This page summarizes the Cloud SQL Language Connectors and how to use them
with your instances.
Cloud SQL Language Connectors are libraries that provide encryption and
[IAM](https://docs.cloud.google.com/iam) authorization when connecting to a Cloud SQL instance.
Cloud SQL Language Connectors create authorized connections to the
server-side proxy on behalf of a user's application and pass that connection to
the application's database driver. They don't provide a network path to a
Cloud SQL instance if one is not already present.
Cloud SQL Language Connectors use a client-side component to connect to a proxy server
on the Cloud SQL instance. The connector creates a temporary certificate
that authorizes the holder to connect to the server-side proxy. The server-side
proxy limits access to the Cloud SQL database by requiring a valid TLS
certificate in order to connect.
Cloud SQL supports the following Cloud SQL Language Connectors:
- [Cloud SQL Java connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#java)
- [Cloud SQL Python connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#python)
- [Cloud SQL Go connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#go)
- [Cloud SQL Node.js connector](https://docs.cloud.google.com/static/sql/docs/postgres/connect-connectors#node.js)
Cloud SQL recommends using Cloud SQL Language Connectors to connect to your
Cloud SQL instance. You can also connect to a Cloud SQL
instance [using a database client](https://docs.cloud.google.com/sql/docs/postgres/connect-admin-ip.md.txt) or the
[Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/postgres/sql-proxy.md.txt). For more information about
connecting to a Cloud SQL instance, see [About connection options](https://docs.cloud.google.com/sql/docs/postgres/connect-overview).
## Requirements
If your Cloud SQL instance uses
[shared certificate authority (CA)](https://docs.cloud.google.com/sql/docs/postgres/authorize-ssl.md.txt#shared-regional-ca)
as its `serverCaMode`, then on the client side,
make sure that the Cloud SQL Language Connectors you're using meet
the following version requirements:
- [Cloud SQL Java connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#java): [v1.21.0](https://github.com/GoogleCloudPlatform/cloud-sql-jdbc-socket-factory/releases/tag/v1.21.0) or later
- [Cloud SQL Go connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#go): [v1.12.0](https://github.com/GoogleCloudPlatform/cloud-sql-go-connector/releases/tag/v1.12.0) or later
- [Cloud SQL Node.js connector](https://docs.cloud.google.com/static/sql/docs/postgres/connect-connectors#node.js): [v1.4.0](https://github.com/GoogleCloudPlatform/cloud-sql-nodejs-connector/releases/tag/v1.4.0) or later
> [!NOTE]
> **Note:** [Cloud SQL Python connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#python) supports instances that use the shared CA configuration, but the connector doesn't verify server identity.
If your Cloud SQL instance uses
[customer-managed CA](https://docs.cloud.google.com/sql/docs/postgres/authorize-ssl.md.txt#customer-managed-ca)
as its `serverCaMode`, then on the client side,
make sure that the Cloud SQL Language Connectors you're using meet
the following version requirements:
- [Cloud SQL Java connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#java): [v1.22.0](https://github.com/GoogleCloudPlatform/cloud-sql-jdbc-socket-factory/releases/tag/v1.22.0) or later
- [Cloud SQL Go connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#go): [v1.14.0](https://github.com/GoogleCloudPlatform/cloud-sql-go-connector/releases/tag/v1.14.0) or later
- [Cloud SQL Node.js connector](https://docs.cloud.google.com/static/sql/docs/postgres/connect-connectors#node.js): [v1.6.0](https://github.com/GoogleCloudPlatform/cloud-sql-nodejs-connector/releases/tag/v1.6.0) or later
When an instance uses customer-managed CA as its server CA mode, you can configure
the instance with a [custom DNS name](https://docs.cloud.google.com/sql/docs/postgres/configure-ssl-instance.md.txt#custom-dns-name).
You provide the custom DNS name in the
custom subject alternative name (SAN) field of the server certificate.
After you set up a custom DNS name for the instance, you can connect to the
instance from Cloud SQL Language Connectors using the DNS name.
## Benefits of Cloud SQL Language Connectors
Cloud SQL Language Connectors provide the following
benefits with connecting to a Cloud SQL instance:
- **IAM authorization**: Uses identity and access management (IAM) permissions to control who or what can connect to your Cloud SQL instances.
- **Convenience**: Removes the requirement to manage SSL certificates, configure firewall rules, or enable authorized networks.
## Limitations
You can't use the Cloud SQL Language Connectors if you're using
[context-aware access](https://docs.cloud.google.com/iap/docs/cloud-iap-context-aware-access-howto.md.txt) and
IAM database authentication. When you try to login to the instance,
IAM authentication fails.
## Enforce the use of Cloud SQL Language Connectors
By using [connector enforcement](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances.md.txt#ConnectorEnforcement), you can enforce using only the Cloud SQL Auth Proxy or Cloud SQL Language Connectors to connect to Cloud SQL instances. With connector enforcement, Cloud SQL rejects direct connections to the database.
If you're using a [Private Service Connect-enabled instance](https://docs.cloud.google.com/sql/docs/postgres/about-private-service-connect.md.txt), then there's a limitation. If the instance has connector enforcement enabled, then you can't create read replicas for the instance. Similarly, if the instance has read replicas, then you can't enable connector enforcement for the instance.
For more information about how to enforce using only the Cloud SQL Auth Proxy or Cloud SQL Language Connectors to connect to an instance, see [Connect using Cloud SQL Language Connectors](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#enforce).
## What's next
- [Connect using the Cloud SQL Java Connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#java).
- [Connect using the Cloud SQL Python Connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#python).
- [Connect using the Cloud SQL Go Connector](https://docs.cloud.google.com/sql/docs/postgres/connect-connectors.md.txt#go).
- [Connect using the Cloud SQL Node.js Connector](https://docs.cloud.google.com/static/sql/docs/postgres/connect-connectors#node.js).
- Learn more about the [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/postgres/sql-proxy.md.txt).