Clarification on Cloud SQL Export Permission Changes for Basic Viewer Role (roles/viewer)

Google Cloud Database
, ,
1

AS per New GCP Update On Cloud-sql permission, Our understanding is that the current roles/viewer role includes Cloud SQL-related permissions, and some users may be able to perform export operations through permissions inherited from this role.

Google’s notification specifically references:

  • roles/cloudsql.viewer
  • Legacy READER

but does not explicitly mention the basic roles/viewer role.

Could you please clarify:

  1. Will the upcoming Cloud SQL export permission changes affect users assigned the basic IAM role roles/viewer?
  2. Is cloudsql.instances.export being removed from roles/viewer as part of this change?

We would appreciate confirmation so we can ensure compliance before the enforcement date.

Thank you.

2

Yes, the upcoming Cloud SQL export permission changes will affect users assigned the basic IAM role (roles/viewer). Because basic roles (Owner, Editor, Viewer) inherently encompass all read-only permissions across Google Cloud services, any fundamental change to a service’s underlying read-only capabilities affects both the service-specific viewer role (roles/cloudsql.viewer) and the project-wide basic roles/viewer.

The cloudsql.instances.export permission is being systematically decoupled from viewer-level access because exporting data constitutes exfiltration and data access, which violates the Principle of Least Privilege for a standard “read-only metadata” viewer.Impact Analysis & Direct AnswersWill the upcoming changes affect users assigned roles/viewer?Yes. If a user relies solely on roles/viewer to trigger or execute Cloud SQL exports via the console, gcloud CLI, or API, that capability will break once Google’s update is fully enforced.Is cloudsql.instances.export being removed from roles/viewer?Yes. To ensure strict data security boundaries, Google is removing data-export capabilities from legacy and basic viewer roles. Moving forward, viewers will only be able to view instance configurations, metadata, and metrics, but not mutate or extract the database state.

I belive this was answered here:

Cloud SQL roles