[google-cloud-sql-discuss] Re: I can connect the Proxy from my account, but not from either of two service accounts that should also have access.

This is true as per the documentation. To change an instance's service account and access scopes, the instance must be temporarily stopped and restarted after the change. 

On Tuesday, March 27, 2018 at 5:50:52 PM UTC-4, James Lampert wrote:

Well, everything seems to work, both connecting via the Proxy from my desktop, and connecting via the Proxy from the template Compute instance.

Pia Chamberlain mentioned (in the Issue Tracker) that

The good news is that if your Compute Engine instance is in the same project as your Cloud SQL instance, authentication is taken care of.

Not quite "taken care of," because the Compute instance produced by the Google Click-to-Deploy Tomcat deployment didn't come with the "Cloud SQL" API Access Scope enabled. I had to stop the instance (thereby releasing its ephemeral external IP address), enable the needed access scope, restart it, and update my SSH session to point to the new ephemeral IP address. But at least that part was easy to figure out (and add to my own docs).

Once that small change was made, the Proxy no longer needed a credential to connect. Nice.

--
You received this message because you are subscribed to the Google Groups "Google Cloud SQL discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-cloud-sql-discuss+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-cloud-sql-discuss/fc85beee-bc6c-440a-8f9e-d67ca2e25bc3%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.