Connect over public IP with authorized networks

✦TL;DR

Connect Atlan to Cloud SQL for PostgreSQL over the instance's public IP, with Cloud SQL's authorized-networks list and SSL keeping everyone else out.

||

|Connect

The fastest path: Atlan connects to your instance's public IP over TLS, and Cloud SQL's authorized-networks list plus SSL keep everyone else out. Four phases, each labeled with who performs it.

New to these terms?

Read How Cloud SQL connectivity works first (5 minutes). It explains authorized networks, NAT IPs, and SSL modes in plain language.

Prerequisites

• Your Cloud SQL instance has (or may have) a public IP enabled. Private-IP-only and must stay that way? Use the self-deployed runtime instead.
• Someone with the Cloud SQL Admin role in your Google Cloud project for Phases 1–2.
• A database user for Atlan with the permissions from Set up Cloud SQL for PostgreSQL (role, USAGE on each schema, optional SELECT for previews).

Four phases at glance

Phase	What happens	Owner	Typical time
1. Get Atlan's IPs	Find your tenant's egress IPs (self-serve or one ticket)	Atlan User	Minutes (GCP) / 1 business day (AWS/Azure via support)
2. Allowlist	Add the IPs to the instance's authorized networks	Google Cloud admin	15 minutes
3. Align SSL	Check the instance's SSL requirement; match it in Atlan	Google Cloud admin + Atlan User	10 minutes
4. Connect & verify	Create the connection in Atlan and test	Atlan User	30 minutes

Phase 1 - Get Atlan's egress IPs

Owner: Atlan User

1. Find your Atlan tenant's hosting cloud and region: Admin Center → Overview → Deployment.
2. GCP-hosted tenant: copy your region's static NAT IPs from the Atlan Network Details page - self-serve, no ticket.
3. AWS- or Azure-hosted tenant: raise a support ticket with your tenant URL and ask for your tenant's public egress IPs. They're provisioned per tenant - a value copied from another company's setup will not work.

Phase 2 - Add them to authorized networks

Owner: Google Cloud admin

In the Google Cloud console: SQL → your instance → Connections → Networking → Authorized networks → Add a network. Add each Atlan IP as a /32 entry (a single address), or run:

gcloud sql instances patch my-instance \
  --authorized-networks=203.0.113.10/32,203.0.113.11/32  # your region's Atlan IPs + any existing entries

This command replaces the whole list

--authorized-networks overwrites the existing list - include every address that should stay allowed, not just Atlan's. Dropping an existing entry silently breaks someone else's access. Also add all IPs published for your region: Atlan traffic rotates across them, so a partial list causes failures that appear only some of the time.

Phase 3 - Align SSL on both ends

Owner: Google Cloud admin + Atlan User

On the instance's Connections → Security tab, check the SSL setting:

Instance setting	What to do in Atlan
Allow unencrypted and encrypted (default)	Enable SSL in the Atlan connection anyway - this is a public-internet path; there's no good reason to send traffic unencrypted.
Allow only SSL connections	You must enable SSL in the Atlan connection. With SSL off, the server rejects the attempt before your password is checked, with an error ending in SSL off - which looks like an authentication failure but isn't.
Require trusted client certificates	Client-certificate authentication needs coordination - raise a support ticket before proceeding.

Phase 4 - Connect and verify

Owner: Atlan User

1. In Atlan, open New workflow → Cloud SQL for PostgreSQL Assets and choose the Direct extraction method.
2. In Host, enter the instance's public IP (from the instance Overview page) - not the private IP, not the instance connection name. Port is 5432 unless you changed it.
3. Choose your authentication method (Basic, or an IAM option - see Special cases for IAM prerequisites), enter credentials, and click Test connection.

Success checklist

• Test connection passes in the Atlan UI
• Preflight checks pass when you configure the crawler
• A crawl scoped to one small schema completes
• A full scheduled crawl completes

If any step fails, see Troubleshooting Cloud SQL for PostgreSQL connectivity.

Next steps

Crawl Cloud SQL for PostgreSQL: Configure and run the crawler to extract metadata from Cloud SQL