozt-platform%2Fterraform-google-cloud-sql-iam/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/boozt-platform","download_url":"https://codeload.github.com/boozt-platform/terraform-google-cloud-sql-iam/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/boozt-platform%2Fterraform-google-cloud-sql-iam/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35249883,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-08T02:00:06.796Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloud-sql","database","gcp","google-cloud","iam","mysql","opentofu","postgresql","terraform","terraform-module"],"created_at":"2026-07-08T03:02:07.392Z","updated_at":"2026-07-08T03:02:08.520Z","avatar_url":"https://github.com/boozt-platform.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003c!-- markdownlint-disable MD013 MD041 --\u003e\n\u003ca href=\"https://github.com/boozt-platform/terraform-google-cloud-sql-iam\"\u003e\n  \u003cimg src=\"https://raw.githubusercontent.com/boozt-platform/branding/main/assets/img/platform-logo.png\" alt=\"Boozt Platform\" /\u003e\n\u003c/a\u003e\n\u003c!-- markdownlint-enable MD013 --\u003e\n\n[![GitHub tag (latest SemVer)](https://img.shields.io/github/v/tag/boozt-platform/terraform-google-cloud-sql-iam.svg?label=latest\u0026sort=semver)](https://github.com/boozt-platform/terraform-google-cloud-sql-iam/releases)\n[![license](https://img.shields.io/badge/license-mit-brightgreen.svg)](./LICENSE)\n[![Terraform](https://img.shields.io/badge/Terraform-%3E%3D1.6.0-blue.svg)](https://www.terraform.io/)\n[![OpenTofu](https://img.shields.io/badge/OpenTofu-%3E%3D1.6.0-blue.svg)](https://opentofu.org/)\n\n# Terraform Google Cloud SQL IAM\n\nTerraform module to manage database users and their grants on Google Cloud SQL\ninstances using **IAM database authentication**. It supports both **MySQL** and\n**PostgreSQL** and selects the right engine automatically, exposing a single,\nengine-agnostic interface.\n\n## Table of Contents\n\n- [Features](#features)\n- [Engine auto-detection](#engine-auto-detection)\n- [Prerequisites](#prerequisites)\n- [Usage](#usage)\n- [PostgreSQL specifics](#postgresql-specifics)\n- [Validation rules](#validation-rules)\n- [Known limitations](#known-limitations)\n- [Examples](#examples)\n- [Testing](#testing)\n- [Terraform docs](#terraform-docs)\n- [About Boozt](#about-boozt)\n- [Reporting Issues](#reporting-issues)\n- [Contributing](#contributing)\n- [License](#license)\n\n## Features\n\n- **One interface, two engines** - the same `user_grants` / `configuration`\n  inputs work for MySQL and PostgreSQL.\n- **Engine auto-detection** - reads the instance `database_version` and routes\n  to the correct sub-module; callers never specify the engine.\n- **IAM database authentication** - manages `CLOUD_IAM_USER`,\n  `CLOUD_IAM_SERVICE_ACCOUNT` and `CLOUD_IAM_GROUP` users.\n- **Fine-grained grants** - database-level, table-level\n  (`database.table` / `database.schema.table`) and, for PostgreSQL,\n  schema-level (`CREATE` / `USAGE`) privileges, plus role memberships.\n- **Least privilege guardrails** - input validation forbids wildcard databases\n  for regular IAM users.\n\n## Engine auto-detection\n\nThe module reads the instance's `database_version` via a\n`google_sql_database_instance` data source and routes to the MySQL or\nPostgreSQL sub-module accordingly. Both the `mysql` and `postgresql` providers\nare declared internally, but each engine's resources are gated on the detected\nengine and both providers connect lazily, so the provider for the unused engine\nnever opens a connection.\n\n## Prerequisites\n\n- The target Cloud SQL instance must have **IAM database authentication\n  enabled** (`cloudsql.iam_authentication = on`).\n- The identity running Terraform/OpenTofu needs:\n  - `cloudsql.instances.get` on the instance (used by the engine-detection\n    data source) — e.g. `roles/cloudsql.viewer`.\n  - The ability to authenticate to the database as the configured\n    `admin_username` with privileges to manage the requested grants.\n- The relevant database(s) must already exist before granting permissions.\n\n## Usage\n\nThis module is published to both the [Terraform Registry][tf-registry] and the\n[OpenTofu Registry][otf-registry]:\n\n```hcl\nmodule \"cloud_sql_iam\" {\n  source  = \"boozt-platform/cloud-sql-iam/google\"\n  version = \"~\u003e 1.1\"\n\n  configuration = {\n    connection_name = \"my-project:europe-west1:my-instance\"\n    admin_username  = \"my-admin\"\n    admin_password  = \"...\" # or a short-lived OAuth2 token when enable_iam = true\n    enable_iam      = false\n  }\n\n  user_grants = [\n    {\n      email     = \"my-service-account@my-project.iam.gserviceaccount.com\"\n      user_type = \"CLOUD_IAM_SERVICE_ACCOUNT\"\n      grants    = { \"*\" = [\"SELECT\", \"INSERT\", \"UPDATE\", \"DELETE\"] }\n    },\n    {\n      # CLOUD_IAM_USER (default) must specify explicit database names.\n      email = \"user1@example.com\"\n      grants = {\n        \"my_application_db\" = [\"SELECT\", \"INSERT\", \"UPDATE\", \"DELETE\"]\n        \"reporting_db\"      = [\"SELECT\"]\n      }\n    }\n  ]\n}\n```\n\nAlternatively, you can source the module directly from GitHub by tag, e.g.\n`source = \"github.com/boozt-platform/terraform-google-cloud-sql-iam?ref=v1.1.0\"`.\n\n## PostgreSQL specifics\n\nWhen the target instance is PostgreSQL, the same inputs apply, with these\nengine differences (all handled by the module):\n\n| Topic | Behavior on PostgreSQL |\n|-------|------------------------|\n| IAM role name | `CLOUD_IAM_USER` / `CLOUD_IAM_GROUP` use the **full email**; `CLOUD_IAM_SERVICE_ACCOUNT` uses the email **without** the `.gserviceaccount.com` suffix (per [Cloud SQL docs](https://cloud.google.com/sql/docs/postgres/iam-logins)). |\n| `grants` | Applied as table privileges on **all tables** of the schema (`public` by default) of each named database. |\n| `table_grants` | Keys may be `database.table` (assumes `public` schema) **or** `database.schema.table`. |\n| `schema_grants` | Schema-level privileges (e.g. `CREATE`, `USAGE`). Keys may be `database` (default schema) or `database.schema`. |\n| `roles` | Applied as cluster-wide role memberships. |\n| Privileges | Passed through verbatim — supply **PostgreSQL-valid** privileges. MySQL-only privileges such as `SHOW DATABASES` or `PROCESS` are not valid. |\n\n## Validation rules\n\nThe `user_grants` variable enforces the following:\n\n| Rule | Description |\n|------|-------------|\n| Unique emails | Each `email` must be unique. |\n| No wildcard database for `CLOUD_IAM_USER` | Regular IAM users must name explicit databases in `grants`, `table_grants` and `schema_grants`; `\"*\"` is rejected. Service accounts and groups may use `\"*\"`. |\n| `table_grants` key format | `database.table` or `database.schema.table`, no empty parts. |\n| `schema_grants` key format | `database` or `database.schema`, no empty parts (PostgreSQL only). |\n\n## Known limitations\n\n- **Provider configuration lives inside the module.** This is required to fan\n  out to a per-user sub-module with `for_each`. As a result, callers cannot\n  currently supply their own `mysql` / `postgresql` provider configuration. A\n  future major version may move provider configuration to the caller; expect a\n  breaking change when that happens.\n- **PostgreSQL grants require ownership/superuser.** Cloud SQL's\n  `cloudsqlsuperuser` is not a true superuser and cannot `GRANT` on objects it\n  does not own. Granting on tables owned by another role must be performed by\n  the owner.\n\n## Examples\n\n- [examples/mysql](./examples/mysql) - Cloud SQL MySQL instance\n- [examples/postgres](./examples/postgres) - Cloud SQL PostgreSQL instance\n\n## Testing\n\nThis module uses Terraform's native testing framework with mock providers (no\nGCP credentials required):\n\n```bash\ntask test\n# or\nterraform test\n```\n\n## Terraform docs\n\n\u003c!-- BEGIN_TF_DOCS --\u003e\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.6.0 |\n| \u003ca name=\"requirement_google\"\u003e\u003c/a\u003e [google](#requirement\\_google) | \u003e= 3.53, \u003c 8.0 |\n| \u003ca name=\"requirement_mysql\"\u003e\u003c/a\u003e [mysql](#requirement\\_mysql) | ~\u003e 3.0 |\n| \u003ca name=\"requirement_postgresql\"\u003e\u003c/a\u003e [postgresql](#requirement\\_postgresql) | ~\u003e 1.22 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_google\"\u003e\u003c/a\u003e [google](#provider\\_google) | \u003e= 3.53, \u003c 8.0 |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_mysql_permissions\"\u003e\u003c/a\u003e [mysql\\_permissions](#module\\_mysql\\_permissions) | ./modules/mysql-instance/ | n/a |\n| \u003ca name=\"module_postgres_permissions\"\u003e\u003c/a\u003e [postgres\\_permissions](#module\\_postgres\\_permissions) | ./modules/postgres-instance/ | n/a |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_user_grants\"\u003e\u003c/a\u003e [user\\_grants](#input\\_user\\_grants) | Map of grants for each users | \u003cpre\u003elist(object({\u003cbr/\u003e    email         = string\u003cbr/\u003e    user_type     = optional(string, \"CLOUD_IAM_USER\")\u003cbr/\u003e    grants        = optional(map(list(string)), {})\u003cbr/\u003e    table_grants  = optional(map(list(string)), {})\u003cbr/\u003e    schema_grants = optional(map(list(string)), {})\u003cbr/\u003e    roles         = optional(map(list(string)), {})\u003cbr/\u003e  }))\u003c/pre\u003e | n/a | yes |\n| \u003ca name=\"input_auth_type\"\u003e\u003c/a\u003e [auth\\_type](#input\\_auth\\_type) | Sets the authentication plugin, it can be one of the following: `native` or `cleartext` | `string` | `\"native\"` | no |\n| \u003ca name=\"input_configuration\"\u003e\u003c/a\u003e [configuration](#input\\_configuration) | Username and password for Cloud SQL instance admin user | \u003cpre\u003eobject({\u003cbr/\u003e    connection_name = string\u003cbr/\u003e    admin_username  = string\u003cbr/\u003e    admin_password  = string\u003cbr/\u003e    enable_iam      = optional(bool, false)\u003cbr/\u003e  })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr/\u003e  \"admin_password\": null,\u003cbr/\u003e  \"admin_username\": null,\u003cbr/\u003e  \"connection_name\": null,\u003cbr/\u003e  \"enable_iam\": false\u003cbr/\u003e}\u003c/pre\u003e | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_database_version\"\u003e\u003c/a\u003e [database\\_version](#output\\_database\\_version) | The raw database\\_version reported by the Cloud SQL instance (e.g. \"POSTGRES\\_15\", \"MYSQL\\_8\\_0\"). |\n| \u003ca name=\"output_engine\"\u003e\u003c/a\u003e [engine](#output\\_engine) | The database engine auto-detected from the Cloud SQL instance's\u003cbr/\u003edatabase\\_version. Either \"mysql\" or \"postgres\". |\n| \u003ca name=\"output_managed_users\"\u003e\u003c/a\u003e [managed\\_users](#output\\_managed\\_users) | The list of user emails managed by this module on the target instance. |\n| \u003ca name=\"output_mysql_user_names\"\u003e\u003c/a\u003e [mysql\\_user\\_names](#output\\_mysql\\_user\\_names) | Map of email to the in-database MySQL user name for each managed user.\u003cbr/\u003eEmpty when the target instance is PostgreSQL. |\n| \u003ca name=\"output_postgres_user_names\"\u003e\u003c/a\u003e [postgres\\_user\\_names](#output\\_postgres\\_user\\_names) | Map of email to the in-database PostgreSQL role name for each managed user.\u003cbr/\u003eFor service accounts this is the email without the \".gserviceaccount.com\"\u003cbr/\u003esuffix. Empty when the target instance is MySQL. |\n\u003c!-- END_TF_DOCS --\u003e\n\n## About Boozt\n\nBoozt is a leading and fast-growing Nordic technology company selling fashion\nand lifestyle online mainly through its multi-brand webstore\n[Boozt.com](https://www.boozt.com/) and [Booztlet.com](https://www.booztlet.com/).\n\nThe company is focused on using cutting-edge, in-house developed technology to\ncurate the best possible customer experience.\n\nSee our [Medium](https://medium.com/boozt-tech) blog page for technology-focused\narticles. Would you like to make your mark by working with us at Boozt? Take a\nlook at our [latest hiring opportunities](https://careers.booztgroup.com/).\n\n## Reporting Issues\n\nPlease provide a clear and concise description of the problem or the feature\nyou're missing along with any relevant context. Check existing issues before\nreporting to avoid duplicates.\n\n## Contributing\n\nContributions are highly valued and very welcome! For the process of reviewing\nchanges we use [Pull Requests](https://github.com/boozt-platform/terraform-google-cloud-sql-iam/pulls).\nFor detailed information please follow the\n[Contribution Guidelines](./docs/CONTRIBUTING.md).\n\n## License\n\nThis project is licensed under the MIT License. Please see [LICENSE](./LICENSE)\nfor full details.\n\n[tf-registry]: https://registry.terraform.io/modules/boozt-platform/cloud-sql-iam/google/latest\n[otf-registry]: https://search.opentofu.org/module/boozt-platform/cloud-sql-iam/google/latest\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fboozt-platform%2Fterraform-google-cloud-sql-iam","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fboozt-platform%2Fterraform-google-cloud-sql-iam","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fboozt-platform%2Fterraform-google-cloud-sql-iam/lists"}