Google Cloud offers Identity and Access Management (IAM), which lets you give
access to specific Google Cloud resources and prevent unwanted
access to other resources. This page describes how Cloud SQL is integrated with
IAM .
For a detailed description of Google Cloud IAM, see
[IAM documentation](https://docs.cloud.google.com/iam/docs.md.txt).

Cloud SQL provides a set of [predefined roles](https://docs.cloud.google.com/sql/docs/sqlserver/iam-roles.md.txt)
designed to help you control access to your Cloud SQL resources. You can
also create your own [custom roles](https://docs.cloud.google.com/sql/docs/sqlserver/iam-roles.md.txt#custom-roles),
if the predefined roles don't provide the sets of permissions you need.
In addition, the legacy basic roles (Editor, Viewer, and Owner) are also still
available to you, although they don't provide
the same fine-grained control as the Cloud SQL roles. In particular, the
basic roles provide access to resources across Google Cloud, rather than just
for Cloud SQL. For more information about basic Google Cloud roles, see
[Basic roles](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#basic).

You can set an IAM policy at any level in the
[resource hierarchy](https://docs.cloud.google.com/iam/docs/overview.md.txt#resource-hierarchy): the
organization level, the folder level, or the project level.
Resources inherit the policies of all of their parent resources.


Cloud SQL for SQL Server

supports IAM authentication for instance and
backup operations only. IAM authentication isn't supported for
database operations. Use the following authentication options for database
operations and queries:

- [Built-in database authentication using username and passwords](https://docs.cloud.google.com/sql/docs/sqlserver/built-in-authentication.md.txt)
- [Customer-managed Active Directory](https://docs.cloud.google.com/sql/docs/sqlserver/cmad.md.txt)
- [Managed Service for Microsoft Active Directory](https://docs.cloud.google.com/sql/docs/sqlserver/ad.md.txt)

## IAM references for Cloud SQL

- [Required permissions for common tasks in the Google Cloud console](https://docs.cloud.google.com/sql/docs/sqlserver/iam-permissions.md.txt#permissions-console)
- [Required permissions for `gcloud sql` commands](https://docs.cloud.google.com/sql/docs/sqlserver/iam-permissions.md.txt#permissions-gcloud)
- [Required permissions for Cloud SQL Admin API methods](https://docs.cloud.google.com/sql/docs/sqlserver/iam-permissions.md.txt#api-methods)
- [Predefined Cloud SQL IAM roles](https://docs.cloud.google.com/sql/docs/sqlserver/iam-roles.md.txt#roles)
- [Permissions and their roles](https://docs.cloud.google.com/sql/docs/sqlserver/iam-roles.md.txt#permissions-roles)
- [Custom roles](https://docs.cloud.google.com/sql/docs/sqlserver/iam-roles.md.txt#custom-roles)

## IAM authentication concepts

When using IAM authentication, permission to access a resource
(a Cloud SQL instance) isn't granted *directly* to the end user. Instead,
permissions are grouped into *roles* , and roles are granted to *principals* . For
more information, see the
[IAM overview](https://docs.cloud.google.com/iam/docs/overview.md.txt).

<br />

IAM policies involve the following entities:

- **Principals** . In Cloud SQL, you can use two types of principals: a *user account* , and a *service account* (for applications). For more information, see [Concepts related to identity](https://docs.cloud.google.com/iam/docs/overview.md.txt#concepts_related_identity).
- **Roles** . A role is a collection of permissions. You can grant roles to principals to provide them with the privileges required to accomplish specific tasks. For more information about IAM roles, see [Roles](https://docs.cloud.google.com/iam/docs/overview.md.txt#roles).
- **Resource**. The resources that principals access are Cloud SQL instances. By default, IAM policy bindings are applied at the project-level, such that principals receive role permissions for all Cloud SQL instances in the project.