Control connector enforcement

To ensure that all database connections to an existing AlloyDB for PostgreSQL instance use mutual TLS (mTLS) encryption and Identity and Access Management (IAM) authorization, you can enforce connections through the AlloyDB Auth Proxy or AlloyDB Language Connectors. You can also disable connector enforcement on an instance at any time. For information about how to require connectors when you create an instance, see Create a primary instance.

Note: For the primary instance in a Private Service Connect cluster, connector enforcement is only supported when there are no secondary instances.

AlloyDB instances accept connections on two TCP ports:

• Port 5432, the default PostgreSQL port that applications use to connect to the instance. If you're using managed connection pooling, the instance also listens on port 6432 for connections to the connection pool.

• Port 5433, which connectors, including the AlloyDB Auth Proxy and AlloyDB Language Connectors, use to connect to the instance.

Applications connect to a chosen connector on the local host and port that the connector listens on, and that connector communicates with your AlloyDB instance on port 5433.

Enforce connectors on an instance

Console

1. Go to the Clusters page.

   Go to Clusters

2. Click a cluster in the Resource name column.
3. In the Overview page, go to the Instances in your cluster section, and click Edit primary.
4. In the Edit primary instance pane, expand Advanced configuration options.
5. Select Enforce mTLS via AlloyDB connectors.
6. Click Update instance.

gcloud

To use the gcloud CLI, you can install and initialize the Google Cloud CLI, or you can use Cloud Shell.

Use the gcloud alloydb instances update command with the --require-connectors flag to enforce connector connections on an AlloyDB instance:

gcloud alloydb instances update INSTANCE_ID \
    --region=REGION_ID \
    --cluster=CLUSTER_ID \
    --project=PROJECT_ID \
    --require-connectors

Replace the following:

• INSTANCE_ID: the ID of the instance that you are updating.
• REGION_ID: the region where the instance is placed.
• CLUSTER_ID: the ID of the cluster where the instance is placed.
• PROJECT_ID: the ID of the project where the cluster is placed.

If the command returns an error message that includes the phrase invalid cluster state MAINTENANCE, then the cluster is undergoing routine maintenance. This state temporarily disallows instance reconfiguration. Run the command again after the cluster returns to a READY state. To check the cluster's status, see View cluster details.

Disable connector enforcement on an instance

Console

1. Go to the Clusters page.

   Go to Clusters

2. Click a cluster in the Resource name column.
3. In the Overview page, go to the Instances in your cluster section, and click Edit primary.
4. In the Edit primary instance pane, expand Advanced configuration options.
5. Clear Enforce mTLS via AlloyDB connectors.
6. Click Update instance.

gcloud

To use the gcloud CLI, you can install and initialize the Google Cloud CLI, or you can use Cloud Shell.

Use the gcloud alloydb instances update command with the --no-require-connectors flag to disable connector enforcement on an AlloyDB instance:

gcloud alloydb instances update INSTANCE_ID \
    --region=REGION_ID \
    --cluster=CLUSTER_ID \
    --project=PROJECT_ID \
    --no-require-connectors

Replace the following:

• INSTANCE_ID: the ID of the instance that you are updating.
• REGION_ID: the region where the instance is placed.
• CLUSTER_ID: the ID of the cluster where the instance is placed.
• PROJECT_ID: the ID of the project where the cluster is placed.

What's next

• AlloyDB Auth Proxy overview
• AlloyDB Language Connectors overview