This page discusses the two levels of access control for Cloud SQL instances. You must configure both levels of access control before you can manage your instance. ## Levels of access control Configuring access control involves controlling who or what can access the instance. Access control occurs on two levels: Instance-level access : Instance-level access authorizes access to your Cloud SQL instance from an application or client (running on an App Engine standard environment or externally) or from another Google Cloud service, such as Compute Engine. Database access : Database access uses [server-level roles](https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles) to control which SQL Server users can access the data in your instance. > [!NOTE] > **Note:** For information about controlling > who can *manage* your instance, see > [Project access control](https://docs.cloud.google.com/sql/docs/project-access-control).
### Instance-level access How you configure instance-level access depends on where you are connecting from: | Connection source | Access configuration options | More information | |---|---|---| | Google Kubernetes Engine | - Cloud SQL Auth Proxy Docker image | - [Connecting from Google Kubernetes Engine](https://docs.cloud.google.com/sql/docs/sqlserver/connect-kubernetes-engine) | | App Engine standard environment | - Same project: configure IAM - Between projects: configure IAM | - [Connecting from standard environment standard environment](https://docs.cloud.google.com/sql/docs/sqlserver/connect-app-engine-standard) | | flexible environment | - Same project: preconfigured - Between projects: configure IAM | - [Connecting from standard environment flexible environment](https://docs.cloud.google.com/sql/docs/sqlserver/connect-app-engine-flexible) | | `sqlcmd` client | - Cloud SQL Auth Proxy - Authorize client IP address | - [Connecting a client using the Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/sqlserver/connect-auth-proxy) - [Connecting a client using public IP](https://docs.cloud.google.com/sql/docs/sqlserver/connect-admin-ip) | | External applications | - Cloud SQL Auth Proxy - Authorize client IP address | - [Connecting to Cloud SQL from external applications](https://docs.cloud.google.com/sql/docs/sqlserver/connect-external-app) | | Cloud Run | - A Cloud SQL instance set up with a public IP. - Between projects: also configure IAM | - [Connecting from Cloud Run (fully managed) to Cloud SQL](https://docs.cloud.google.com/sql/docs/sqlserver/connect-run) | | Google Kubernetes Engine | - Private IP - If Public IP, Cloud SQL Auth Proxy is required | - [Connecting from Google Kubernetes Engine](https://docs.cloud.google.com/sql/docs/sqlserver/connect-kubernetes-engine) | ### Database access After a user or application connects to a database instance, the user or application must log in with a user or service account. As part of creating a Cloud SQL instance, you set up the default user (root) account. You can also create more users to give you finer-grained control over access to your instance. For more information, see [SQL Server users](https://docs.cloud.google.com/sql/docs/sqlserver/users) and [Creating and managing SQL Server users](https://docs.cloud.google.com/sql/docs/sqlserver/create-manage-users). ## What's next - Learn more about [how Cloud SQL works with SQL Server users](https://docs.cloud.google.com/sql/docs/sqlserver/users). - Learn more about [SQL Server roles](https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles). - Learn more about your [options for connecting from an external application](https://docs.cloud.google.com/sql/docs/sqlserver/connect-overview). - Learn about [controlling who can manage your Google Cloud Platform project](https://docs.cloud.google.com/sql/docs/sqlserver/roles-and-permissions).