<p>Even though the user (not a service account) already have the Cloud SQL Client <code>roles/cloudsql.client</code> and Cloud SQL Instance User <code>roles/cloudsql.instanceUser</code>, the IAM account is added to the database instance (which is the user email), when using cloud-sql-proxy fails with</p>
<pre><code>FATAL: empty password returned by client
</code></pre>
<p>The current command is:</p>
<pre class="lang-bash prettyprint-override"><code>docker run --rm --network=host gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.6.1 --address 0.0.0.0 --port 5432 --token=$(gcloud auth print-access-token) $(gcloud sql instances describe MY_INSTANCE --format='value(connectionName)')
</code></pre>
<p>The log says:</p>
<pre><code>2023/09/15 18:53:56 Authorizing with OAuth2 token
2023/09/15 18:53:57 [MY_ORG:us-central1:MY_INSTANCE] Listening on [::]:5432
2023/09/15 18:53:57 The proxy has started successfully and is ready for new connections!
</code></pre>
<p>It connects but gives the <code>FATAL</code> error described before.
What is the correct command for it to work?</p>

pocesar
<p>The proper way to do this is by providing 2 additional parameters to the <code>docker run</code> arguments:</p>
<pre class="lang-bash prettyprint-override"><code>docker run --rm --network=host gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.6.1 \
  --address 0.0.0.0 \
  --port 5432 \
  --token=$(gcloud auth print-access-token) \
  --login-token=$(gcloud sql generate-login-token) \
  --auto-iam-authn \
  $(gcloud sql instances describe MY_INSTANCE --format='value(connectionName)')
</code></pre>
<p>You can now connect to it without using any password. Just connect to <code>localhost:5432</code> and you should be able to access.</p>
