IAM based connection to mysql fails in Cloud Run

Hi,

I have deployed a Ruby on Rails based web app to Cloud Run. I get the following error.

textPayload: “[57fad4e5-1113-492a-aa43-f1a629fe844e] ActiveRecord::DatabaseConnectionError (There is an issue connecting to your database with your username/password, username: .”

The service account I use has Editor, Cloud SQL Instance User, Cloud SQL Admin user rights. It is set up to connect using IAM. I don’t have db_username, db_password anywhere in environmental variables or in the deployment script - I have reset env vars for a few times as well. I have granted privileges on the mysql db as well. During deployment, database connection test works and I can log on with Mysql Workbench, but these ofc don’t test IAM based connection. What could be the issue here or what could I do to debug that?

My deployment script is here:

gcloud run deploy $SERVICE_NAME \

–image $IMAGE_URI \

--region $REGION \

--service-account $SERVICE_ACCOUNT \

--platform managed \

--allow-unauthenticated \

--add-cloudsql-instances $PROJECT_ID:$REGION:$DB_INSTANCE \

--update-secrets=RAILS_MASTER_KEY=rails-master-key:latest \

--set-env-vars=APP_HOST=blablabla.today,BUCKET_NAME=storage,SMTP_FROM_EMAIL=…,RAILS_ENV=production,DB_DATABASE=site_production,DB_INSTANCE_CONNECTION_NAME=$PROJECT_ID:$REGION:$DB_INSTANCE \

--project=$PROJECT_ID \

--timeout=10m || {

debug_message “APPLICATION DEPLOYMENT FAILED”

debug_message “Check Cloud Run logs with: gcloud beta run services logs read $SERVICE_NAME --region $REGION”

exit 1

}

Hi @pertti.rahnel,

Make sure your service account has the right IAM permissions, specifically, it needs permission to either manage a Private Service Connect connection or at least have the necessary access to connect to your Cloud SQL instance. Without these, IAM-based authentication might fail even if everything else looks correct.