MySQL said: Lost connection to MySQL server at 'reading initial communication packet', system error: 0
2018/03/22 09:38:23 New connection for "<REDACTED>"
2018/03/22 09:38:24 couldn't connect to "<REDACTED>": ensure that the account has access to "<REDACTED>" (and make sure there's no typo in that name). Error during createEphemeral for <REDACTED>: googleapi: Error 403: Access Not Configured. Cloud SQL Administration API has not been used in project 773874261491 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/sqladmin.googleapis.com/overview?project=<REDACTED> then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry., accessNotConfigured
Cloud SQL AdminCloud SQL ClientCompute Instance Admin (v1)Compute Network AdminCompute Security AdminDeployment Manager EditorService Account ActorService Account AdminService Account Key AdminProject IAM AdminStorage Admin
Cloud SQL ClientEditor
Cloud SQL Client
It would be worth to verify your service account has "Cloud SQL Client" access in IAM and "Cloud SQL API" has been enabled correctly. Suggestions provided here resolved a similar issue in the past.
Jamess-Mac-mini:~ jamesl$ gcloud iam service-accounts get-iam-policy REDACTED-service@REDACTED.iam.gserviceaccount.com
etag: ACAB
Updates are available for some Cloud SDK components. To install them,
please run:
$ gcloud components update
Jamess-Mac-mini:~ jamesl$ gcloud iam service-accounts get-iam-policy REDACTED-com...@developer.gserviceaccount.com
etag: ACAB
James,
Did you enable the 'Cloud SQL' API, or the 'Cloud SQL Admin' API? I believe the second is needed for the proxy to authenticate.
You may want to try the solution provided by the development team on this PIT thread for the same issue. Try to enable 'Cloud SQL Admin' APIand let us know if that resolves proxy connection issue. If you are unable to do that with own account, I will suggest that to try to enable it with project owner account as described in this document.
The good news is that if your Compute Engine instance is in the same project as your Cloud SQL instance, authentication is taken care of.
This is true as per the documentation. To change an instance's service account and access scopes, the instance must be temporarily stopped and restarted after the change.