[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-25。"],[[["\u003cp\u003eAlloyDB instances can be accessed via either private or public IP addresses, with private IPs offering lower latency and enhanced security within a Virtual Private Cloud (VPC).\u003c/p\u003e\n"],["\u003cp\u003eAccess to AlloyDB clusters can be managed through multiple methods, including AlloyDB Language Connectors, the AlloyDB Auth Proxy for IAM-based access control, or VPC firewall rules.\u003c/p\u003e\n"],["\u003cp\u003eAlloyDB supports two primary authentication methods: standard PostgreSQL user roles with usernames and passwords, and IAM user and service accounts using OAuth 2.0 tokens.\u003c/p\u003e\n"],["\u003cp\u003eOnce authenticated and connected, an AlloyDB instance functions like a standard PostgreSQL server, allowing the use of familiar PostgreSQL tools and techniques for data access.\u003c/p\u003e\n"],["\u003cp\u003eAlloyDB instances support outbound connection, which is useful for migrating databases or to connect to an external data source.\u003c/p\u003e\n"]]],[],null,["This page summarizes how to connect to databases served by AlloyDB for PostgreSQL:\n\n- **Networking:** AlloyDB instances use public or private IPs on a\n [Virtual Private Cloud](/vpc/docs/overview) (VPC). Various\n techniques allow secure connections from applications running outside the\n VPC.\n\n- **Authorization:** The AlloyDB Auth Proxy lets you use [Identity and Access Management](/iam/docs/overview) (IAM) to control who has\n access to your data. Your VPC's firewall lets you further tune access to\n AlloyDB resources.\n\n- **Authentication:** Use standard PostgreSQL user-authentication techniques\n to log in to your instances. AlloyDB also supports IAM-based authentication\n using standard PostgreSQL user roles.\n\nNetworking\n\nEven though an AlloyDB instance contains many nodes, your applications\nconnect to an instance through a single, static IP address. This address can be\neither a private to the VPC that you specify when first setting up an instance's\ncluster, or a public IP that allows direct connections from outside of the VPC.\n\nPrivate IP\n\nWhen you configure AlloyDB with private IP, your instance gets\na private IP address within your VPC.\n\nPrivate IP addresses affect connections to your application in two ways:\n\n- Applications running elsewhere within your project's VPC can connect to the\n instance---or to a proxy representing the instance---without additional steps or\n resources.\n\n As an example, [Connect a psql client to an\n instance](/alloydb/docs/connect-psql) shows how to connect to your\n AlloyDB instance by running the `psql` command-line program\n on a Compute Engine VM within your VPC.\n- Applications running outside the VPC require an intermediary service to\n connect to the AlloyDB instance. Solutions include running\n proxy services on a VM within the instance's VPC, or using other\n Google Cloud products to establish a permanent connection between your\n application and your VPC.\n\n For more information, see [Connect to a cluster from outside its\n VPC](/alloydb/docs/connect-external).\n\nConnections over private IP typically provide\nlower latency and limited attack vectors because they don't require traversing\nthe internet.\n\nTo learn more about private IP in AlloyDB, see [Private IP overview](/alloydb/docs/private-ip).\n\nPublic IP\n\nWhen you configure AlloyDB with public IP, your instance gets a\npublic IP address for inbound connections, that is accessible on the public\ninternet. Optionally, you can use *authorized external networks* to specify a\nrange of IP addresses in CIDR format that can access your instance.\n\nWe recommend using public IP with AlloyDB Language Connectors to\nensure secure connections between the client and your instance.\n\nFor more information about adding a public IP and authorized external networks to your\ninstance, see [Connect using public IP](/alloydb/docs/connect-public-ip).\n\nAlloyDB also supports outbound connections\nto your instance. You can enable outbound public IP for migrating a database\ninto AlloyDB directly from an external source using Database Migration Service\nor self-managed `pglogical` setups. AlloyDB also supports\nconnecting to an external data source using foreign data wrappers, such as\n`postgres_fdw` or `oracle_fdw`.\n\nFor more information about enabling outbound public IP, see [Add outbound\nconnectivity to an\ninstance](/alloydb/docs/connect-public-ip#add-outbound-connectivity).\n\nAuthorization\n\nYou can control access to an AlloyDB cluster by using\nAlloyDB Language Connectors, AlloyDB Auth Proxy, or with VPC firewall rules.\n\nAlloyDB Language Connectors\n\nAlloyDB Language Connectors are client libraries that provide automated\nmTLS using TLS 1.3 and IAM\nauthorization when connecting to a AlloyDB cluster.\n\nYou can use these libraries directly from their respective programming languages.\nThey provide the same capabilities as the AlloyDB Proxy without requiring an\nexternal process. This provides improved security and reduced configuration\nrequirements to connect to AlloyDB.\n\nFor more information, see [AlloyDB Language Connectors overview](/alloydb/docs/language-connectors-overview).\n\nControl access with IAM and the AlloyDB Auth Proxy\n\nAlthough you can connect directly to an instance through its IP address, we\nrecommend using the AlloyDB Auth Proxy in production environments. It provides\nIAM-based access control and end-to-end encryption between the proxy and your\ncluster.\n\nFor more information, see [About the\nAlloyDB Auth Proxy](/alloydb/docs/auth-proxy/overview).\n\nLimit VPC access with firewall rules\n\nAs with any cloud-based project, you should tune your VPC's firewall rules to\nrestrict network access only to the IP ranges or subnetworks that your\napplications connect from. This is especially important with external\napplications, as detailed in [Connect to a cluster from outside its\nVPC](/alloydb/docs/connect-external).\n\nFor more information about configuring your VPC's firewall, see [VPC firewall\nrules](/vpc/docs/firewalls).\n\nAuthentication\n\nAlloyDB supports two kinds of database users, each of which has\nits own way of authenticating with your databases:\n\n- Standard PostgreSQL user roles authenticate using a username and password.\n You manage these accounts using ordinary PostgreSQL user-management\n techniques. For more information, see [Manage AlloyDB user\n roles](/alloydb/docs/database-users/about).\n\n- IAM user and service accounts authenticate as database users\n using OAuth 2.0 tokens. You manage these accounts using the\n Google Cloud IAM system. For more information, see\n [Manage IAM authentication](/alloydb/docs/manage-iam-authn).\n\nOnce authenticated with an AlloyDB instance, an application can\ntreat the instance like an ordinary PostgreSQL server. After establishing\nnetworking and authorization routes to an instance, you can use standard\nPostgreSQL techniques to log in to an instance and access your data. This holds\ntrue whether manually logging in with a tool like `psql`, or connecting to your\ndatabase programmatically using a PostgreSQL code library.\n\nTypically, your first authentication with a new an AlloyDB\ncluster involves logging in to its primary instance as its `postgres` user,\nusing the password that you specify when creating the cluster. From there, you\nshould create database users without administrative privileges for your\napplication's use.\n\nWhat's next\n\n- Learn how to [connect to an AlloyDB instance with the `psql`\n command-line shell](/alloydb/docs/connect-psql). This includes instructions\n for setting up a VM within your VPC and installing `psql` on it.\n\n- Learn how to [create a database](/alloydb/docs/database-create).\n\n- Learn how to [install and use the AlloyDB Auth Proxy](/alloydb/docs/auth-proxy/connect)\n to establish secure connections with your AlloyDB instance.\n\n- Learn about connecting using [AlloyDB Language Connectors](/alloydb/docs/language-connectors-overview)."]]
