title: Cloud SQL Postgres - Managing Database Users, Best Practices?
body: <p>What are some recommendations to manage Postgres database users in Cloud SQL at scale in an enterprise environment? For example when many internal individual users (each with their individual IAM user account) want to query a Postgres database in Cloud SQL?</p>
  <p>In Microsoft SQL Server and Active Directory, I would use Windows Integrated Auth with AD Security groups; assign the least privileges to the groups and let security group membership/inheritance handle who has access to what.</p>
  <p>In Cloud SQL/Postgres, there does not appear to be an option to accomplish similar with Google Cloud IAM Security Groups. I reviewed the documentation on <a href="https://cloud.google.com/sql/docs/postgres/project-access-control" rel="nofollow noreferrer">Project Access Control</a> but that does not appear to provide what I am looking for.</p>
  <ul>
  <li><p>Is creating explicit Postgres database users for each and every user that requests it the only option?</p>
  </li>
  <li><p>If this is the only way, then is there a way to minimize the administrative overhead (e.g. password expiration, password reset requests, disabling ex-employees, etc.)?</p>
  </li>
  <li><p>Is there a better way to accomplish this that scales well and eases the administrative overhead?</p>
  </li>
  </ul>
  <p>Thank you for any insights!!</p>