# How to Use Cloud SQL Skills for MySQL: Complete Setup and Connection Guide

> Master Cloud SQL skills for MySQL. Provision a managed instance and connect securely using gcloud and the Cloud SQL Auth Proxy. Get the complete setup guide.

- Repository: [Google/skills](https://github.com/google/skills)
- Tags: how-to-guide
- Published: 2026-08-15

---

**Use the Cloud SQL Basics skill in the google/skills repository to provision a managed MySQL instance through gcloud commands and connect securely via the Cloud SQL Auth Proxy.**

The **Cloud SQL Basics** skill provides a production-ready workflow for deploying Google Cloud SQL with MySQL. This open-source skill, maintained in the `google/skills` repository, includes reference files with tested commands for instance creation, IAM configuration, and secure client connectivity. This guide walks through the complete implementation based on the official skill source files.

## Enable Required APIs and IAM Permissions

Before creating any resources, you must enable the Cloud SQL Admin API and ensure your identity has appropriate permissions.

### Enable the Cloud SQL Admin API

```bash
gcloud services enable sqladmin.googleapis.com --quiet

```

This command activates the `sqladmin.googleapis.com` service, which powers all `gcloud sql` operations. As noted in [`SKILL.md`](https://github.com/google/skills/blob/main/SKILL.md) (lines 34-36), this is the mandatory first step before instance provisioning.

### Required IAM Role

The skill documentation specifies that you need **Cloud SQL Admin** (`roles/cloudsql.admin`) to create and manage instances. For production environments, consider **Cloud SQL Client** (`roles/cloudsql.client`) for applications that only need to connect to existing instances. These permissions are detailed in [`references/iam-security.md`](https://github.com/google/skills/blob/main/references/iam-security.md).

## Create a MySQL Instance with gcloud

The [`references/cli-usage.md`](https://github.com/google/skills/blob/main/references/cli-usage.md) file contains the definitive command structure for MySQL instance creation. Here's the recommended configuration:

```bash
gcloud sql instances create my-mysql-instance \
  --database-version=MYSQL_8_0 \
  --tier=db-f1-micro \
  --region=us-central1 \
  --storage-size=10GB \
  --no-assign-ip

```

Key parameters explained:

- **`--database-version=MYSQL_8_0`** – Specifies MySQL 8.0; also supports `MYSQL_5_7` for legacy compatibility
- **`--tier=db-f1-micro`** – Shared-core machine type suitable for development; upgrade to `db-n1-standard-2` or higher for production workloads
- **`--no-assign-ip`** – Creates a private-IP-only instance, forcing connections through the Auth Proxy or VPC peering

## Configure Users and Databases

### Set the Root Password

```bash
gcloud sql users set-password root \
  --instance=my-mysql-instance \
  --password=MyStrongPassword123 \
  --quiet

```

This command, sourced from [`cli-usage.md`](https://github.com/google/skills/blob/main/cli-usage.md), establishes authentication credentials for the initial administrative access.

### Create Your Application Database

```bash
gcloud sql databases create my_database \
  --instance=my-mysql-instance \
  --charset=utf8mb4 \
  --collation=utf8mb4_general_ci \
  --quiet

```

The **`utf8mb4`** character set ensures full Unicode support, including emoji and mathematical symbols, as recommended in the skill's reference documentation.

## Connect Securely with Cloud SQL Auth Proxy

The Cloud SQL Auth Proxy eliminates the need to expose your database to the public internet or manage SSL certificates manually. The skill implementation in [`SKILL.md`](https://github.com/google/skills/blob/main/SKILL.md) (lines 71-95) provides this two-step process:

### 1. Capture the Instance Connection Name

```bash
INSTANCE_CONNECTION_NAME=$(gcloud sql instances describe my-mysql-instance \
  --format="value(connectionName)" --quiet)

echo $INSTANCE_CONNECTION_NAME

# Output: your-project:us-central1:my-mysql-instance

```

### 2. Download and Start the Proxy

```bash

# Download the current stable release

wget https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.9.0/cloud-sql-proxy.linux.amd64 -O cloud-sql-proxy
chmod +x cloud-sql-proxy

# Start proxy (listens on local port 3306)

./cloud-sql-proxy $INSTANCE_CONNECTION_NAME

```

The proxy authenticates using your local gcloud credentials and establishes an encrypted tunnel to your instance.

### 3. Connect with Standard MySQL Client

```bash
mysql -u root -pMyStrongPassword123 \
  -h 127.0.0.1 \
  -P 3306 \
  my_database

```

Your application or CLI tools now connect to `127.0.0.1:3306` as if MySQL were running locally, with all traffic encrypted through Google's infrastructure.

## Production Deployment: Cloud Run with IAM Authentication

For serverless deployments, the skill's [`iam-security.md`](https://github.com/google/skills/blob/main/iam-security.md) reference demonstrates passwordless authentication using IAM service accounts. Mount the Auth Proxy as a sidecar container and configure your application to connect through the Unix socket:

```bash

# Connection string format in your application

socketPath: "/cloudsql/${INSTANCE_CONNECTION_NAME}"

```

The proxy automatically handles IAM token exchange, eliminating credential rotation and secret management complexity.

## Infrastructure as Code Alternative

The skill includes Terraform configurations in [`references/iac-usage.md`](https://github.com/google/skills/blob/main/references/iac-usage.md) for teams preferring declarative infrastructure. This enables version-controlled, reproducible MySQL deployments integrated with your CI/CD pipeline.

## Reference File Structure

| File | Purpose | Location in Repository |
|------|---------|------------------------|
| [`SKILL.md`](https://github.com/google/skills/blob/main/SKILL.md) | Architecture overview and quick-start workflow | [`skills/cloud/cloud-sql-basics/SKILL.md`](https://github.com/google/skills/blob/main/skills/cloud/cloud-sql-basics/SKILL.md) |
| [`references/cli-usage.md`](https://github.com/google/skills/blob/main/references/cli-usage.md) | Complete `gcloud sql` command reference | [`skills/cloud/cloud-sql-basics/references/cli-usage.md`](https://github.com/google/skills/blob/main/skills/cloud/cloud-sql-basics/references/cli-usage.md) |
| [`references/iam-security.md`](https://github.com/google/skills/blob/main/references/iam-security.md) | IAM roles, SSL/TLS, and Auth Proxy patterns | [`skills/cloud/cloud-sql-basics/references/iam-security.md`](https://github.com/google/skills/blob/main/skills/cloud/cloud-sql-basics/references/iam-security.md) |
| [`references/client-library-usage.md`](https://github.com/google/skills/blob/main/references/client-library-usage.md) | Python, Java, Node.js, Go connection examples | [`skills/cloud/cloud-sql-basics/references/client-library-usage.md`](https://github.com/google/skills/blob/main/skills/cloud/cloud-sql-basics/references/client-library-usage.md) |
| [`references/iac-usage.md`](https://github.com/google/skills/blob/main/references/iac-usage.md) | Terraform modules for Cloud SQL provisioning | [`skills/cloud/cloud-sql-basics/references/iac-usage.md`](https://github.com/google/skills/blob/main/skills/cloud/cloud-sql-basics/references/iac-usage.md) |

## Summary

- **Cloud SQL Basics skill** in `google/skills` provides authoritative, tested commands for MySQL deployment
- **Enable `sqladmin.googleapis.com`** and obtain `roles/cloudsql.admin` before creating resources
- **Use `--no-assign-ip`** with the **Auth Proxy** for production-grade security without public internet exposure
- **Reference [`cli-usage.md`](https://github.com/google/skills/blob/main/cli-usage.md)** for user management, database creation, and backup operations
- **Implement IAM authentication** for passwordless connections from Cloud Run and other Google Cloud services

## Frequently Asked Questions

### What MySQL versions does Cloud SQL support?

Cloud SQL supports **MySQL 5.7** and **MySQL 8.0**. Specify your version with `--database-version=MYSQL_8_0` or `MYSQL_5_7` when creating instances. The skill's [`cli-usage.md`](https://github.com/google/skills/blob/main/cli-usage.md) reference includes version-specific considerations for upgrade paths.

### Do I need the Auth Proxy if my instance has a public IP?

No, but it's strongly discouraged to use public IPs without the proxy. The skill documentation emphasizes that the **Cloud SQL Auth Proxy** provides automatic IAM authentication and encrypted tunnels even for public IP instances, eliminating the need to configure authorized networks or manage client SSL certificates.

### How do I connect from a local development machine to a private-IP-only instance?

Use the **Cloud SQL Auth Proxy** as shown in this guide. The proxy authenticates using your local gcloud credentials and tunnels traffic through Google's internal network, so your machine does not need VPC connectivity. This is the primary local development pattern documented in [`SKILL.md`](https://github.com/google/skills/blob/main/SKILL.md) lines 84-95.

### Where are the client library examples for Python and other languages?

The skill includes a dedicated reference file at [`references/client-library-usage.md`](https://github.com/google/skills/blob/main/references/client-library-usage.md) with connection examples for **Python** (SQLAlchemy), **Java** (JDBC), **Node.js** (mysql2), and **Go** (database/sql). These examples demonstrate both direct TCP connections with SSL certificates and proxy-based Unix socket connections.