Cloud SQL PostgreSQL IAM authentication: restricting managed SET role membership and PUBLIC database privileges

Google Cloud Database
1

We are configuring an isolated service worker using Cloud SQL for PostgreSQL 18 and IAM database authentication.

Read-only catalog checks identified two security concerns:

  1. The IAM database user inherits membership in cloudsqliamserviceaccount, granted by cloudsqladmin, with ADMIN=false, INHERIT=true, and SET=true.

  2. PUBLIC database privileges provide effective CONNECT and TEMP access on databases outside the worker’s intended scope.

Our security requirements prohibit unauthorized role assumption and effective access to unrelated databases. We also need to preserve existing users, application isolation, and provider-managed configurations.

Questions:

  • Is SET=true on this provider-managed IAM role membership required for Cloud SQL IAM authentication?

  • Is there a Google-supported way to restrict role assumption without breaking IAM authentication?

  • Can effective PUBLIC CONNECT and TEMP privileges be restricted for one IAM database identity without affecting other users or system databases?

  • If these requirements cannot be enforced on a shared Cloud SQL instance, what is the smallest supported isolation alternative?

We are seeking documented, provider-supported guidance before making changes. No role, ACL, or authentication modifications have been performed to address these findings.