This page describes how to configure Cloud SQL data discovery at the level of an organization or folder. If you want to profile a project, see Profile Cloud SQL data in a single project.
For more information about the discovery service, see Data profiles.
How it works
The following is a high-level workflow for profiling Cloud SQL data:
-
After you create a scan configuration, Sensitive Data Protection starts identifying your Cloud SQL instances and creating a default connection for each instance. Depending on the number of instances in scope of discovery, this process can take a few hours. You can exit the Google Cloud console and check your connections later.
Grant the required IAM roles to the service agent associated with your scan configuration.
When the default connections are ready, give Sensitive Data Protection access to your Cloud SQL instances by updating each connection with the proper database user credentials. You can provide existing database user accounts or create database users.
Recommended: Increase the maximum number of connections that Sensitive Data Protection can use to profile your data. Increasing the connections can speed up discovery.
Supported services
This feature supports the following:
- Cloud SQL for MySQL
- Cloud SQL for PostgreSQL
Cloud SQL for SQL Server isn't supported.
Processing and storage regions
Sensitive Data Protection is a regional and multi-regional service; it
doesn't distinguish between zones. When Sensitive Data Protection
profiles a Cloud SQL instance, the data is processed in its current
region, but not necessarily its current zone. For example, if a
Cloud SQL instance is stored in the us-central1-a zone, then
Sensitive Data Protection processes and stores the data profiles in the
us-central1 region.
For more information, see Data residency considerations.
Before you begin
Confirm that you have the IAM permissions that are required to configure data profiles at the organization level.