AlloyDB Language Connectors overview

To establish encrypted, authorized connections from your application to an AlloyDB for PostgreSQL instance without managing SSL certificates or running a separate proxy process, you can use the AlloyDB Language Connectors.

AlloyDB Language Connectors are client libraries that provide automated mutual TLS (mTLS) with TLS 1.3 and Identity and Access Management (IAM) authorization when connecting to an AlloyDB instance. The libraries create authorized connections to the proxy server on the AlloyDB instance on behalf of your application and pass those connections to your application's database driver. They don't provide a network path to an AlloyDB instance if a network path isn't already present.

AlloyDB provides the following AlloyDB Language Connectors:

Benefits of AlloyDB Language Connectors

AlloyDB Language Connectors provide the following benefits when connecting to an AlloyDB cluster:

  • Access control: Uses IAM permissions to control who or what can connect to your AlloyDB instances.
  • Convenience: Uses automatic mTLS to provide extended mutual security and removes the requirement to manage SSL certificates, configure firewall rules, or enable authorized external networks.

How AlloyDB Language Connectors work

AlloyDB Language Connectors use a client-side library component to connect to a proxy server on the AlloyDB instance. The connector creates an ephemeral certificate that authorizes the client to connect to the server-side proxy. The server-side proxy limits access to the AlloyDB database by requiring a valid TLS certificate to connect.

You can use AlloyDB Language Connectors with private IP (private services access or Private Service Connect) or public IP. AlloyDB Language Connectors default to a private IP connection.

AlloyDB Language Connectors use built-in database authentication by default. You can also configure AlloyDB Language Connectors to use automatic IAM database authentication. For information about how to install and configure the connectors, see Connect using the AlloyDB Language Connectors.

You can also connect to an AlloyDB cluster by using the AlloyDB Auth Proxy. For more information about connecting to an AlloyDB cluster, see the Connection overview.

What's next