Skip to main content
Google Cloud · lesson 6 of 10

Beginner

4

Intermediate

5

Advanced

1
Open the Google Cloud page →
Google Cloud intermediate Lesson 6 of 10

Cloud SQL Basics

Provision a managed Cloud SQL Postgres instance, connect with the Cloud SQL Auth Proxy, and run a real backup and restore cycle.

By SkillByExample · Published

gcp cloud-sql postgresql databases

Cloud SQL is a managed relational database — you pick an engine and machine size, and Google handles patching, backups, and storage growth. This lesson provisions a small Postgres instance, connects through the Cloud SQL Auth Proxy, and runs a real backup-then-restore cycle.

Creating the instance

gcloud sql instances create lessons-pg \
    --database-version=POSTGRES_15 \
    --tier=db-f1-micro \
    --region=us-central1 \
    --storage-size=10 \
    --storage-auto-increase
Creating Cloud SQL instance for POSTGRES_15...done.
Created [https://sqladmin.googleapis.com/sql/v1beta4/projects/skillbyexample-437219/instances/lessons-pg].
NAME        DATABASE_VERSION  LOCATION       TIER          PRIMARY_ADDRESS   STATUS
lessons-pg  POSTGRES_15       us-central1-a  db-f1-micro   34.72.19.201      RUNNABLE

Instance creation for Cloud SQL commonly takes several minutes — it’s provisioning a full VM and attached storage underneath, not just registering a config.

gcloud sql users set-password postgres --instance=lessons-pg --password="a-strong-password"
gcloud sql databases create bookshop --instance=lessons-pg
Updating Cloud SQL user...done.
Creating Cloud SQL database...done.

Connecting with the Auth Proxy

cloud-sql-proxy skillbyexample-437219:us-central1:lessons-pg &
2026/09/13 10:14:02 Authorizing with Application Default Credentials
2026/09/13 10:14:03 [skillbyexample-437219:us-central1:lessons-pg] Listening on 127.0.0.1:5432
2026/09/13 10:14:03 The proxy has started successfully and is ready for new connections!
psql "host=127.0.0.1 port=5432 dbname=bookshop user=postgres"
Password for user postgres:
psql (15.6, server 15.6)
Type "help" for help.

bookshop=>

The proxy listens on localhost and forwards to the instance over an authenticated, encrypted tunnel — nothing about the instance’s real IP or SSL certs needs handling by hand.

create table books (
    id serial primary key,
    title text not null,
    author text not null
);

insert into books (title, author) values
    ('The Pragmatic Programmer', 'Hunt & Thomas'),
    ('Designing Data-Intensive Applications', 'Kleppmann');
CREATE TABLE
INSERT 0 2

Taking a backup

gcloud sql backups create --instance=lessons-pg --description="before schema change"
Creating Cloud SQL backup...done.
Backup Id: 1757754842000
gcloud sql backups list --instance=lessons-pg
ID             WINDOW_START_TIME              ERROR  STATUS
1757754842000  2026-09-13T10:14:02.000+00:00         SUCCESSFUL

Simulating a mistake, then restoring

delete from books;
DELETE 2
gcloud sql backups restore 1757754842000 \
    --restore-instance=lessons-pg \
    --backup-instance=lessons-pg
This will overwrite data in [lessons-pg] with data from the backup [1757754842000].
Do you want to continue (Y/n)? Y

Restoring Cloud SQL instance...done.
Restored [https://sqladmin.googleapis.com/sql/v1beta4/projects/skillbyexample-437219/instances/lessons-pg].
select count(*) from books;
 count
-------
     2
(1 row)

The two rows deleted a moment ago are back, and everything written to lessons-pg after the backup’s window-start time is gone — a restore doesn’t merge, it replaces.

Practice

1. Confirm the tier being used and estimate a rough monthly compute cost from it. 
gcloud sql instances describe lessons-pg --format="value(settings.tier,settings.dataDiskSizeGb)"
db-f1-micro	10

db-f1-micro is Cloud SQL’s smallest shared-core tier, intended for light development workloads rather than anything latency-sensitive or concurrent.

2. Enable automated daily backups instead of relying on manual ones. 
gcloud sql instances patch lessons-pg \
    --backup-start-time=03:00 \
    --enable-bin-log
Patching Cloud SQL instance...done.
Updated [https://sqladmin.googleapis.com/sql/v1beta4/projects/skillbyexample-437219/instances/lessons-pg].

--enable-bin-log (for MySQL) or point-in-time recovery (for Postgres) is what lets a restore target an arbitrary timestamp rather than only the exact moment of a nightly snapshot.

3. Clone the instance instead of restoring in place, to inspect old data without destroying current data. 
gcloud sql instances clone lessons-pg lessons-pg-clone \
    --point-in-time="2026-09-13T10:14:02.000Z"
Cloning Cloud SQL instance...done.
Created [https://sqladmin.googleapis.com/sql/v1beta4/projects/skillbyexample-437219/instances/lessons-pg-clone].

lessons-pg is untouched; lessons-pg-clone is a brand-new, separately-billed instance frozen at that timestamp — the safer option whenever you’re not sure a restore is really what you want.

4. Check what a public IP connection would require, compared to the proxy. 
gcloud sql instances describe lessons-pg --format="value(settings.ipConfiguration.authorizedNetworks)"
[]

An empty list means no IP range is authorized to connect directly — connecting without the proxy would first require adding your own IP with gcloud sql instances patch --authorized-networks=<your-ip>/32, and managing that list as your IP changes.

5. Delete the clone and the original instance to stop billing. 
gcloud sql instances delete lessons-pg-clone --quiet
gcloud sql instances delete lessons-pg --quiet
Deleting Cloud SQL instance...done.
Deleting Cloud SQL instance...done.

Unlike Compute Engine, there’s no separate “stop billing but keep the disk” state for Cloud SQL — an instance is either running (billing) or deleted; stopping only pauses compute billing temporarily and still isn’t free of storage charges.

Next: Cloud Run and Cloud Functions — deploying and invoking a real service, and what a cold start actually costs.

Frequently Asked Questions

What does Cloud SQL manage for me that a self-run database wouldn't?
Automated backups, patching and minor-version upgrades, storage autoresize, and optional high-availability failover to a standby in a different zone. You still manage schema, indexes, and query performance yourself — Cloud SQL is a managed instance, not a managed database design.
What is the Cloud SQL Auth Proxy and why not just connect to the public IP?
The Auth Proxy is a small local process that opens an encrypted, IAM-authenticated tunnel to your instance without needing the instance's IP allow-listed or SSL certificates managed by hand. Connecting to a public IP directly works but means you're responsible for the instance's authorized-network firewall and certificate rotation yourself.
How long does an on-demand Cloud SQL backup take?
For a small development instance with a few tables, seconds to low minutes; the number scales with database size, not row count alone, because Cloud SQL backups are storage-snapshot based rather than a logical pg_dump-style export.
Can I restore a backup onto the same instance, or does it need a new one?
A restore always overwrites the target instance's current data — you either restore onto the original instance (destroying its current state) or clone the backup onto a brand-new instance first if you want to keep the current data intact for comparison.
What's the cheapest way to run Cloud SQL for a lesson or side project?
The smallest shared-core tier — db-f1-micro or db-g1-small — with a single zone (no HA standby) and the smallest storage size that fits, and stopping the instance between sessions since Cloud SQL bills for compute while running, similar to a VM.