Private Service Connect to Cloud SQL
Keep traffic between your GCP-hosted Atlan tenant and your Cloud SQL for PostgreSQL instance entirely on Google's internal network with Private Service Connect.
Traffic between your GCP-hosted Atlan tenant and your Cloud SQL instance stays entirely on Google's internal network. This path is set up together with Atlan support - five phases, including the approval handshake most setups stall on.
PSC endpoints to customer databases are delivered case by case via support tickets. Requires a GCP-hosted Atlan tenant. Raise a support ticket to confirm feasibility for your setup before promising dates to your security team.
Read How Cloud SQL connectivity works first. In particular the socket-and-plug model: your side exposes a service attachment, Atlan creates an endpoint, and you must approve the pending connection.
Five phases at glance
| Phase | What happens | Owner | Typical time |
|---|---|---|---|
| 1. Expose | Enable PSC on the instance / create a service attachment | Google Cloud admin | 1–2 hours |
| 2. Share | Send the service attachment name to Atlan; get Atlan's project ID back | Atlan User + Atlan support | 1 business day |
| 3. Build | Atlan creates the endpoint in its project | Atlan support | 1–2 business days |
| 4. Approve | Accept the pending connection - the critical handshake | Google Cloud admin | 15 minutes (do it promptly) |
| 5. Connect & verify | Point the Atlan connection at the endpoint DNS/IP and test | Atlan User | 30 minutes |
Phase 1 - Expose instance over PSC
Owner: Google Cloud admin
Enable Private Service Connect on the Cloud SQL instance (Connections → Networking) or, for instances fronted by your own networking, create a PSC service attachment. Note the attachment's full name - it looks like:
projects/example-project/regions/us-central1/serviceAttachments/example-cloudsql-psc
Phase 2 - Swap identifiers with Atlan
Owner: Atlan User + Atlan support
- Raise a support request with your tenant URL, the service attachment name(s) (label each environment clearly if you have several), and the port your database listens on.
- Support replies with Atlan's GCP project ID. Add it to the service attachment's accepted projects list - otherwise Atlan's endpoint can never connect.
- Tell support the private DNS name you'd like to use (e.g.
cloudsql.example-corp.internal). Atlan creates a private DNS zone so you can use a stable name instead of a bare IP.
If you're connecting several environments (dev/stage/prod) or several services, say so up front and agree naming with support. Renaming an endpoint later means recreating it.
Phase 3 - Atlan builds endpoint
Owner: Atlan support
Atlan creates a PSC endpoint in its project pointing at your service attachment, typically within 1–2 business days, and replies with the endpoint name, its IP, and the private DNS name (if requested).
Phase 4 - Approve pending connection
Owner: Google Cloud admin
Until accepted, the endpoint exists but carries no traffic - and every connection attempt times out. The lifecycle:
- Created - Atlan builds the endpoint (Phase 3)
- Pending - waiting for your acceptance. Connections time out in this state.
- Accepted - traffic flows. Atlan sees the status flip too.
- Usable - proceed to Phase 5
Accept it in the Google Cloud console on the service attachment's Connected endpoints tab (or confirm the endpoint's project is in the accepted-projects list). Nothing accepts itself - a "we created everything but it still times out" report is, more often than not, an endpoint still sitting in pending.
Phase 5 - Connect and verify
Owner: Atlan User
- In the crawler setup (Direct method), enter the private DNS name - or the endpoint IP if no DNS zone was created - as the Host.
- Click Test connection.
The private DNS name only exists inside Atlan's network - it will not resolve from your laptop, and that's normal. If the crawler can't resolve it either, ask support to verify the private DNS zone; using the endpoint IP directly is a valid stopgap.
Success checklist
- Endpoint status shows Accepted on your service attachment
- Test connection passes in Atlan
- A crawl scoped to one small schema completes
- A full crawl completes on schedule
Next steps
Crawl Cloud SQL for PostgreSQL: Configure and run the crawler to extract metadata from Cloud SQL