Cloud SQL — the three engines, the Enterprise Plus edition, the four ways to connect, and what a maintenance update costs you

Managed MySQL, PostgreSQL and SQL Server. The edition that changes maintenance behaviour, the high-availability shape, the four connection paths and when each is right, and the update category that restarts the instance.

markdownreferencev1530R-TFRTstage: designtrust: officialfamily: databasesservice: cloud-sqlinterface: anycloud SQLMySQLPostgreSQLSQL ServerEnterprise Plus editionhigh availabilitystandby VMpublic IPprivate IPCloud SQL Auth ProxyIAM database authenticationmaintenance update

Created 21 Oct 2026 · Modified 23 Oct 2026 · 1 version

Cloud SQL

1. Three engines, two editions

Engines: MySQL, PostgreSQL, SQL Server.

"Cloud SQL Enterprise Plus edition" is named for PostgreSQL and MySQL. The difference the overview actually states is about downtime, not raw performance: Enterprise Plus can achieve "sub-second downtime" during maintenance.

2. The update categories, and the one that restarts the instance

System updates come in three kinds: hardware, online, and maintenance.

"Maintenance updates" require an "instance restart" — which causes downtime.

Two things follow, and they belong in any migration plan rather than in an incident review:

  1. You can schedule it. The overview says to "schedule maintenance to occur at a time that is the least

disruptive". Set the window at creation; a default window is a production outage at an arbitrary hour.

  1. The edition changes the cost of the restart. If the application cannot tolerate a restart-shaped gap,

that is an Enterprise Plus argument, and it is the clearest one the overview makes.

3. High availability

The HA configuration uses a standby VM in another zone. So HA here is zone-level, within one region — the same shape as a regional Persistent Disk (reference/storage/persistent-disk-and-hyperdisk.md §3) and not cross-region. Cross-region needs read replicas or a different product (reference/databases/alloydb.md, reference/databases/spanner.md).

4. Four ways to connect, in the order to prefer them

MethodUse when
private IPthe default for anything inside Google Cloud. The instance is reachable only from the VPC network
Cloud SQL Auth Proxya client that cannot be in the VPC, or needs IAM-based connection authorisation without managing certificates
IAM database authenticationyou want the database user to be an IAM principal, so there is no database password to hold
public IPlast resort. Reachable from the internet, with authorised networks as the only perimeter

Combine private IP with IAM database authentication and the design has no database credential at all — the connection is authorised by the workload's own identity. That is the shape patterns/cloud-run-to-cloud-sql-with-iam.md builds, and it is the single biggest security improvement available when a self-managed database moves to Cloud SQL.

5. An absence, recorded

The overview states no version end-of-support information. Database major-version retirement is a real and dated thing on every managed-database service, and it is one of the highest-value facts a migration plan can carry. It is not on this page, so it is not stated here: read the engine-specific version-policy page before planning a move onto a particular major version.

Next: reference/databases/errors.md, guides/databases/connect-to-cloud-sql-with-iam-auth.md, and guides/parity/databases.md for RDS/Aurora and Azure Database for PostgreSQL/MySQL and Azure SQL.

Read this document as markdown — the same bytes an agent receives.