Skip to content

Commit 8af1b48

Browse files
committed
chore: reformat line length
1 parent 1b6ec1c commit 8af1b48

1 file changed

Lines changed: 32 additions & 24 deletions

File tree

README.md

Lines changed: 32 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -343,30 +343,6 @@ query param:
343343
> ./cloud-sql-proxy --unix-socket C:\cloudsql myproject:my-region:mysql
344344
> ```
345345

346-
### Configuring Service Account Impersonation
347-
348-
The Proxy supports [service account impersonation](https://cloud.google.com/iam/docs/impersonating-service-accounts).
349-
This allows the Proxy to act as a different service account, which can be useful
350-
for granting access to resources that are not accessible to the default IAM principal.
351-
352-
To use service account impersonation, you must have the
353-
`iam.serviceAccounts.getAccessToken` permission on the IAM principal impersonating another service account. You can grant this permission by assigning the
354-
`roles/iam.serviceAccountTokenCreator` role to the IAM principal.
355-
356-
To impersonate a service account, use the `--impersonate-service-account` flag:
357-
358-
> [!NOTE]:
359-
>
360-
> The impersonated service account must have the `Service Usage Consumer` and `Cloud SQL Client` permissions. Additionally, to use IAM Authenticated users, add the `Cloud SQL Instance User` permission.
361-
362-
363-
```shell
364-
# Starts a listener on localhost:5432 and impersonates the service account
365-
# "my-other-sa@my-project.iam.gserviceaccount.com".
366-
# The Proxy will use the credentials of the principal running the Proxy to
367-
# generate a short-lived access token for the impersonated service account.
368-
./cloud-sql-proxy --impersonate-service-account my-other-sa@my-project.iam.gserviceaccount.com <INSTANCE_CONNECTION_NAME>
369-
```
370346

371347
### Configuring IAM Database Authentication
372348

@@ -406,6 +382,38 @@ and to [add your IAM principal as a database user][iam-auth-user].
406382
> * For a service account, this is the service account's email address without
407383
> the `@project-id.iam.gserviceaccount.com` suffix.
408384
385+
386+
### Configuring Service Account Impersonation
387+
388+
The Proxy supports [service account impersonation](https://cloud.google.com/iam/docs/impersonating-service-accounts).
389+
This allows the Proxy to act as a different service account, which can be useful
390+
for granting access to resources that are not accessible to the default IAM
391+
principal.
392+
393+
To use service account impersonation, you must have the
394+
`iam.serviceAccounts.getAccessToken` permission on the IAM principal
395+
impersonating another service account. You can grant this permission by assigning
396+
the `roles/iam.serviceAccountTokenCreator` role to the IAM principal.
397+
398+
To impersonate a service account, use the `--impersonate-service-account` flag:
399+
400+
> [!NOTE]
401+
>
402+
> The impersonated service account must have the `Service Usage Consumer` and
403+
`Cloud SQL Client` permissions.
404+
> Additionally, to use IAM Authenticated users, add the `Cloud SQL Instance User`
405+
permission.
406+
407+
408+
```shell
409+
# Starts a listener on localhost:5432 and impersonates the service account
410+
# "my-other-sa@my-project.iam.gserviceaccount.com".
411+
# The Proxy will use the credentials of the principal running the Proxy to
412+
# generate a short-lived access token for the impersonated service account.
413+
./cloud-sql-proxy --impersonate-service-account \
414+
my-other-sa@my-project.iam.gserviceaccount.com <INSTANCE_CONNECTION_NAME>
415+
```
416+
409417
### Configuring DNS domain names to identify instances
410418
411419
The Proxy can be configured to use DNS to look up an instance. This would

0 commit comments

Comments
 (0)