Create a database user for a Cloud SQL instance.
* This tool returns a long-running operation. Use the `get_operation` tool to poll
its status until the operation completes.
* When you use the `create_user` tool, specify the type of user:
`CLOUD_IAM_USER` or `CLOUD_IAM_SERVICE_ACCOUNT`.
* By default the newly created user is assigned the `cloudsqlsuperuser` role, unless
you specify other database roles explicitly in the request.
* You can use a newly created user with the `execute_sql` tool if the user is a
currently logged in IAM user. The `execute_sql` tool executes the SQL statements
using the privileges of the database user logged in using IAM database
authentication.
The `create_user` tool has the following limitations:
* To create a built-in user with password, use the `password_secret_version` field to provide password using the
Google Cloud Secret Manager. The value of `password_secret_version` should be the resource name of
the secret version, like `projects/12345/locations/us-central1/secrets/my-password-secret/versions/1` or
`projects/12345/locations/us-central1/secrets/my-password-secret/versions/latest`. The caller needs to have
`secretmanager.secretVersions.access` permission on the secret version. This feature is available only to projects on an allowlist.
* The `create_user` tool doesn't support creating a user for SQL Server.
To create an IAM user in PostgreSQL:
* The database username must be the IAM user's email address and all lowercase.
For example, to create user for PostgreSQL IAM user `example-user@example.com`,
you can use the following request:
```
{
"name": "example-user@example.com",
"type": "CLOUD_IAM_USER",
"instance":"test-instance",
"project": "test-project"
}
```
The created database username for the IAM user is `example-user@example.com`.
To create an IAM service account in PostgreSQL:
* The database username must be created without the `.gserviceaccount.com` suffix even though
the full email address for the account is`service-account-name@project-id.iam.gserviceaccount.com`.
For example, to create an IAM service account for PostgreSQL you can use the following request
format:
```
{
"name": "test@test-project.iam",
"type": "CLOUD_IAM_SERVICE_ACCOUNT",
"instance": "test-instance",
"project": "test-project"
}
```
The created database username for the IAM service account is `test@test-project.iam`.
To create an IAM user or IAM service account in MySQL:
* When Cloud SQL for MySQL stores a username, it truncates the @ and the domain name from
the user or service account's email address.
For example, `example-user@example.com` becomes `example-user`.
* For this reason, you can't add two IAM users or service accounts
with the same username but different domain names to the same Cloud SQL instance.
* For example, to create user for the MySQL IAM user `example-user@example.com`,
use the following request:
```
{
"name": "example-user@example.com",
"type": "CLOUD_IAM_USER",
"instance": "test-instance",
"project": "test-project"
}
```
The created database username for the IAM user is `example-user`.
* For example, to create the MySQL IAM service account
`service-account-name@project-id.iam.gserviceaccount.com`, use the
following request:
```
{
"name": "service-account-name@project-id.iam.gserviceaccount.com",
"type": "CLOUD_IAM_SERVICE_ACCOUNT",
"instance": "test-instance",
"project": "test-project"
}
```
The created database username for the IAM service account is
`service-account-name`.