Cloud SQL for PostgreSQL lets you deploy fully managed relational databases on
Google Cloud. You can provision instances tailored to your workload while
automating routine maintenance such as operating system patching, backups, and
failover.

Before provisioning an instance, review feature availability in the
[Introduction to
Cloud SQL editions](https://docs.cloud.google.com/sql/docs/postgres/editions-intro). For detailed
information about all instance settings, see
[Instance settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt).

## Key concepts

A newly-created instance has a `postgres` database.

The maximum number of instances you can have in a single project depends on the
[network
architecture](https://docs.cloud.google.com/sql/docs/postgres/upgrade-cloud-sql-instance-new-network-architecture#overview)
of those instances:

- New SQL network architecture: You can have up to 1,000 instances per project.
- Old SQL network architecture: You can have up to 100 instances per project.
- Using both architectures: Your limit will be somewhere between 100 and 1,000, depending on the distribution of your instances across the two architectures.

[File a support case](https://support.google.com/googlecloud/answer/1041916)
to request an increase. Read replicas are counted as instances.

## Before you begin

1. Make sure you have the following roles on your user account:
   - [Cloud SQL Admin](https://docs.cloud.google.com/sql/docs/postgres/iam-roles.md.txt#roles)
   - [Compute Viewer](https://docs.cloud.google.com/compute/docs/access/iam.md.txt#compute.viewer)

   [Go to the IAM page](https://console.cloud.google.com/iam-admin/iam)

   [Learn more](https://docs.cloud.google.com/sql/docs/postgres/roles-and-permissions.md.txt)
   about roles and permissions.

## Create a PostgreSQL instance

> [!TIP]
> **Tip** : If you plan on using private networking, then you can deploy both the private networking setup of your choice and the Cloud SQL instance along with clients such as Compute Engine VMs by using Terraform. For more information, see [Simplified Cloud Networking Configuration Solutions](https://github.com/GoogleCloudPlatform/cloudnetworking-config-solutions).

### Console

1. In the Google Cloud console, go to the **Cloud SQL Instances** page.

   [Go to Cloud SQL Instances](https://console.cloud.google.com/sql)
2. Click **Create instance**.
3. Select **New instance**.
4. On the **Choose your database engine** panel of the **Create an instance** page, click **Choose PostgreSQL**.
5. In the **Choose a Cloud SQL edition** section of the
   **Create a SQL Server instance** page, select the Cloud SQL
   edition for your instance: `Enterprise` or
   `Enterprise Plus`.

   > [!NOTE]
   > **Note**: If the database version for your instance
   > is PostgreSQL 16 or later, then the default Cloud SQL for PostgreSQL edition is
   > Cloud SQL Enterprise Plus edition. If the database version is earlier than PostgreSQL 16, then
   > the default edition is Cloud SQL Enterprise edition.

   For more information about Cloud SQL editions, see
   [Introduction to Cloud SQL editions](https://docs.cloud.google.com/sql/docs/postgres/editions-intro.md.txt).
6. Select the edition preset for your instance. To see the available presets, click the **Edition preset** menu.

   > [!NOTE]
   > **Note:** To learn about how edition presets differ from one another, click **Compare edition presets**.

7. In the **Instance info** section, select the database version for your instance. To see the available versions, click the **Database version** menu.

   The database version can't be edited after the instance has been created.

   > [!NOTE]
   > **Note:** Only PostgreSQL versions 12 and later are compatible with Cloud SQL Enterprise Plus edition.

8. In the **Instance ID** field of the **Instance info** pane, enter an ID for your instance.  

   > [!CAUTION]
   > Don't include sensitive or personally identifiable information in your instance name.


   You do not need to include the project ID in the instance name. This is done automatically where
   appropriate (for example, in the log files).
9. Enter a password for the `postgres` user.
10. To see the password in clear text, click the **Show password** icon.
11. You can either enter the password manually or click **Generate** to have Cloud SQL create a password for you automatically.
12. Optional: Configure a password policy for the instance as follows:
    1. Select the **Enable password policies** checkbox.

       > [!NOTE]
       > Note: When you enable a password policy, statements that create users or change user passwords can cause additional latency due to password policy verification.

    2. Click the **Set password policy** button, set one or more of the following options, and click **Save** .
       - **Minimum length**: Specifies the minimum number of characters that the password must have.
       - **Password complexity**: Checks if the password is a combination of lowercase, uppercase, numeric, and non-alphanumeric characters.
       - **Restrict password reuse**: Specifies the number of previous passwords that you can't reuse.
       - **Disallow username**: Prevents the use of the username in the password.
       - **Set password change interval**: Specifies the minimum number of hours after which you can change the password.

    > [!NOTE]
    > Note: When you deselect the **Enable password policies** checkbox, the password policy parameters are reset.

13. In the **Choose region and zonal availability** section, select the region and zone for your instance. Region availability might be different based on your Cloud SQL for PostgreSQL edition. For more information, see [About instance settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt).

    Place your instance in the same region as the resources that
    access it. The region you select can't be modified in the future. In most
    cases, you don't need to specify a zone.

    > [!NOTE]
    > **Note:** If there is a resource location constraint on your organization policy, you must select one of the regions that the organization policy allows. You see a message about Resource Location Restriction in the **Choose region and zonal availability** section if a constraint exists. [Learn more](https://docs.cloud.google.com/resource-manager/docs/organization-policy/defining-locations).

    If you are configuring your instance for
    [high availability](https://docs.cloud.google.com/sql/docs/postgres/high-availability.md.txt),
    you can select both a primary and secondary zone.

    The following conditions apply when the secondary zone is used during
    instance creation:
    - The zones default to `Any` for the primary zone and `Any (different from primary)` for the secondary zone.
    - If both the primary and secondary zones are specified, they must be distinct zones.
14. In the **Customize your instance** section, update the settings for your instance. Click **Show configuration option** to display the groups of settings. Then, expand the groups you want to review and customize settings. A **Summary** of all the options you select is shown on the right. Customizing these instance settings is optional. Defaults are assigned in every case where no customizations are made.

    The following table is a quick reference to instance settings. For more
    details about each setting, see the
    [instance settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt)
    page.

    | Setting | Notes |
    |---|---|
    | **Machine type** ||
    | Machine type | Select from Shared core or Dedicated core. For Shared core, each machine type is classified by the number of CPUs (cores) and amount of memory for your instance. |
    | Cores | The number of vCPUs for your instance. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#cpus-postgres). |
    | Memory | The amount of memory for your instance, in GBs. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#memory-postgres). |
    | Custom | For the Dedicated core machine type, instead of selecting a predefined configuration, select the **Custom** button to create an instance with a custom configuration. When you select this option, you need to select the number of cores and amount of memory for your instance. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/create-instance.md.txt#machine-types). |
    | **Data cache** ||
    | Enable data cache | By default, the option to enable data cache is selected automatically for Cloud SQL for PostgreSQL Enterprise Plus edition instances. If you don't want to enable data cache, then clear the **Enable data cache** checkbox. For more information about data cache, see [data cache](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#data-cache-postgres). |
    | **Storage** ||
    | Storage type | Determines whether your instance uses SSD or HDD storage. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#storage-type-2ndgen). |
    | Storage capacity | The amount of storage provisioned for the instance. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#storage-capacity-2ndgen). |
    | Enable automatic storage increases | Determines whether Cloud SQL automatically provides more storage for your instance when free space runs low. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#automatic-storage-increase-2ndgen). |
    | **Encryption** ||
    | Google-managed encryption | The default option. |
    | Customer key-managed encryption key (CMEK) | Select to use your key with Google Cloud Key Management Service. [Learn more](https://docs.cloud.google.com/sql/docs/mysql/cmek.md.txt). |
    | **Connections** ||
    | Private IP | Adds a private IP address for your instance. Choose either a [private services access](https://docs.cloud.google.com/sql/docs/postgres/about-private-services-access.md.txt) connection, a [Private Service Connect](https://docs.cloud.google.com/sql/docs/postgres/about-private-service-connect.md.txt) connection, or both for your instance. Your selection provides the private network connection for your instance. In all cases, additional configuration is required. <br /> To select and configure private services access, do the following: 1. Select the **Private Services Access (PSA)** checkbox. 2. From the **VPC network** drop-down menu, select the name of the network that your instance connects to. 3. From the **Allocated IP range** drop-down menu, select **Automatic** or a specific named IP range from the drop-down menu. For more information about configuring private services access, see [Configure private services access](https://docs.cloud.google.com/sql/docs/mysql/configure-private-services-access.md.txt). Your instance can have both a public IP address and a private IP address. To select and configure Private Service Connect, do the following: 1. Select the **Private Service Connect (PSC)** checkbox. 2. Click **Add an Endpoint**. 3. In the **Endpoint setup** section, do the following: - In the **New Endpoint** card, select the project where you want to set up the endpoint from the **Project** drop-down. - Select a network for your endpoint from the **Network** drop-down. - If the Network Connectivity API isn't enabled yet, then click **Enable**. 4. To set up the permissions for creating the service connection policy automatically, click **Confirm Network Setup**. For more information about configuring Private Service Connect, see [Configure Private Service Connect](https://docs.cloud.google.com/sql/docs/postgres/configure-private-service-connect.md.txt). - Learn more about [Private IP connection options](https://docs.cloud.google.com/sql/docs/postgres/connect-overview#private-ip). - Learn more about [allocated IP address ranges](https://docs.cloud.google.com/sql/docs/postgres/private-ip.md.txt#allocated_ip_address_ranges). > [!NOTE] > **Note:** Cloud SQL generates a write endpoint automatically for your Cloud SQL Enterprise Plus edition instance if you do the following: > 1. If you haven't already enabled the Cloud DNS API, [enable the Cloud DNS API](https://docs.cloud.google.com/sql/docs/postgres/configure-private-ip#connect-write-endpoint) for your Google Cloud project. > 2. [Enable the Cloud DNS API](https://docs.cloud.google.com/sql/docs/postgres/configure-private-ip#connect-write-endpoint) for your Google Cloud project (if this API isn't enabled). > 3. Add a private IP address to the instance. > 4. Specify an associated network for the instance. > 5. Optionally, specify an allocated IP range for the instance. |
    | Public IP | Adds a public IP address for your instance. You can then add authorized networks to connect to the instance. Your instance can have both a public and a private IP address. Learn more about using [public IP](https://docs.cloud.google.com/sql/docs/postgres/connect-overview#public_ip). |
    | Authorized networks | Add the name for the new network and the Network address. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/authorize-networks.md.txt#authorized-networks). |
    | Allow Data API | By selecting this checkbox, you let authorized users to call the [Data API](https://docs.cloud.google.com/sql/docs/postgres/executesql-instance.md.txt) to execute SQL statements on the instance. For instances with Private IP only, this allows authorized users to call the Data API from the public internet. |
    | Enable private path | By selecting this checkbox, you let other Google Cloud services, such as BigQuery, access data in Cloud SQL and make queries against this data over a private connection. <br /> > [!NOTE] > **Note:** This checkbox is enabled only if you select the **Private IP** check box, and you add or select an authorized network to create a private connection. <br /> |
    | Enable Managed Connection Pooling | By selecting this checkbox, you enable Managed Connection Pooling for your instance. Managed Connection Pooling lets you scale your workloads by optimizing resource utilization and connection latency Cloud SQL instances using pooling and multiplexing. For more information about Managed Connection Pooling, see [Managed Connection Pooling overview](https://docs.cloud.google.com/sql/docs/postgres/managed-connection-pooling.md.txt). |
    | **Security** ||
    | Server certificate authority mode | Choose the type of certificate authority (CA) that signs the server certificate for this Cloud SQL instance. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/authorize-ssl.md.txt#certificate_authority_ca_hierarchies). By default, when you create an instance in Google Cloud console, the instance uses the **Google managed internal certificate authority** (`GOOGLE_MANAGED_INTERNAL_CA`), which is the per-instance CA option. |
    | Automatic server certificate rotation | If you select either the Google-managed CAS certificate authority (CA) (`GOOGLE_MANAGED_CAS_CA`) or the customer-managed CAS internal certificate authority (`CUSTOMER_MANAGED_CAS_CA`) option as the server CA mode for the instance, then you can choose whether to rotate the server certificate for the instance automatically. For more information about rotating Cloud SQL server certificates automatically, see [Enable automatic server certificate rotation](https://docs.cloud.google.com/sql/docs/postgres/manage-ssl-instance.md.txt#automatic-server-certificate-rotation-cas). By default, this option is disabled. |
    | **Data protection** ||
    | Backup tier | The [backup option](https://docs.cloud.google.com/sql/docs/postgres/backup-recovery/backup-options.md.txt) of your instance. You can choose between [enhanced backups](https://docs.cloud.google.com/sql/docs/postgres/backup-recovery/backup-options.md.txt#enhanced-backups) and [standard backups](https://docs.cloud.google.com/sql/docs/postgres/backup-recovery/backup-options.md.txt#standard-backups). |
    | Automate backups | The window of time when you would like backups to start. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#backups-postgres). |
    | Choose where to store your backups | Select Multi-region for most use cases. If you need to store backups in a specific region, for example, if there are regulatory reasons to do so, select Region and select your region from the Location drop-down menu. |
    | Choose how many automated backups to store | The number of automated backups you would like to retain (from 1 to 365 days). [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#backup-retention). |
    | Enable point-in-time recovery | Enables point-in-time recovery and write-ahead logging. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#backups-and-binary-logging-2ndgen). > [!NOTE] > **Note:** > To speed up instance creation when PITR is enabled, Cloud SQL uses an initial > [instant snapshot](https://docs.cloud.google.com/compute/docs/disks/instant-snapshots.md.txt) for PITR instead of a > [standard backup](https://docs.cloud.google.com/sql/docs/mysql/backup-recovery/backups.md.txt#backup-options). > This snapshot is later converted to a standard backup in the background to support restore > operations. > PITR is enabled by default during instance creation in the following conditions: > In **Cloud SQL Enterprise Plus edition**: > - PITR is enabled by default, regardless of how you create the instance. > In **Cloud SQL Enterprise edition**: > - If you create the instance in Google Cloud console, PITR is enabled by default. > - If you create the instance using [gcloud CLI](https://docs.cloud.google.com/sdk/gcloud.md.txt), Terraform, or Cloud SQL Admin API, then PITR is disabled by default. In this case, you must enable PITR manually if you want to use it. |
    | Enable deletion protection | Determines whether to protect an instance against accidental deletion. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/deletion-protection.md.txt). |
    | Enable retained backups after instance deletion | Determines whether automated and on-demand backups are retained after an instance is deleted. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/backup-recovery/backups.md.txt#retained-backups). |
    | Choose how many days of logs to retain | Configure write-ahead log retention from 1 to 7 days. The default setting is 7 days. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#transaction-log-retention). |
    | **Maintenance** ||
    | Preferred window | Determines a one-hour window when Cloud SQL can perform disruptive maintenance on your instance. If you do not set the window, then disruptive maintenance can be done at any time. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#maintenance-window-2ndgen). |
    | Order of updates | Your preferred timing for instance updates, relative to other instances in the same project. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#maintenance-timing-2ndgen). |
    | **Flags** ||
    | ADD FLAG | You can use database flags to control settings and parameters for your instance. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/flags.md.txt). |
    | **Query insights** ||
    | Enable Query insights | By selecting this checkbox, you enable query insights for your instance. Query insights provides you with detailed information about your database queries, including query performance, query text, and query execution plans. After you select query insights, you can enable additional features that are associated with query insights. For more information about these features and query insights, see [Use query insights to improve query performance](https://docs.cloud.google.com/sql/docs/postgres/using-query-insights.md.txt). |
    | **Labels** ||
    | ADD LABEL | Add a key and value for each label that you add. You use labels to help organize your instances. |

15. Click **Create Instance** .

    Note: It might take a few minutes to create your instance. However,
    you can [view information about the
    instance](https://docs.cloud.google.com/sql/docs/postgres/instance-info) while it's being created.

### gcloud

For information about installing and getting started with the
[gcloud CLI](https://docs.cloud.google.com/sdk/gcloud.md.txt), see
[Installing gcloud CLI](https://docs.cloud.google.com/sdk/docs/install).
For information about starting Cloud Shell, see the
[Cloud Shell documentation](https://docs.cloud.google.com/shell/docs/starting-cloud-shell).

1. Use the [`gcloud sql instances create`](https://docs.cloud.google.com/sdk/gcloud/reference/sql/instances/create.md.txt) command to create the instance:

For Cloud SQL Enterprise Plus edition instances:

```bash
    gcloud sql instances create INSTANCE_NAME \
    --database-version=DATABASE_VERSION \
    --region=REGION \
    --tier=TIER \
    --edition=ENTERPRISE_PLUS
    
```

> [!NOTE]
> **Note**: If the database version for your instance is PostgreSQL 16 or later, then the default edition is Cloud SQL Enterprise Plus edition.

<br />

For Cloud SQL Enterprise edition instances:

```bash
    gcloud sql instances create INSTANCE_NAME \
    --database-version=DATABASE_VERSION \
    --region=REGION \
    --cpu=NUMBER_CPUS \
    --memory=MEMORY_SIZE \
    --edition=ENTERPRISE
    
```

> [!NOTE]
> **Note** : If you either don't specify a database version or you specify a version other than PostgreSQL 16 or later, then the default edition is Cloud SQL Enterprise edition.
>
> If you specify PostgreSQL 16 or later for
> the database version of your instance, but you create the instance in a region
> that doesn't have [region support](https://docs.cloud.google.com/sql/docs/editions-intro#editions-regions)
> for Cloud SQL Enterprise Plus edition, then you must create an Cloud SQL Enterprise edition instance.

Or, alternatively, you can use the `--tier` flag if you choose `db-f1-micro` or `db-g1-small` as the machine type:

```bash
    gcloud sql instances create INSTANCE_NAME \
      --tier=API_TIER_STRING \
      --region=REGION
  
```
2. There are restrictions on the values for vCPUs and memory size:
   - vCPUs must be either 1 or an even number between 2 and 96 (up to 80 in [select regions](https://docs.cloud.google.com/sql/docs/postgres/region-availability-overview.md.txt#enterprise-edition-regions)).
   - Memory must be:
     - 0.9 to 6.5 GB per vCPU
     - A multiple of 256 MB
     - At least 3.75 GB (3840 MB)
3. For example, the following command creates a Cloud SQL Enterprise edition instance with two vCPUs and 7,680 MB of memory:

```bash
  gcloud sql instances create myinstance \
  --database-version=POSTGRES_16 \
  --cpu=2 \
  --memory=7680MB \
  --region=us-central1
  
```
4. The following command creates a Cloud SQL Enterprise Plus edition instance with four cores:

```bash
  gcloud sql instances create myinstance \
  --database-version=POSTGRES_16 \
  --tier=db-perf-optimized-N-4 \
  --edition=ENTERPRISE_PLUS \
  --region=us-central1
  
```
See [Choose a machine
series](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview) for more information about how to size compute (`--cpu`) and memory (`--memory`).
5. The default value for <var translate="no">REGION</var> is `us-central1`.
6. Don't include sensitive or personally identifiable information in your instance name; it is externally visible.   
   You do not need to include the project ID in the instance name. This is done automatically where appropriate (for example, in the log files).
7. If you are creating an instance for [high availability](https://docs.cloud.google.com/sql/docs/postgres/high-availability.md.txt), you can specify both the primary and secondary zones, using the `--zone` and `--secondary-zone` parameters. The following conditions apply when the secondary zone is used during instance creation or edit:
   - The zones must be valid zones.
   - If the secondary zone is specified, the primary must also be specified.
   - If the primary and secondary zones are specified, they must be distinct zones.
   - If the primary and secondary zones are specified, they must belong to the same region.
8. You can add more [parameters](https://docs.cloud.google.com/sdk/gcloud/reference/sql/instances/create.md.txt) to determine other instance settings:

| Setting | Parameter | Notes |
|---|---|---|
| **Required parameters** |||
| Database version | `--database-version` | The [database version](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#settings-2ndgen), which is based on your Cloud SQL edition. |
| Region | `--region` | [See valid values](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#region-values). > [!NOTE] > **Note:** Some organizations use an organization policy to restrict resource locations. If this type of policy affects your project, you can only select regions the organization policy allows. In the **Location** drop-down menu in the Console, the locations that are not allowed are unavailable. [Learn more](https://docs.cloud.google.com/resource-manager/docs/organization-policy/defining-locations). |
| **Set password policy** |||
| Enable password policy | `--enable-password-policy` | Enables the password policy when used. By default, the password policy is disabled. When disabled using the `--clear-password-policy` parameter, the other password policy parameters are reset. > [!NOTE] > Note: When you enable a password policy, statements that create users or change user passwords can cause additional latency due to password policy verification. |
| Minimum length | `--password-policy-min-length` | Specifies the minimum number of characters that the password must have. |
| Password complexity | `--password-policy-complexity` | Enables the password complexity check to ensure that the password contains one of each of these types of characters: lowercase, uppercase, numeric, and non-alphanumeric. Set the value to `COMPLEXITY_DEFAULT`. |
| Restrict password reuse | `--password-policy-reuse-interval` | Specifies the number of previous passwords that you can't reuse. |
| Disallow username | `--password-policy-disallow-username-substring` | Prevents the use of the username in the password. Use the `--no-password-policy-disallow-username-substring` parameter to disable the check. |
| Set password change interval | `--password-policy-password-change-interval` | Specifies the minimum duration after which you can change the password, for example, 2m for 2 minutes. |
| **Connectivity** |||
| Managed Connection Pooling | `--enable-connection-pooling` | Enables [Managed Connection Pooling](https://docs.cloud.google.com/sql/docs/postgres/managed-connection-pooling.md.txt) in the new instance. You can configure advanced Managed Connection Pooling settings after your instance is created. **Note:** This feature is only available for Cloud SQL Enterprise Plus edition instances that are configured to meet Managed Connection Pooling [requirements.](https://docs.cloud.google.com/sql/docs/postgres/managed-connection-pooling.md.txt#requirements) |
| Private IP | **Private services access** `--network` `--no-assign-ip` (optional) `--allocated-ip-range-name` (optional) `--enable-google-private-path` (optional) <br /> <br /> **Private Service Connect** `--no-assign-ip` `--enable-private-service-connect` `--allowed-psc-projects` `--psc-auto-connections` `--enable-psc-auto-connection-policy` | `--network`: specifies the name of the VPC network you want to use for this instance. Private services access must already be configured for the network. On new or empty projects, you must enable `servicenetworking.googleapis.com`, allocate an IP range, and configure VPC Network Peering before creating the instance. Available only for the beta command (`gcloud beta sql instances create`). `--no-assign-ip`: Instance will only have a private IP address. `--allocated-ip-range-name`: if specified, sets a range name for which an IP range is allocated. For example, `google-managed-services-default`. The range name should comply with `RFC-1035` and be within 1-63 characters. (`gcloud alpha sql instances create`). `--enable-google-private-path`: if you use this parameter, then you allow other Google Cloud services, such as BigQuery, to access data in Cloud SQL and make queries against this data over a private connection. This parameter is valid only if: - You use the `--no-assign-ip` parameter. - You use the `--network` parameter to specify the name of the VPC network that you want to use to create a private connection. > [!NOTE] > **Note:** Cloud SQL generates a write endpoint automatically for your Cloud SQL Enterprise Plus edition instance if you do the following: > 1. [Enable the Cloud DNS API](https://docs.cloud.google.com/sql/docs/postgres/configure-private-ip#connect-write-endpoint) for your Google Cloud project (if this API isn't enabled). > 2. Add a private IP address to the instance. > 3. Specify an associated network for the instance. > 4. Optionally, specify an allocated IP range for the instance. For Cloud SQL instances that use Private Service Connect for private IP connections, use the following flags: `--enable-private-service-connect`: enables private network connections to the Cloud SQL instance using Private Service Connect. For more information, see [Overview of Private Service Connect in Cloud SQL](https://docs.cloud.google.com/sql/docs/postgres/about-private-service-connect.md.txt). `--allowed-psc-projects`: a comma-separated list of allowed project IDs or numbers from where Private Service Connect endpoints can connect to Cloud SQL instances. `--psc-auto-connections`: if you're setting up endpoints automatically for a Cloud SQL instance, then use the flag to specify the consumer networks and projects for the Private Service Connect endpoints. `--enable-psc-auto-connection-policy`: if specified, Google Cloud creates or updates a service connection policy in the consumer network and project for the Private Service Connect endpoint. For more information about configuring Private Service Connect, see [Configure Private Service Connect](https://docs.cloud.google.com/sql/docs/postgres/configure-private-service-connect.md.txt). |
| Data API Access | `--data-api-access` | Controls connectivity to the instance using [Data API](https://docs.cloud.google.com/sql/docs/postgres/executesql-instance.md.txt). It's disallowed by default. Set the value to `ALLOW_DATA_API` to let users use the Data API to connect to the instance. For instances configured with a private IP address only, authorized users can call the Data API on the instance from the public internet. Set the value to `DISALLOW_DATA_API` to disallow using the Data API. |
| Public IP | `--authorized-networks` | For public IP connections, only connections from authorized networks can connect to your instance. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/configure-ip.md.txt). |
| SSL Enforcement | `--ssl-mode` `--require-ssl` | The `ssl-mode` parameter enforces the SSL/TLS enforcement for the connections. For more information, see [Settings for Cloud SQL for PostgreSQL](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#ssl-mode). The `require-ssl` parameter determines whether SSL connections over IP are enforced or not. `require-ssl` is a legacy parameter. Use `ssl-mode` instead. For more information, see [IpConfiguration](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances.md.txt#ipconfiguration). |
| Server CA mode | `--server-ca-mode` | The `--server-ca-mode` flag configures the type of [server certificate authority (CA)](https://docs.cloud.google.com/sql/docs/postgres/authorize-ssl.md.txt#certificate_authority_ca_hierarchies) for an instance. You can select one of the following options: - `GOOGLE_MANAGED_INTERNAL_CA`: this is the default value. With this option, an internal CA dedicated to each Cloud SQL instance signs the server certificate for that instance. - `GOOGLE_MANAGED_CAS_CA`: with this option, a CA hierarchy consisting of a root CA and subordinate server CAs managed by Cloud SQL and hosted on Google Cloud Certificate Authority Service (CA Service) is used. The subordinate server CAs in a region sign the server certificates and are shared across instances in the region. - `CUSTOMER_MANAGED_CAS_CA`: with this option, you define the CA hierarchy and manage the rotation of the CA certificates. You create a CA pool in CA Service in the same region of your instance. One of the CAs in the pool is used to sign the server certificate. For more information, see [Use a customer-managed CA](https://docs.cloud.google.com/sql/docs/postgres/customer-managed-ca.md.txt). |
| Automatic server certificate rotation | `--server-certificate-rotation-mode` | The `--server-certificate-rotation-mode` flag configures the type of server certificate rotation mode of the instance. You can select one of the following options: - `NO_AUTOMATIC_ROTATION`: this is the default value. With this option, there won't be no automatic server certificate rotation. Server certificates must be rotated manually. - `AUTOMATIC_ROTATION_DURING_MAINTENANCE`: With this option, automatic server certificate rotation is enabled during Cloud SQL scheduled maintenance or self-service maintenance updates. Requires `server_ca_mode` to be `GOOGLE_MANAGED_CAS_CA` or `CUSTOMER_MANAGED_CAS_CA`. |
| Network architecture | [`--enforce-new-sql-network-architecture`](https://docs.cloud.google.com/sdk/gcloud/reference/beta/sql/instances/create.md.txt#--enforce-new-sql-network-architecture) | Enforce the use of the new network architecture for the instance upon creation. Using this flag when you create an instance before that project has been fully upgraded to the new network architecture can lead to IP address overconsumption or a failure to create instances if there aren't sufficient IP addresses remaining in the allocated IP range. For more information, see [Upgrade an instance to the new network architecture](https://docs.cloud.google.com/sql/docs/postgres/upgrade-cloud-sql-instance-new-network-architecture.md.txt) and [Allocate an IP address range](https://docs.cloud.google.com/sql/docs/postgres/private-ip.md.txt#allocated-ip). |
| **Machine type and storage** |||
| Machine type | `--tier` | Used to specify a shared-core instance (`db-f1-micro` or `db-g1-small`). For a custom instance configuration, use the `--cpu` or `--memory` parameters instead. See [Choose a machine series](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt) for possible configurations. |
| Storage type | `--storage-type` | Determines whether your instance uses SSD or HDD storage. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#storage-type-2ndgen). |
| Storage capacity | `--storage-size` | The amount of storage provisioned for the instance, in GB. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#storage-capacity-2ndgen). |
| Automatic storage increase | `--storage-auto-increase` | Determines whether Cloud SQL automatically provides more storage for your instance when free space runs low. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#automatic-storage-increase-2ndgen). |
| Automatic storage increase limit | `--storage-auto-increase-limit` | Determines how large Cloud SQL can automatically grow storage, in GB. The default value is `unlimited`, which allows storage to grow up to the maximum available storage for the instance tier. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#automatic-storage-increase-limit-2ndgen). |
| Data cache (optional) | `--enable-data-cache` | Enables or deactivates the data cache for instances. For more information, see [data cache](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#data-cache-postgres). |
| **Automatic backups and high availability** |||
| High availability | `--availability-type` | For a highly-available instance, set to `REGIONAL`. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/configure-ha.md.txt). |
| Secondary zone | `--secondary-zone` | If you're creating an instance for [high availability](https://docs.cloud.google.com/sql/docs/postgres/high-availability.md.txt), you can specify both the primary and secondary zones using the `--zone` and `--secondary-zone parameters`. The following restrictions apply when the secondary zone is used during instance creation or edit: - The zones must be valid zones. - If the secondary zone is specified, the primary must also be specified. - If the primary and secondary zones are specified, they must be distinct zones. - If the primary and secondary zones are specified, they must belong to the same region. |
| Automatic backups | `--backup-start-time` | The window of time when you would like backups to start. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#backups-postgres). |
| Retention settings for automated backups | `--retained-backups-count` | The number of automated backups to retain. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/backup-recovery/backups.md.txt#retention). |
| Retention settings for binary logging | `--retained-transaction-log-days` | The number of days to retain write-ahead logs for point-in-time recovery. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/backup-recovery/backups.md.txt#retention). |
| Point-in-time recovery | `--enable-point-in-time-recovery` | Enables point-in-time recovery and write-ahead logging. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#backups-postgres). |
| > [!NOTE] > **Note:** > To speed up instance creation when PITR is enabled, Cloud SQL uses an initial > [instant snapshot](https://docs.cloud.google.com/compute/docs/disks/instant-snapshots.md.txt) for PITR instead of a > [standard backup](https://docs.cloud.google.com/sql/docs/mysql/backup-recovery/backups.md.txt#backup-options). > This snapshot is later converted to a standard backup in the background to support restore > operations. > PITR is enabled by default during instance creation in the following > conditions: > In **Cloud SQL Enterprise Plus edition**: > - PITR is enabled by default, regardless of how you create the instance. > In **Cloud SQL Enterprise edition**: > - If you create the instance in the Google Cloud console, PITR is enabled by default. > - If you create the instance using the [gcloud CLI](https://docs.cloud.google.com/sdk/gcloud.md.txt), Terraform, or the Cloud SQL Admin API, then PITR is disabled by default, and you must enable PITR manually to use it. |||
| **Add database flags** |||
| Database flags | `--database-flags` | You can use database flags to control settings and parameters for your instance. [Learn more about database flags](https://docs.cloud.google.com/sql/docs/postgres/flags.md.txt). |
| **Maintenance schedule** |||
| Maintenance window | `--maintenance-window-day`, `--maintenance-window-hour` | Determines a one-hour window when Cloud SQL can perform disruptive maintenance on your instance. If you don't set the window, then disruptive maintenance can be done at any time. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#maintenance-window-2ndgen). |
| Maintenance timing | `--maintenance-release-channel` | Your preferred timing for instance updates, relative to other instances in the same project. Use `preview` for earlier updates, and `production` for later updates. [Learn more](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#maintenance-timing-2ndgen). |
| **[Integration with Vertex AI](https://docs.cloud.google.com/sql/docs/postgres/integrate-cloud-sql-with-vertex-ai.md.txt)** |||
|   | `--enable-google-ml-integration` | Enables Cloud SQL instances to connect to Vertex AI to pass requests for [real-time predictions](https://docs.cloud.google.com/vertex-ai/docs/predictions/overview) and insights to the AI. |
|   | `--database-flags cloudsql.enable_google_ml_integration=on` | By turning this flag on, Cloud SQL can integrate with Vertex AI. |
| **[Query insights](https://docs.cloud.google.com/sql/docs/postgres/using-query-insights.md.txt)** |||
|   | `--insights-config-query-insights-enabled` | Enables query insights to provide query and query plan analytics. |
| **Custom SAN** |||
| Add a custom subject alternative name (SAN) | `--custom-subject-alternative-names=DNS_NAMES` | If you want to use a custom DNS name to connect to a Cloud SQL instance instead of using an IP address, then configure the custom subject alternative name (SAN) setting while creating the instance. The custom DNS name that you insert into the custom SAN setting is added to the SAN field of the server certificate of the instance. This lets you use the custom DNS name with hostname validation securely. Before you can use the custom DNS name in your clients and applications, you must set up the mapping between the DNS name and the IP address. This is known as *DNS resolution*. You can add a comma-separated list of up to three custom DNS names to the custom SAN setting. > [!NOTE] > **Note:** This feature is available for [`CUSTOMER_MANAGED_CAS_CA`](https://docs.cloud.google.com/sql/docs/postgres/authorize-ssl.md.txt#ca-hierarchies) instances only. To create the instance, you must use the [`gcloud sql instances create`](https://docs.cloud.google.com/sdk/gcloud/reference/sql/instances/create.md.txt) command. |

9. Note the automatically assigned IP address. If you are not using the Cloud SQL Auth Proxy, you will use this address as the
   host address that your applications or tools use to connect to the
   instance.

10. Set the password for the `postgres` user:

    ```bash
          gcloud sql users set-password postgres \
          --instance=INSTANCE_NAME \
          --password=PASSWORD
          
    ```

### Terraform

To create an instance, use a
[Terraform resource](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance).

```terraform
resource "google_sql_database_instance" "postgres_pvp_instance_name" {
  name             = "postgres-pvp-instance-name"
  region           = "asia-northeast1"
  database_version = "POSTGRES_14"
  root_password    = "abcABC123!"
  settings {
    tier = "db-custom-2-7680"
    password_validation_policy {
      min_length                  = 6
      reuse_interval              = 2
      complexity                  = "COMPLEXITY_DEFAULT"
      disallow_username_substring = true
      password_change_interval    = "30s"
      enable_password_policy      = true
    }
  }
  # set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
  # use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
  deletion_protection = false
}
```

#### Apply the changes

To apply your Terraform configuration in a Google Cloud project, complete the steps in the
following sections.

## Prepare Cloud Shell

1. Launch [Cloud Shell](https://shell.cloud.google.com/).
2. Set the default Google Cloud project
   where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   ```
   export GOOGLE_CLOUD_PROJECT=PROJECT_ID
   ```

   Environment variables are overridden if you set explicit values in the Terraform
   configuration file.

## Prepare the directory

Each Terraform configuration file must have its own directory (also
called a *root module*).

1. In [Cloud Shell](https://shell.cloud.google.com/), create a directory and a new file within that directory. The filename must have the `.tf` extension---for example `main.tf`. In this tutorial, the file is referred to as `main.tf`.

   ```
   mkdir DIRECTORY && cd DIRECTORY && touch main.tf
   ```
2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly created `main.tf`.

   Optionally, copy the code from GitHub. This is recommended
   when the Terraform snippet is part of an end-to-end solution.
3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   ```
   terraform init
   ```

   Optionally, to use the latest Google provider version, include the `-upgrade`
   option:

   ```
   terraform init -upgrade
   ```

## Apply the changes

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   ```
   terraform plan
   ```

   Make corrections to the configuration as necessary.
2. Apply the Terraform configuration by running the following command and entering `yes` at the prompt:

   ```
   terraform apply
   ```

   Wait until Terraform displays the "Apply complete!" message.
3. [Open your Google Cloud project](https://console.cloud.google.com/) to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

> [!NOTE]
> **Note:** Terraform samples typically assume that the required APIs are enabled in your Google Cloud project.

#### Delete the changes

To delete your changes, do the following:

1. To disable deletion protection, in your Terraform configuration file set the `deletion_protection` argument to `false`.

   ```
   deletion_protection =  "false"
   ```
2. Apply the updated Terraform configuration by running the following command and entering `yes` at the prompt:

   ```
   terraform apply
   ```

<!-- -->

3. Remove resources previously applied with your Terraform configuration by running the following
   command and entering `yes` at the prompt:

   ```
   terraform destroy
   ```

### REST v1

> [!CAUTION]
> **Prerequisites for Private IP using private services access on new projects:**
>
> The following API request configures the instance to use private IP (`ipConfiguration.privateNetwork`). Before you create an instance that uses a private IP address using private services access in a new or empty project, you must ensure that the Service Networking API is enabled and that VPC Network Peering is configured for your VPC network. Otherwise, instance creation will fail with `SERVICE_NETWORKING_NOT_ENABLED` or `NETWORK_NOT_PEERED`.
>
> Run the following `gcloud` commands to set up the prerequisites:
>
> 1. **Enable the Service Networking API and the Compute Engine API:**
>
>    ```bash
>    gcloud services enable 
>
>        sqladmin.googleapis.com 
>
>        compute.googleapis.com 
>
>        servicenetworking.googleapis.com 
>
>        --project=PROJECT_ID
>        
>    ```
> 2. **Allocate an IP address range for VPC Network Peering:**
>
>    ```bash
>    gcloud compute addresses create google-managed-services-default 
>
>        --global 
>
>        --purpose=VPC_PEERING 
>
>        --prefix-length=16 
>
>        --network=projects/PROJECT_ID/global/networks/default 
>
>        --project=PROJECT_ID
>        
>    ```
> 3. **Establish the private connection (VPC Network Peering):**
>
>    ```bash
>    gcloud services vpc-peerings connect 
>
>        --service=servicenetworking.googleapis.com 
>
>        --ranges=google-managed-services-default 
>
>        --network=default 
>
>        --project=PROJECT_ID
>        
>    ```
>
> For more details, see [Configure private services access](https://docs.cloud.google.com/sql/docs/postgres/configure-private-services-access.md.txt).

#### Create the instance

This example creates an instance. Some optional parameters, such as
backups and binary logging are also included.
For a complete list of parameters for this call, see the
[Instances:insert](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances/insert.md.txt)
page. For information about instance settings, including valid values for
region, see
[Instance settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#settings-2ndgen).

Don't include sensitive or personally identifiable information
in your instance ID; it is externally visible.   


You do not need to include the project ID in the instance name. This is done automatically where
appropriate (for example, in the log files).


Before using any of the request data,
make the following replacements:

- <var translate="no">PROJECT_ID</var>: your project ID
- <var translate="no">INSTANCE_ID</var>: your instance ID
- <var translate="no">REGION</var>: the region
- <var translate="no">DATABASE_VERSION</var>: enum string of the database version (for example, `POSTGRES_18`)
- <var translate="no">PASSWORD</var>: the password for the root user
- <var translate="no">MACHINE_TYPE</var>: enum string of the machine (tier) type, as: `db-custom-[CPUS]-[MEMORY_MBS]`
- <var translate="no">EDITION_TYPE</var>: your Cloud SQL edition

  > [!NOTE]
  > **Note**: If the database version for your instance is PostgreSQL 16 and later, then the default edition is Cloud SQL Enterprise Plus edition. If you either don't specify a database version or you specify a version other than PostgreSQL 16 and later, then the default edition is Cloud SQL Enterprise edition.
  >
  > If you specify PostgreSQL 16 and later for the database version of your instance, but you create the instance in a region that doesn't have [region support](https://docs.cloud.google.com/sql/docs/editions-intro#editions-regions) for Cloud SQL Enterprise Plus edition, then you must create a Cloud SQL Enterprise edition instance.

- <var translate="no">DATA_CACHE_ENABLED</var>: (optional) set to `true` to enable data cache for your instance
- <var translate="no">PRIVATE_NETWORK</var>: specify the name of the Virtual Private Cloud (VPC) network that you want to use for this instance. Private services access must already be configured for the network.

  > [!NOTE]
  > Cloud SQL generates a write endpoint automatically for your Cloud SQL Enterprise Plus edition instance if you do the following:
  > 1. [Enable the Cloud DNS API](https://docs.cloud.google.com/sql/docs/postgres/configure-private-ip#connect-write-endpoint) for your Google Cloud project (if this API isn't enabled).
  > 2. Add a private IP address to the instance.
  > 3. Specify an associated network for the instance.
  > 4. Optionally, specify an allocated IP range for the instance.

- <var translate="no">AUTHORIZED_NETWORKS</var>: for public IP connections, specify the connections from authorized networks that can connect to your instance.
- <var translate="no">CA_MODE</var>: specify a [certificate authority hierarchy](https://docs.cloud.google.com/sql/docs/postgres/authorize-ssl.md.txt#certificate_authority_ca_hierarchies) for the instance, either `GOOGLE_MANAGED_INTERNAL_CA` or `GOOGLE_MANAGED_CAS_CA`. If you don't specify `serverCaMode`, then the default configuration is `GOOGLE_MANAGED_INTERNAL_CA`.
- <var translate="no">SERVER_CERTIFICATE_ROTATION_MODE</var>: For automatic server certificate rotation for your instance, specify `AUTOMATIC_ROTATION_DURING_MAINTENANCE`. If you don't specify `serverCertificateRotationMode`, then the default configuration is `NO_AUTOMATIC_ROTATION`.
- <var translate="no">DNS_NAMES</var>: add a comma-separated list of up to three DNS names to the [server certificate](https://docs.cloud.google.com/sql/docs/postgres/configure-ssl-instance.md.txt) of your Cloud SQL instance. You can secure multiple DNS names with a single certificate. This feature is available for [`CUSTOMER_MANAGED_CAS_CA`](https://docs.cloud.google.com/sql/docs/postgres/authorize-ssl.md.txt#certificate_authority_ca_hierarchies) instances only.

> [!NOTE]
> **Note:** For the `ipv4Enabled` parameter, set the value to `true`
> if you're using a public IP address for your instance or `false` if your instance has a
> private IP address.
>
> If you set the `enablePrivatePathForGoogleCloudServices` parameter to `true`,
> then you allow other Google Cloud services, such as BigQuery, to access data in
> Cloud SQL and make queries against this data over a private connection. By setting this parameter to
> `false`, other Google Cloud services can't access data in Cloud SQL over a private connection.
>
> If you set `dataApiAccess` to `ALLOW_DATA_API`, then you allow authorized
> users to use [Data API](https://docs.cloud.google.com/sql/docs/postgres/executesql-instance.md.txt) to connect to your instance.
> For Private IP only instances, this allows authorized users to connect from the public internet.

To set a password policy while creating an instance, include the
[passwordValidationPolicy](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances.md.txt#passwordValidationPolicy) object in the request.
Set the following parameters, as required:

- `enablePasswordPolicy`: Enables the password policy when set to `true`.


  To remove the password policy, you can use a `PATCH`
  request with `null` as the value for `enablePasswordPolicy`.
  In this case, the other password policy parameters are reset.

  > [!NOTE]
  > **Note:** When you enable a password policy, statements that create users or change user passwords can cause additional latency due to password policy verification.

- `minLength`: Specifies the minimum number of characters that the password must have.
- `complexity`: Checks if the password is a combination of lowercase, uppercase, numeric, and non-alphanumeric characters. The default value is `COMPLEXITY_DEFAULT`.
- `reuseInterval`: Specifies the number of previous passwords that you can't reuse.
- `disallowUsernameSubstring`: Prevents the use of the username in the password when set to `true`.
- `passwordChangeInterval`: Specifies the minimum duration after which you can change the password. The value is in seconds with up to nine fractional digits, terminated by `s`. For example, `3.5s`.

To create the instance so that it can [integrate with Vertex AI](https://docs.cloud.google.com/sql/docs/postgres/integrate-cloud-sql-with-vertex-ai.md.txt), include the [enableGoogleMlIntegration](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances.md.txt) object in the request. This integration lets you apply large language models (LLMs), which are hosted in Vertex AI, to a Cloud SQL for PostgreSQL database.

Set the following parameters, as required:

- `enableGoogleMlIntegration`: when this parameter is set to `true`, Cloud SQL instances can connect to Vertex AI to pass requests for [real-time predictions](https://docs.cloud.google.com/vertex-ai/docs/predictions/overview) and insights to the AI
- `cloudsql.enable_google_ml_integration`: when this parameter is set to `on`, Cloud SQL can integrate with Vertex AI

You can use the `sqlNetworkArchitecture` field to enforce the use of the new network
architecture for the instance upon creation, even if the project isn't fully upgraded.
For more details about the new network architecture and its implications, see
[Upgrade an instance to the new network architecture](https://docs.cloud.google.com/sql/docs/postgres/upgrade-cloud-sql-instance-new-network-architecture.md.txt) and [Allocate an IP address range](https://docs.cloud.google.com/sql/docs/postgres/private-ip.md.txt#allocated-ip).


HTTP method and URL:

```
POST https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances
```


Request JSON body:

```
{
  "name": "INSTANCE_ID",
  "region": "REGION",
  "databaseVersion": "DATABASE_VERSION",
  "rootPassword": "PASSWORD",
  "settings": {
    "tier": "MACHINE_TYPE",
    "edition": "EDITION_TYPE",
    "enableGoogleMlIntegration": "true" | "false"
    "databaseFlags":
    [
      {
        "name": "cloudsql.enable_google_ml_integration",
        "value": "on" | "off"
      }
    ]
    "dataCacheConfig": {
      "dataCacheEnabled": DATA_CACHE_ENABLED
    },
    "backupConfiguration": {
      "enabled": true
    },
    "passwordValidationPolicy": {
      "enablePasswordPolicy": true
      "minLength": "MIN_LENGTH",
      "complexity": COMPLEXITY_DEFAULT,
      "reuseInterval": "REUSE_INTERVAL",
      "disallowUsernameSubstring": "DISALLOW_USERNAME_SUBSTRING",
      "passwordChangeInterval": "PASSWORD_CHANGE_INTERVAL"
    },
    "ipConfiguration": {
      "privateNetwork": "PRIVATE_NETWORK",
      "authorizedNetworks": [AUTHORIZED_NETWORKS],
      "ipv4Enabled": false,
      "enablePrivatePathForGoogleCloudServices": true,
      "serverCaMode": "CA_MODE",
      "serverCertificateRotationMode": "SERVER_CERTIFICATE_ROTATION_MODE",
      "customSubjectAlternativeNames": "DNS_NAMES"
    },
    "dataApiAccess": "ALLOW_DATA_API"
  },
  "sqlNetworkArchitecture": "NEW_NETWORK_ARCHITECTURE"
}
```

To send your request, expand one of these options:

#### curl (Linux, macOS, or Cloud Shell)

> [!NOTE]
> **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](https://docs.cloud.google.com/sdk/gcloud/reference/init) or [`gcloud auth login`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/login.md.txt) , or by using [Cloud Shell](https://docs.cloud.google.com/shell/docs.md.txt), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/list.md.txt).


Save the request body in a file named `request.json`,
and execute the following command:

```
curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances"
```

#### PowerShell (Windows)

> [!NOTE]
> **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](https://docs.cloud.google.com/sdk/gcloud/reference/init) or [`gcloud auth login`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/login.md.txt) . You can check the currently active account by running [`gcloud auth list`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/list.md.txt).


Save the request body in a file named `request.json`,
and execute the following command:

```
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances" | Select-Object -Expand Content
```

You should receive a JSON response similar to the following:

```
{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2019-09-25T22:19:33.735Z",
  "operationType": "CREATE",
  "name": "OPERATION_ID",
  "targetId": "INSTANCE_ID",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/operations/OPERATION_ID",
  "targetProject": "PROJECT_ID"
}
```

The response is a
[long-running operation](https://docs.cloud.google.com/sql/docs/mysql/admin-api/rest/v1/operations.md.txt),
which might take a few minutes to complete.

#### Retrieve the IPv4 address

Retrieve the automatically assigned IPv4 address for the new instance:


Before using any of the request data,
make the following replacements:

- <var translate="no">project-id</var>: your project ID
- <var translate="no">instance-id</var>: instance ID created in prior step


HTTP method and URL:

```
GET https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id
```

To send your request, expand one of these options:

#### curl (Linux, macOS, or Cloud Shell)

> [!NOTE]
> **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](https://docs.cloud.google.com/sdk/gcloud/reference/init) or [`gcloud auth login`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/login.md.txt) , or by using [Cloud Shell](https://docs.cloud.google.com/shell/docs.md.txt), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/list.md.txt).


Execute the following command:

```
curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id"
```

#### PowerShell (Windows)

> [!NOTE]
> **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](https://docs.cloud.google.com/sdk/gcloud/reference/init) or [`gcloud auth login`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/login.md.txt) . You can check the currently active account by running [`gcloud auth list`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/list.md.txt).


Execute the following command:

```
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id" | Select-Object -Expand Content
```

You should receive a JSON response similar to the following:

```
{
  "kind": "sql#instance",
  "state": "RUNNABLE",
  "databaseVersion": "MYSQL_8_0_18",
  "settings": {
    "authorizedGaeApplications": [],
    "tier": "db-f1-micro",
    "kind": "sql#settings",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration": {
      "authorizedNetworks": [],
      "ipv4Enabled": true
    },
    "locationPreference": {
      "zone": "us-west1-a",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "backupConfiguration": {
      "startTime": "18:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "1",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  },
  "etag": "--redacted--",
  "ipAddresses": [
    {
      "type": "PRIMARY",
      "ipAddress": "10.0.0.1"
    }
  ],
  "serverCaCert": {
    ...
  },
  "instanceType": "CLOUD_SQL_INSTANCE",
  "project": "project-id",
  "serviceAccountEmailAddress": "redacted@gcp-sa-cloud-sql.iam.gserviceaccount.com",
  "backendType": "SECOND_GEN",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id",
  "connectionName": "project-id:region:instance-id",
  "name": "instance-id",
  "region": "us-west1",
  "gceZone": "us-west1-a"
}
```

Look for the `ipAddress` field in the response.

### REST v1beta4

> [!CAUTION]
> **Prerequisites for Private IP using private services access on new projects:**
>
> The following API request configures the instance to use private IP (`ipConfiguration.privateNetwork`). Before you create an instance that uses a private IP address using private services access in a new or empty project, you must ensure that the Service Networking API is enabled and that VPC Network Peering is configured for your VPC network. Otherwise, instance creation will fail with `SERVICE_NETWORKING_NOT_ENABLED` or `NETWORK_NOT_PEERED`.
>
> Run the following `gcloud` commands to set up the prerequisites:
>
> 1. **Enable the Service Networking API and the Compute Engine API:**
>
>    ```bash
>    gcloud services enable 
>
>        sqladmin.googleapis.com 
>
>        compute.googleapis.com 
>
>        servicenetworking.googleapis.com 
>
>        --project=PROJECT_ID
>        
>    ```
> 2. **Allocate an IP address range for VPC Network Peering:**
>
>    ```bash
>    gcloud compute addresses create google-managed-services-default 
>
>        --global 
>
>        --purpose=VPC_PEERING 
>
>        --prefix-length=16 
>
>        --network=projects/PROJECT_ID/global/networks/default 
>
>        --project=PROJECT_ID
>        
>    ```
> 3. **Establish the private connection (VPC Network Peering):**
>
>    ```bash
>    gcloud services vpc-peerings connect 
>
>        --service=servicenetworking.googleapis.com 
>
>        --ranges=google-managed-services-default 
>
>        --network=default 
>
>        --project=PROJECT_ID
>        
>    ```
>
> For more details, see [Configure private services access](https://docs.cloud.google.com/sql/docs/postgres/configure-private-services-access.md.txt).

#### Create the instance


This example creates an instance. Some optional parameters, such as
backups and binary logging are also included.
For a complete list of parameters for this call, see the
[instances:insert](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1beta4/instances/insert.md.txt)
page. For information about instance settings, including valid values for
region, see
[Instance settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt#settings-2ndgen)


Don't include sensitive or personally identifiable information
in your instance ID; it is externally visible.   


You do not need to include the project ID in the instance name. This is done automatically where
appropriate (for example, in the log files).


Before using any of the request data,
make the following replacements:

- <var translate="no">PROJECT_ID</var>: your project ID
- <var translate="no">INSTANCE_ID</var>: your instance ID
- <var translate="no">REGION</var>: the region
- <var translate="no">DATABASE_VERSION</var>: enum string of the database version (for example, `POSTGRES_18`)
- <var translate="no">PASSWORD</var>: the password for the root user
- <var translate="no">MACHINE_TYPE</var>: enum string of the machine (tier) type, as: `db-custom-[CPUS]-[MEMORY_MBS]`
- <var translate="no">EDITION_TYPE</var>: your Cloud SQL edition

  > [!NOTE]
  > **Note**: If the database version for your instance is PostgreSQL 16 and later, then the default edition is Cloud SQL Enterprise Plus edition. If you either don't specify a database version or you specify a version other than PostgreSQL 16 and later, then the default edition is Cloud SQL Enterprise edition.
  >
  > If you specify PostgreSQL 16 and later for the database version of your instance, but you create the instance in a region that doesn't have [region support](https://docs.cloud.google.com/sql/docs/editions-intro#editions-regions) for Cloud SQL Enterprise Plus edition, then you must create a Cloud SQL Enterprise edition instance.

- <var translate="no">DATA_CACHE_ENABLED</var>: (optional) set to `true` to enable data cache for your instance
- <var translate="no">PRIVATE_NETWORK</var>: Specify the name of the Virtual Private Cloud (VPC) network that you want to use for this instance. Private services access must already be configured for the network.
- <var translate="no">AUTHORIZED_NETWORKS</var>: For public IP connections, specify the connections from authorized networks that can connect to your instance.
- <var translate="no">CA_MODE</var>: specify a [certificate authority hierarchy](https://docs.cloud.google.com/sql/docs/postgres/authorize-ssl.md.txt#certificate_authority_ca_hierarchies) for the instance, either `GOOGLE_MANAGED_INTERNAL_CA` or `GOOGLE_MANAGED_CAS_CA`. If you don't specify `serverCaMode`, then the default configuration is `GOOGLE_MANAGED_INTERNAL_CA`.
- <var translate="no">SERVER_CERTIFICATE_ROTATION_MODE</var>: For automatic server certificate rotation for your instance, specify `AUTOMATIC_ROTATION_DURING_MAINTENANCE`. If you don't specify `serverCertificateRotationMode`, then the default configuration is `NO_AUTOMATIC_ROTATION`.
- <var translate="no">DNS_NAMES</var>: add a comma-separated list of up to three DNS names to the [server certificate](https://docs.cloud.google.com/sql/docs/postgres/configure-ssl-instance.md.txt) of your Cloud SQL instance. You can secure multiple DNS names with a single certificate. This feature is available for [`CUSTOMER_MANAGED_CAS_CA`](https://docs.cloud.google.com/sql/docs/postgres/authorize-ssl.md.txt#certificate_authority_ca_hierarchies) instances only.

> [!NOTE]
> **Note:** For the `ipv4Enabled` parameter, set the value to `true`
> if you're using a public IP address for your instance or `false` if your instance has a
> private IP address.
>
> If you set the `enablePrivatePathForGoogleCloudServices` parameter to `true`,
> then you allow other Google Cloud services, such as BigQuery, to access data in
> Cloud SQL and make queries against this data over a private connection. By setting this parameter to
> `false`, other Google Cloud services can't access data in Cloud SQL over a private connection.
>
> If you set `dataApiAccess` to `ALLOW_DATA_API`, then you allow authorized
> users to use the [Data API](https://docs.cloud.google.com/sql/docs/postgres/executesql-instance.md.txt) to connect to and execute SQL statements on your instance.
> For Private IP-only instances, enabling Data API access lets authorized users connect and execute SQL statements from the public internet.

> [!NOTE]
> **Note:** Cloud SQL generates a write endpoint automatically for your Cloud SQL Enterprise Plus edition instance if you do the following:
>
> 1. [Enable the Cloud DNS API](https://docs.cloud.google.com/sql/docs/postgres/configure-private-ip#connect-write-endpoint) for your Google Cloud project (if this API isn't enabled).
> 2. Add a private IP address to the instance.
> 3. Specify an associated network for the instance.
> 4. Optionally, specify an allocated IP range for the instance.

To set a password policy while creating an instance, include the [passwordValidationPolicy](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances.md.txt#passwordValidationPolicy) object in the request.
Set the following parameters, as required:

- `enablePasswordPolicy`: Enables the password policy when set to `true`.


  To remove the password policy, you can use a `PATCH`
  request with `null` as the value for `enablePasswordPolicy`.
  In this case, the other password policy parameters are reset.

  > [!NOTE]
  > **Note:** When you enable a password policy, statements that create users or change user passwords can cause additional latency due to password policy verification.

- `minLength`: Specifies the minimum number of characters that the password must have.
- `complexity`: Checks if the password is a combination of lowercase, uppercase, numeric, and non-alphanumeric characters. The default value is `COMPLEXITY_DEFAULT`.
- `reuseInterval`: Specifies the number of previous passwords that you can't reuse.
- `disallowUsernameSubstring`: Prevents the use of the username in the password when set to `true`.
- `passwordChangeInterval`: Specifies the minimum duration after which you can change the password. The value is in seconds with up to nine fractional digits, terminated by `s`. For example, `3.5s`.

To create the instance so that it can [integrate with Vertex AI](https://docs.cloud.google.com/sql/docs/postgres/integrate-cloud-sql-with-vertex-ai.md.txt), include the [enableGoogleMlIntegration](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1beta4/instances.md.txt) object in the request. This integration lets you apply large language models (LLMs), which are hosted in Vertex AI, to a Cloud SQL for PostgreSQL database.

Set the following parameters, as required:

- `enableGoogleMlIntegration`: when this parameter is set to `true`, Cloud SQL instances can connect to Vertex AI to pass requests for [real-time predictions](https://docs.cloud.google.com/vertex-ai/docs/predictions/overview) and insights to the AI
- `cloudsql.enable_google_ml_integration`: when this parameter is set to `on`, Cloud SQL can integrate with Vertex AI

You can use the `sqlNetworkArchitecture` field to enforce the use of the new network
architecture for the instance upon creation, even if the project isn't fully upgraded.
For more details about the new network architecture and its implications, see
[Upgrade an instance to the new network architecture](https://docs.cloud.google.com/sql/docs/postgres/upgrade-cloud-sql-instance-new-network-architecture.md.txt) and [Allocate an IP address range](https://docs.cloud.google.com/sql/docs/postgres/private-ip.md.txt#allocated-ip).


HTTP method and URL:

```
POST https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances
```


Request JSON body:

```
{
  "name": "INSTANCE_ID",
  "region": "REGION",
  "databaseVersion": "DATABASE_VERSION",
  "rootPassword": "PASSWORD",
  "settings": {
    "tier": "MACHINE_TYPE",
    "edition": "EDITION_TYPE",
    "enableGoogleMlIntegration": "true" | "false"
    "databaseFlags":
    [
      {
        "name": "cloudsql.enable_google_ml_integration",
        "value": "on" | "off"
      }
    ]
    "dataCacheConfig": {
      "dataCacheEnabled": DATA_CACHE_ENABLED
    },
    "backupConfiguration": {
      "enabled": true
    },
    "passwordValidationPolicy": {
      "enablePasswordPolicy": true
      "minLength": "MIN_LENGTH",
      "complexity": COMPLEXITY_DEFAULT,
      "reuseInterval": "REUSE_INTERVAL",
      "disallowUsernameSubstring": "DISALLOW_USERNAME_SUBSTRING",
      "passwordChangeInterval": "PASSWORD_CHANGE_INTERVAL"
    },
    "ipConfiguration": {
      "privateNetwork": "PRIVATE_NETWORK",
      "authorizedNetworks": [AUTHORIZED_NETWORKS],
      "ipv4Enabled": false,
      "enablePrivatePathForGoogleCloudServices": true,
      "serverCaMode": "CA_MODE",
      "serverCertificateRotationMode": "SERVER_CERTIFICATE_ROTATION_MODE",
      "customSubjectAlternativeNames": "DNS_NAMES"
    },
    "dataApiAccess": "ALLOW_DATA_API"
  },
  "sqlNetworkArchitecture": "NEW_NETWORK_ARCHITECTURE"
}
```

To send your request, expand one of these options:

#### curl (Linux, macOS, or Cloud Shell)

> [!NOTE]
> **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](https://docs.cloud.google.com/sdk/gcloud/reference/init) or [`gcloud auth login`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/login.md.txt) , or by using [Cloud Shell](https://docs.cloud.google.com/shell/docs.md.txt), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/list.md.txt).


Save the request body in a file named `request.json`,
and execute the following command:

```
curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances"
```

#### PowerShell (Windows)

> [!NOTE]
> **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](https://docs.cloud.google.com/sdk/gcloud/reference/init) or [`gcloud auth login`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/login.md.txt) . You can check the currently active account by running [`gcloud auth list`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/list.md.txt).


Save the request body in a file named `request.json`,
and execute the following command:

```
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances" | Select-Object -Expand Content
```

You should receive a JSON response similar to the following:

```
{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID",
  "status": "PENDING",
  "user": "user@example.com",
  "insertTime": "2020-01-01T19:13:21.834Z",
  "operationType": "CREATE",
  "name": "OPERATION_ID",
  "targetId": "INSTANCE_ID",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/operations/OPERATION_ID",
  "targetProject": "PROJECT_ID"
}
```


The response is a
[long-running operation](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1beta4/operations.md.txt),
which might take a few minutes to complete.

#### Retrieve the IPv4 address


Retrieve the automatically assigned IPv4 address for the new instance:


Before using any of the request data,
make the following replacements:

- <var translate="no">project-id</var>: your project ID
- <var translate="no">instance-id</var>: instance ID created in prior step


HTTP method and URL:

```
GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id
```

To send your request, expand one of these options:

#### curl (Linux, macOS, or Cloud Shell)

> [!NOTE]
> **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](https://docs.cloud.google.com/sdk/gcloud/reference/init) or [`gcloud auth login`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/login.md.txt) , or by using [Cloud Shell](https://docs.cloud.google.com/shell/docs.md.txt), which automatically logs you into the `gcloud` CLI . You can check the currently active account by running [`gcloud auth list`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/list.md.txt).


Execute the following command:

```
curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id"
```

#### PowerShell (Windows)

> [!NOTE]
> **Note:** The following command assumes that you have logged in to the `gcloud` CLI with your user account by running [`gcloud init`](https://docs.cloud.google.com/sdk/gcloud/reference/init) or [`gcloud auth login`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/login.md.txt) . You can check the currently active account by running [`gcloud auth list`](https://docs.cloud.google.com/sdk/gcloud/reference/auth/list.md.txt).


Execute the following command:

```
$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content
```

You should receive a JSON response similar to the following:

```
{
  "kind": "sql#instance",
  "state": "RUNNABLE",
  "databaseVersion": "MYSQL_8_0_18",
  "settings": {
    "authorizedGaeApplications": [],
    "tier": "db-f1-micro",
    "kind": "sql#settings",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration": {
      "authorizedNetworks": [],
      "ipv4Enabled": true
    },
    "locationPreference": {
      "zone": "us-west1-a",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "backupConfiguration": {
      "startTime": "18:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "1",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  },
  "etag": "--redacted--",
  "ipAddresses": [
    {
      "type": "PRIMARY",
      "ipAddress": "10.0.0.1"
    }
  ],
  "serverCaCert": {
    ...
  },
  "instanceType": "CLOUD_SQL_INSTANCE",
  "project": "project-id",
  "serviceAccountEmailAddress": "redacted@gcp-sa-cloud-sql.iam.gserviceaccount.com",
  "backendType": "SECOND_GEN",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "connectionName": "project-id:region:instance-id",
  "name": "instance-id",
  "region": "us-west1",
  "gceZone": "us-west1-a"
}
```


Look for the `ipAddress` field in the response.
To see how the [underlying REST API request](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1beta4/instances/insert.md.txt) is constructed for this task, see the [APIs Explorer on the instances:insert page](https://docs.cloud.google.com/sql/docs/postgres/admin-api/rest/v1beta4/instances/insert.md.txt).

### Generate the write endpoint

A write endpoint is a global domain name service (DNS) name that resolves to the
IP address of the current primary instance automatically. This endpoint redirects
incoming connections to the new primary instance automatically in case of a replica
[failover or switchover](https://docs.cloud.google.com/sql/docs/postgres/replication/cross-region-replicas.md.txt)
operation. You can use the write endpoint in a SQL connection string instead of
an IP address. By using a write endpoint, you can avoid having to make
application connection changes when a region outage occurs.

For more information about using a write endpoint to connect to an instance, see
[Connect to an instance using a write endpoint](https://docs.cloud.google.com/sql/docs/postgres/connect-to-instance-using-write-endpoint.md.txt).

## Machine types

Determines memory and virtual cores available for your Cloud SQL
instance. You can configure machine types from different machine series.
The availability of different machine series is determined by your
Cloud SQL edition and region.

- **For Cloud SQL Enterprise Plus edition instances:**Cloud SQL offers predefined
  machine types in these machine series:

  - [N2](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt#n2) series.
  - [C4A](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt#c4a) series.
  - [C4](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt#c4) series.
  - [C4D](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt#c4d) series.
- **For Cloud SQL Enterprise edition instances:**Cloud SQL offers both
  predefined and custom machine types in these machine series:

  - [general purpose - shared core](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt#gp-shared-core) series.
  - [general purpose - dedicated core](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt#gp-dedicated-core) series.
  - [N4](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt#n4) series.

If you require real-time processing, such as online transaction
processing (OLTP), make sure that your instance has enough memory to contain
the entire working set. However, there are other factors that can impact
memory requirements, such as number of active connections, and internal
overhead processes. Perform load testing to avoid performance
issues in your production environment.

When you configure your instance, select sufficient memory and vCPUs to handle
your needs, and scale up your instance as your requirements increase. A machine configuration
with insufficient vCPUs might lose its SLA coverage. For more information,
see [Operational guidelines](https://docs.cloud.google.com/sql/docs/postgres/operational-guidelines.md.txt).

For more information, see
[Choose a machine series](https://docs.cloud.google.com/sql/docs/postgres/machine-series-overview.md.txt).

## Troubleshoot

| Issue | Troubleshooting |
|---|---|
| Error message: `The zone or region does not have sufficient resources to handle the request at the moment.` | The selected zone lacks capacity for the requested resources or the VM type at the time of the instance creation request. There might be simultaneous high operational demand in that specific regional location at the time of request. To resolve this issue, retry creating the instance in another zone or retry creating the instance in the same zone that received the error at a different time of day. |
| Error message: `Failed to create subnetwork. Couldn't find free blocks in allocated IP ranges. Please allocate new ranges for this service provider`. | There are no more available addresses in the allocated IP range. There can be several possible scenarios: - The size of the allocated IP range for the private service connection is smaller than /24. - The size of the allocated IP range for the private service connection is too small for the number of Cloud SQL instances. - The requirement on the size of allocated IP range will be larger if instances are created in multiple regions. See [allocated range size](https://docs.cloud.google.com/sql/docs/postgres/private-ip.md.txt#allocated_range_size) To resolve this issue, you can either expand the existing allocated IP range or allocate an additional IP range to the private service connection. For more information, see [Allocate an IP address range](https://docs.cloud.google.com/sql/docs/mysql/configure-private-services-access.md.txt#allocate-ip-address-range). If you used the `--allocated-ip-range-name` flag while creating the Cloud SQL instance, you may only expand the specified IP range. If you're allocating a new range, take care that the allocation doesn't overlap with any existing allocations. After creating a new IP range, update the vpc peering with the following command: ```bash gcloud services vpc-peerings update \ --service=servicenetworking.googleapis.com \ --ranges=OLD_RESERVED_RANGE_NAME,NEW_RESERVED_RANGE_NAME \ --network=VPC_NETWORK \ --project=PROJECT_ID \ --force ``` If you're expanding an existing allocation, take care to increase only the allocation range and not decrease it. For example, if the original allocation was 10.0.10.0/24, then make the new allocation at least 10.0.10.0/23. In general, if starting from a /24 allocation, decrementing the /mask by 1 for each condition (additional instance type group, additional region) is a good rule of thumb. For example, if trying to create both instance type groups on the same allocation, going from /24 to /23 is enough. After expanding an existing IP range, update the vpc peering with following command: ```bash gcloud services vpc-peerings update \ --service=servicenetworking.googleapis.com \ --ranges=RESERVED_RANGE_NAME \ --network=VPC_NETWORK \ --project=PROJECT_ID ``` |
| Error message: `Failed to create subnetwork. Router status is temporarily unavailable. Please try again later. Help Token: [token-ID]`. | Try to create the Cloud SQL instance again. |
| Error message: `HTTPError 400: Invalid request: Incorrect Service Networking config for instance: PROJECT_ID:INSTANCE_NAME:SERVICE_NETWORKING_NOT_ENABLED.` | Enable the [Service Networking API](https://docs.cloud.google.com/service-infrastructure/docs/service-networking/getting-started.md.txt) using the following command and try to create the Cloud SQL instance again. ```bash gcloud services enable servicenetworking.googleapis.com \ --project=PROJECT_ID ``` |
| Error message: `Failed to create subnetwork. Required 'compute.projects.get' permission for PROJECT_ID`. | When you create an instance using with a Private IP address, a service account is created just-in-time using the Service Networking API. If you have only recently enabled the Service Networking API, then the service account might not get created and the instance creation fails. In this case, you must wait for the service account to propagate throughout the system or manually add it with the required permissions. |
| Error message: `More than 3 subject alternative names are not allowed.` | You're trying to use a custom SAN to add more than three DNS names to the server certificate of a Cloud SQL instance. You can't add more than three DNS names to the instance. |
| Error message: `Subject alternative names %s is too long. The maximum length is 253 characters.` | Make sure that any DNS names that you want to add to the server certificate of a Cloud SQL instance don't have more than 253 characters. |
| Error message: `Subject alternative name %s is invalid.` | Verify that the DNS names that you want to add to the server certificate of a Cloud SQL instance meet the following criteria: - They don't have wildcard characters. - They don't have trailing dots. - They meet [RFC 1034](https://datatracker.ietf.org/doc/html/rfc1034) specifications. |
| Error message: `Requested region is not compatible with host project sql.restrictNoncompliantResourceCreation org policy.` Instance creation might also fail with a generic error message, such as `An unknown error occurred` or `INTERNAL`. | Instance creation can fail if the `constraints/sql.restrictNoncompliantResourceCreation` organization policy constraint is enabled on the project, folder, or organization. This constraint is automatically configured during Assured Workloads onboarding and is intended only for regulatory controls within Assured Workloads. It enforces strict compliance requirements, which can limit instance creation to specific compliance regions or require configurations such as customer-managed encryption keys (CMEK). Enabling this constraint outside of an Assured Workloads environment can block instance creation unexpectedly. To resolve this issue, take the following actions: - If you aren't using Assured Workloads, disable the `constraints/sql.restrictNoncompliantResourceCreation` constraint on the project, folder, or organization. - To enforce specific resource controls (such as location, CMEK, or public IP access), use standard predefined constraints (such as `constraints/gcp.resourceLocations`, `constraints/gcp.restrictNonCmekServices`, or `constraints/sql.restrictPublicIp`) or create [custom organization policies](https://docs.cloud.google.com/sql/docs/postgres/org-policy/custom-org-policy.md.txt). For more information, see [Cloud SQL organization policies](https://docs.cloud.google.com/sql/docs/postgres/org-policy/org-policy.md.txt) and [Organization policy constraints](https://docs.cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints). |

## What's next

1. [Create a PostgreSQL database on the instance](https://docs.cloud.google.com/sql/docs/postgres/create-manage-databases.md.txt).
2. [Create PostgreSQL users on the instance](https://docs.cloud.google.com/sql/docs/postgres/create-manage-users.md.txt).
3. [Secure and control access to the instance](https://docs.cloud.google.com/sql/docs/postgres/instance-access-control.md.txt).
4. [Connect to the instance with a PostgreSQL client](https://docs.cloud.google.com/sql/docs/postgres/connect-admin-ip.md.txt).
5. [Import data into the database](https://docs.cloud.google.com/sql/docs/postgres/import-export.md.txt).
6. [Learn about instance settings](https://docs.cloud.google.com/sql/docs/postgres/instance-settings.md.txt).