title: Creating a user that's not a cloudsqlsuperuser in Cloud SQL using Terraform
body: <p>I'd like to limit the privileges afforded to any given user that I create via the Google Terraform provider. By default, any user created is placed in the <code>cloudsqlsuperuser</code> group, and any new database created has that role/group as owner. This gives any user created via the GCP console or <code>google_sql_user</code> Terraform resource total control over any database that is (or was) created in a similar fashion.</p>
  <p>So far, the best we've been able to come up with is creating and altering a user via a single-run k8s job. This seems circuitous, at best, especially given that that resource must then be manually imported later if we want to manage it via Terraform.</p>
  <p>Is there a better way to create a user that has privileges limited to a single, application-specific database?</p>