Create instances

This page describes how to create a Cloud SQL for PostgreSQL instance.

For detailed information about all instance settings, see Instance settings.

A newly-created instance has a postgres database.

The maximum number of instances you can have in a single project depends on the network architecture of those instances:

  • New SQL network architecture: You can have up to 1000 instances per project.
  • Old SQL network architecture: You can have up to 100 instances per project.
  • Using both architectures: Your limit will be somewhere between 100 and 1000, depending on the distribution of your instances across the two architectures.

File a support case to request an increase. Read replicas are counted as instances.

Before you begin

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. Install the gcloud CLI.

  5. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  6. To initialize the gcloud CLI, run the following command: 

    gcloud init

  7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  8. Verify that billing is enabled for your Google Cloud project.

  9. Install the gcloud CLI.

  10. If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  11. To initialize the gcloud CLI, run the following command: 

    gcloud init
  12. Make sure you have the following roles on your user account:

    Go to the IAM page

    Learn more about roles and permissions.

Create a PostgreSQL instance

Console

  1. In the Google Cloud console, go to the Cloud SQL Instances page.

    Go to Cloud SQL Instances

  2. Click Create instance.
  3. Select New instance.
  4. On the Choose your database engine panel of the Create an instance page, click Choose PostgreSQL.

  5. In the Choose a Cloud SQL edition section of the Create a SQL Server instance page, select the Cloud SQL edition for your instance: Enterprise or Enterprise Plus.

    For more information about Cloud SQL editions, see Introduction to Cloud SQL editions.

  6. Select the edition preset for your instance. To see the available presets, click the Edition preset menu.
  7. In the Instance info section, select the database version for your instance. To see the available versions, click the Database version menu.

    The database version can't be edited after the instance has been created.

  8. In the Instance ID field of the Instance info pane, enter an ID for your instance.

    You do not need to include the project ID in the instance name. This is done automatically where appropriate (for example, in the log files).

  9. Enter a password for the postgres user.

    10. To see the password in clear text, click the Show password icon.

    You can either enter the password manually or click Generate to have Cloud SQL create a password for you automatically.

  10. Optional: Configure a password policy for the instance as follows:
    1. Select the Enable password policies checkbox.
    2. Click the Set password policy button, set one or more of the following options, and click Save.
      • Minimum length: Specifies the minimum number of characters that the password must have.
      • Password complexity: Checks if the password is a combination of lowercase, uppercase, numeric, and non-alphanumeric characters.
      • Restrict password reuse: Specifies the number of previous passwords that you can't reuse.
      • Disallow username: Prevents the use of the username in the password.
      • Set password change interval: Specifies the minimum number of hours after which you can change the password.
  11. In the Choose region and zonal availability section, select the region and zone for your instance. Region availability might be different based on your Cloud SQL for PostgreSQL edition. For more information, see About instance settings.

    Place your instance in the same region as the resources that access it. The region you select can't be modified in the future. In most cases, you don't need to specify a zone.

    If you are configuring your instance for high availability, you can select both a primary and secondary zone.

    The following conditions apply when the secondary zone is used during instance creation:

    • The zones default to Any for the primary zone and Any (different from primary) for the secondary zone.
    • If both the primary and secondary zones are specified, they must be distinct zones.
  12. In the Customize your instance section, update the settings for your instance. Click Show configuration option to display the groups of settings. Then, expand the groups you want to review and customize settings. A Summary of all the options you select is shown on the right. Customizing these instance settings is optional. Defaults are assigned in every case where no customizations are made.

    The following table is a quick reference to instance settings. For more details about each setting, see the instance settings page.

    Setting Notes
    Machine type
    Machine type Select from Shared core or Dedicated core. For Shared core, each machine type is classified by the number of CPUs (cores) and amount of memory for your instance.
    Cores The number of vCPUs for your instance. Learn more.
    Memory The amount of memory for your instance, in GBs. Learn more.
    Custom For the Dedicated core machine type, instead of selecting a predefined configuration, select the Custom button to create an instance with a custom configuration. When you select this option, you need to select the number of cores and amount of memory for your instance. Learn more.
    Data cache
    Enable data cache By default, the option to enable data cache is selected automatically for Cloud SQL for PostgreSQL Enterprise Plus edition instances. If you don't want to enable data cache, then clear the Enable data cache checkbox. For more information about data cache, see data cache.
    Storage
    Storage type Determines whether your instance uses SSD or HDD storage. Learn more.
    Storage capacity The amount of storage provisioned for the instance. Learn more.
    Enable automatic storage increases Determines whether Cloud SQL automatically provides more storage for your instance when free space runs low. Learn more.
    Encryption
    Google-managed encryptionThe default option.
    Customer key-managed encryption key (CMEK)Select to use your key with Google Cloud Key Management Service. Learn more.
    Connections
    Private IP Adds a private IP address for your instance. Choose either a private services access connection, a Private Service Connect connection, or both for your instance. Your selection provides the private network connection for your instance. In all cases, additional configuration is required.

    To select and configure private services access, do the following:

    1. Select the Private Services Access (PSA) checkbox.
    2. From the VPC network drop-down menu, select the name of the network that your instance connects to.
    3. From the Allocated IP range drop-down menu, select Automatic or a specific named IP range from the drop-down menu.

    For more information about configuring private services access, see Configure private services access. Your instance can have both a public IP address and a private IP address.

    To select and configure Private Service Connect, do the following:

    1. Select the Private Service Connect (PSC) checkbox.
    2. Click Add an Endpoint.
    3. In the Endpoint setup section, do the following:
      • In the New Endpoint card, select the project where you want to set up the endpoint from the Project drop-down.
      • Select a network for your endpoint from the Network drop-down.
      • If the Network Connectivity API isn't enabled yet, then click Enable.
    4. To set up the permissions for creating the service connection policy automatically, click Confirm Network Setup.

    For more information about configuring Private Service Connect, see Configure Private Service Connect.
    Public IP Adds a public IP address for your instance. You can then add authorized networks to connect to the instance.

    Your instance can have both a public and a private IP address.

    Learn more about using public IP.
    Authorized networks

    Add the name for the new network and the Network address. Learn more.
    Allow Data API

    By selecting this checkbox, you let authorized users to call the Data API to execute SQL statements on the instance. For instances with Private IP only, this allows authorized users to call the Data API from the public internet.
    Enable private path

    By selecting this checkbox, you let other Google Cloud services, such as BigQuery, access data in Cloud SQL and make queries against this data over a private connection.
    Enable Managed Connection Pooling

    By selecting this checkbox, you enable Managed Connection Pooling for your instance. Managed Connection Pooling lets you scale your workloads by optimizing resource utilization and connection latency Cloud SQL instances using pooling and multiplexing. For more information about Managed Connection Pooling, see Managed Connection Pooling overview.
    Security
    Server certificate authority mode

    Choose the type of certificate authority (CA) that signs the server certificate for this Cloud SQL instance. Learn more.

    By default, when you create an instance in Google Cloud console, the instance uses the Google managed internal certificate authority (GOOGLE_MANAGED_INTERNAL_CA), which is the per-instance CA option.
    Automatic server certificate rotation

    If you select either the Google-managed CAS certificate authority (CA) (GOOGLE_MANAGED_CAS_CA) or the customer-managed CAS internal certificate authority (CUSTOMER_MANAGED_CAS_CA) option as the server CA mode for the instance, then you can choose whether to rotate the server certificate for the instance automatically. For more information about rotating Cloud SQL server certificates automatically, see Enable automatic server certificate rotation.

    By default, this option is disabled.
    Data protection
    Backup tier The backup option of your instance. You can choose between enhanced backups and standard backups.
    Automate backups The window of time when you would like backups to start. Learn more.
    Choose where to store your backupsSelect Multi-region for most use cases. If you need to store backups in a specific region, for example, if there are regulatory reasons to do so, select Region and select your region from the Location drop-down menu.
    Choose how many automated backups to storeThe number of automated backups you would like to retain (from 1 to 365 days). Learn more.
    Enable point-in-time recovery Enables point-in-time recovery and write-ahead logging. Learn more.
    Enable deletion protection Determines whether to protect an instance against accidental deletion. Learn more.
    Enable retained backups after instance deletion Determines whether automated and on-demand backups are retained after an instance is deleted. Learn more.
    Choose how many days of logs to retain Configure write-ahead log retention from 1 to 7 days. The default setting is 7 days. Learn more.
    Maintenance