Create instances

Console

1. In the Google Cloud console, go to the Cloud SQL Instances page.

   Go to Cloud SQL Instances

2. Click Create instance.
3. On the Choose your database engine panel of the Create an instance page, click Choose PostgreSQL.
4. In the Instance ID field of the Instance info pane, enter an ID for your instance.
   

   You do not need to include the project ID in the instance name. This is done automatically where appropriate (for example, in the log files).

5. Enter a password for the postgres user.

To see the password in clear text, click the Show password icon.

You can either enter the password manually or click Generate to have Cloud SQL create a password for you automatically.

6. Optional: Configure a password policy for the instance as follows:

   1. Select the Enable password policies checkbox.
   2. Click the Set password policy button, set one or more of the following options, and click Save.
      • Minimum length: Specifies the minimum number of characters that the password must have.
      • Password complexity: Checks if the password is a combination of lowercase, uppercase, numeric, and non-alphanumeric characters.
      • Restrict password reuse: Specifies the number of previous passwords that you can't reuse.
      • Disallow username: Prevents the use of the username in the password.
      • Set password change interval: Specifies the minimum number of hours after which you can change the password.
7. Select the database version for your instance: PostgreSQL 17, PostgreSQL 16 (default), PostgreSQL 15, PostgreSQL 14, PostgreSQL 13, PostgreSQL 12, PostgreSQL 11, PostgreSQL 10, or PostgreSQL 9.6.
   

   The database version can't be edited after the instance has been created.

8. Select the Cloud SQL edition for your instance: Enterprise or Enterprise plus. For more information about Cloud SQL editions, see Introduction to Cloud SQL editions.
9. In the Choose region and zonal availability section, select the region and zone for your instance. Region availability might be different based on your Cloud SQL edition. For more information, see About instance settings.

   Place your instance in the same region as the resources that access it. The region you select can't be modified in the future. In most cases, you don't need to specify a zone.

   If you are configuring your instance for high availability, you can select both a primary and secondary zone.

   The following conditions apply when the secondary zone is used during instance creation:

   • The zones default to Any for the primary zone and Any (different from primary) for the secondary zone.
   • If both the primary and secondary zones are specified, they must be distinct zones.
10. In the Customize your instance section, update settings for your instance. Begin by clicking SHOW CONFIGURATION OPTIONS to display the groups of settings. Then, expand desired groups to review and customize settings. A Summary of all the options you select is shown on the right. Customizing these instance settings is optional. Defaults are assigned in every case where no customizations are made.

    The following table is a quick reference to instance settings. For more details about each setting, see the instance settings page.

    Setting	Notes
    Machine type
    Machine type	Select from Shared core or Dedicated core. For Shared core, each machine type is classified by the number of CPUs (cores) and amount of memory for your instance.
    Cores	The number of vCPUs for your instance. Learn more.
    Memory	The amount of memory for your instance, in GBs. Learn more.
    Custom	For the Dedicated core machine type, instead of selecting a predefined configuration, select the Custom button to create an instance with a custom configuration. When you select this option, you need to select the number of cores and amount of memory for your instance. Learn more.
    Storage
    Storage type	Determines whether your instance uses SSD or HDD storage. Learn more.
    Storage capacity	The amount of storage provisioned for the instance. Learn more.
    Enable automatic storage increases	Determines whether Cloud SQL automatically provides more storage for your instance when free space runs low. Learn more.
    Encryption
    Google-managed encryption	The default option.
    Customer key-managed encryption key (CMEK)	Select to use your key with Google Cloud Key Management Service. Learn more.
    Connections
    Private IP	Adds a private IP address for your instance. To enable connecting to the instance, additional configuration is required. Optionally, you can specify an allocated IP range for your instances to use for connections. Expand Show allocated IP range option. Select an IP range from the drop-down menu. Your instance can have both a public and a private IP address. Learn more about using private IP. Learn more about allocated IP address ranges.
    Public IP	Adds a public IP address for your instance. You can then add authorized networks to connect to the instance. Your instance can have both a public and a private IP address. Learn more about using public IP.
    Authorized networks	Add the name for the new network and the Network address. Learn more.
    Private path for Google Cloud services	By selecting this check box, you allow other Google Cloud services, such as BigQuery, to access data in Cloud SQL and make queries against this data over a private connection.
    Data protection
    Automate backups	The window of time when you would like backups to start. Learn more.
    Choose where to store your backups	Select Multi-region for most use cases. If you need to store backups in a specific region, for example, if there are regulatory reasons to do so, select Region and select your region from the Location drop-down menu.
    Choose how many automated backups to store	The number of automated backups you would like to retain (from 1 to 365 days). Learn more.
    Enable point-in-time recovery	Enables point-in-time recovery and write-ahead logging. Learn more.
    Enable deletion protection	Determines whether to protect an instance against accidental deletion. Learn more.
    Choose how many days of logs to retain	Configure write-ahead log retention from 1 to 7 days. The default setting is 7 days. Learn more.
    Maintenance
    Preferred window	Determines a one-hour window when Cloud SQL can perform disruptive maintenance on your instance. If you do not set the window, then disruptive maintenance can be done at any time. Learn more.
    Order of updates	Your preferred timing for instance updates, relative to other instances in the same project. Learn more.
    Flags
    ADD FLAG	You can use database flags to control settings and parameters for your instance. Learn more.
    Labels
    ADD LABEL	Add a key and value for each label that you add. You use labels to help organize your instances.
    Data cache
    Enable data cache (optional)	Enables data cache for Cloud SQL for PostgreSQL Enterprise Plus edition instances. For more information about data cache, see data cache.

11. Click Create Instance.

    Note: It might take a few minutes to create your instance. However, you can view information about the instance while it's being created.

gcloud

For information about installing and getting started with the gcloud CLI, see Installing gcloud CLI. For information about starting Cloud Shell, see the Cloud Shell documentation.

1. Use the gcloud sql instances create command to create the instance:

For Cloud SQL Enterprise Plus edition instances:

gcloud sql instances create INSTANCE_NAME \
--database-version=DATABASE_VERSION \
--region=REGION \
--tier=TIER \
--edition=ENTERPRISE_PLUS


For Cloud SQL Enterprise edition instances:

gcloud sql instances create INSTANCE_NAME \
--database-version=DATABASE_VERSION \
--region=REGION \
--cpu=NUMBER_CPUS \
--memory=MEMORY_SIZE \
--edition=ENTERPRISE

Or, alternatively, you can use the --tier flag if you choose db-f1-micro or db-g1-small as the machine type:

gcloud sql instances create INSTANCE_NAME \
--tier=API_TIER_STRING \
--region=REGION

There are restrictions on the values for vCPUs and memory size:

• vCPUs must be either 1 or an even number between 2 and 96.
• Memory must be:
  • 0.9 to 6.5 GB per vCPU
  • A multiple of 256 MB
  • At least 3.75 GB (3840 MB)

For example, the following command creates a Cloud SQL Enterprise edition instance with two vCPUs and 7,680 MB of memory:

gcloud sql instances create myinstance \
--database-version=POSTGRES_16 \
--cpu=2 \
--memory=7680MB \
--region=us-central1

The following command creates a Cloud SQL Enterprise Plus edition instance with four cores:

gcloud sql instances create myinstance \
--database-version=POSTGRES_16 \
--tier=db-perf-optimized-N-4 \
--edition=ENTERPRISE_PLUS \
--region=us-central1

The default value for REGION is us-central1.

Do not include sensitive or personally identifiable information in your instance name; it is externally visible.
You do not need to include the project ID in the instance name. This is done automatically where appropriate (for example, in the log files).

If you are creating an instance for high availability, you can specify both the primary and secondary zones, using the --zone and --secondary-zone parameters. The following conditions apply when the secondary zone is used during instance creation or edit:

• The zones must be valid zones.
• If the secondary zone is specified, the primary must also be specified.
• If the primary and secondary zones are specified, they must be distinct zones.
• If the primary and secondary zones are specified, they must belong to the same region.

You can add more parameters to determine other instance settings:

gcloud sql users set-password postgres \
--instance=INSTANCE_NAME \
--password=PASSWORD

Terraform

To create an instance, use a Terraform resource.

resource "google_sql_database_instance" "postgres_pvp_instance_name" {
  name             = "postgres-pvp-instance-name"
  region           = "asia-northeast1"
  database_version = "POSTGRES_14"
  root_password    = "abcABC123!"
  settings {
    tier = "db-custom-2-7680"
    password_validation_policy {
      min_length                  = 6
      reuse_interval              = 2
      complexity                  = "COMPLEXITY_DEFAULT"
      disallow_username_substring = true
      password_change_interval    = "30s"
      enable_password_policy      = true
    }
  }
  # set `deletion_protection` to true, will ensure that one cannot accidentally delete this instance by
  # use of Terraform whereas `deletion_protection_enabled` flag protects this instance at the GCP level.
  deletion_protection = false
}

Apply the changes

To apply your Terraform configuration in a Google Cloud project, complete the steps in the following sections.

Prepare Cloud Shell

1. Launch Cloud Shell.

2. Set the default Google Cloud project where you want to apply your Terraform configurations.

   You only need to run this command once per project, and you can run it in any directory.

   export GOOGLE_CLOUD_PROJECT=PROJECT_ID

   Environment variables are overridden if you set explicit values in the Terraform configuration file.

Prepare the directory

Each Terraform configuration file must have its own directory (also called a root module).

1. In Cloud Shell, create a directory and a new file within that directory. The filename must have the .tf extension—for example main.tf. In this tutorial, the file is referred to as main.tf.

   mkdir DIRECTORY && cd DIRECTORY && touch main.tf

2. If you are following a tutorial, you can copy the sample code in each section or step.

   Copy the sample code into the newly created main.tf.

   Optionally, copy the code from GitHub. This is recommended when the Terraform snippet is part of an end-to-end solution.

3. Review and modify the sample parameters to apply to your environment.
4. Save your changes.
5. Initialize Terraform. You only need to do this once per directory.

   terraform init

   Optionally, to use the latest Google provider version, include the -upgrade option:

   terraform init -upgrade

Apply the changes

1. Review the configuration and verify that the resources that Terraform is going to create or update match your expectations:

   terraform plan

   Make corrections to the configuration as necessary.

2. Apply the Terraform configuration by running the following command and entering yes at the prompt:

   terraform apply

   Wait until Terraform displays the "Apply complete!" message.

3. Open your Google Cloud project to view the results. In the Google Cloud console, navigate to your resources in the UI to make sure that Terraform has created or updated them.

Delete the changes

To delete your changes, do the following:

1. To disable deletion protection, in your Terraform configuration file set the deletion_protection argument to false.

   deletion_protection =  "false"

2. Apply the updated Terraform configuration by running the following command and entering yes at the prompt:

   terraform apply

3. Remove resources previously applied with your Terraform configuration by running the following command and entering yes at the prompt:

   terraform destroy

REST v1

Create the instance

This example creates an instance. Some optional parameters, such as backups and binary logging are also included. For a complete list of parameters for this call, see the Instances:insert page. For information about instance settings, including valid values for region, see Instance settings.

Do not include sensitive or personally identifiable information in your instance ID; it is externally visible.
You do not need to include the project ID in the instance name. This is done automatically where appropriate (for example, in the log files).

Before using any of the request data, make the following replacements:

• PROJECT_ID: your project ID
• INSTANCE_ID: your instance ID
• REGION: the region
• DATABASE_VERSION: enum string of the database version (for example, POSTGRES_16)
• PASSWORD: the password for the root user
• MACHINE_TYPE: enum string of the machine (tier) type, as: db-custom-[CPUS]-[MEMORY_MBS]

• EDITION_TYPE: your Cloud SQL edition

• DATA_CACHE_ENABLED: (optional) set to true to enable data cache for your instance
• PRIVATE_NETWORK: specify the name of the Virtual Private Cloud (VPC) network that you want to use for this instance. Private services access must already be configured for the network.
• AUTHORIZED_NETWORKS: for public IP connections, specify the connections from authorized networks that can connect to your instance.
• CA_MODE: specify a certificate authority hierarchy for the instance, either GOOGLE_MANAGED_INTERNAL_CA or GOOGLE_MANAGED_CAS_CA. If you don't specify serverCaMode, then the default configuration is GOOGLE_MANAGED_INTERNAL_CA. This feature is in Preview.

To set a password policy while creating an instance, include the passwordValidationPolicy object in the request. Set the following parameters, as required:

• enablePasswordPolicy: Enables the password policy when set to true.

  To remove the password policy, you can use a PATCH request with null as the value for enablePasswordPolicy. In this case, the other password policy parameters are reset.

• minLength: Specifies the minimum number of characters that the password must have.
• complexity: Checks if the password is a combination of lowercase, uppercase, numeric, and non-alphanumeric characters. The default value is COMPLEXITY_DEFAULT.
• reuseInterval: Specifies the number of previous passwords that you can't reuse.
• disallowUsernameSubstring: Prevents the use of the username in the password when set to true.
• passwordChangeInterval: Specifies the minimum duration after which you can change the password. The value is in seconds with up to nine fractional digits, terminated by s. For example, 3.5s.

To create the instance so that it can integrate with Vertex AI, include the enableGoogleMlIntegration object in the request. This integration lets you apply large language models (LLMs), which are hosted in Vertex AI, to a Cloud SQL for PostgreSQL database.

Set the following parameters, as required:

• enableGoogleMlIntegration: when this parameter is set to true, Cloud SQL instances can connect to Vertex AI to pass requests for real-time predictions and insights to the AI
• cloudsql.enable_google_ml_integration: when this parameter is set to on, Cloud SQL can integrate with Vertex AI

HTTP method and URL:

POST https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances

Request JSON body:

{
  "name": "INSTANCE_ID",
  "region": "REGION",
  "databaseVersion": "DATABASE_VERSION",
  "rootPassword": "PASSWORD",
  "settings": {
    "tier": "MACHINE_TYPE",
    "edition": "EDITION_TYPE",
    "enableGoogleMlIntegration": "true" | "false"
    "databaseFlags":
    [
      {
        "name": "cloudsql.enable_google_ml_integration",
        "value": "on" | "off"
      }
    ]
    "dataCacheConfig" = {
      "dataCacheEnabled": DATA_CACHE_ENABLED
    },
    "backupConfiguration": {
      "enabled": true
    },
    "passwordValidationPolicy": {
      "enablePasswordPolicy": true
      "minLength": "MIN_LENGTH",
      "complexity": COMPLEXITY_DEFAULT,
      "reuseInterval": "REUSE_INTERVAL",
      "disallowUsernameSubstring": "DISALLOW_USERNAME_SUBSTRING",
      "passwordChangeInterval": "PASSWORD_CHANGE_INTERVAL"
    }
    "ipConfiguration": {
      "privateNetwork": "PRIVATE_NETWORK",
      "authorizedNetworks": [AUTHORIZED_NETWORKS],
      "ipv4Enabled": false,
      "enablePrivatePathForGoogleCloudServices": true,
      "serverCaMode": "CA_MODE"
    }
  }
}

To send your request, expand one of these options:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/instances/INSTANCE_ID",
  "status": "PENDING",
  "user": "[email protected]",
  "insertTime": "2019-09-25T22:19:33.735Z",
  "operationType": "CREATE",
  "name": "OPERATION_ID",
  "targetId": "INSTANCE_ID",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/PROJECT_ID/operations/OPERATION_ID",
  "targetProject": "PROJECT_ID"
}

The response is a long-running operation, which might take a few minutes to complete.

Retrieve the IPv4 address

Retrieve the automatically assigned IPv4 address for the new instance:

Before using any of the request data, make the following replacements:

• project-id: your project ID
• instance-id: instance ID created in prior step

HTTP method and URL:

GET https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id

To send your request, expand one of these options:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#instance",
  "state": "RUNNABLE",
  "databaseVersion": "MYSQL_8_0_18",
  "settings": {
    "authorizedGaeApplications": [],
    "tier": "db-f1-micro",
    "kind": "sql#settings",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration": {
      "authorizedNetworks": [],
      "ipv4Enabled": true
    },
    "locationPreference": {
      "zone": "us-west1-a",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "backupConfiguration": {
      "startTime": "18:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "1",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  },
  "etag": "--redacted--",
  "ipAddresses": [
    {
      "type": "PRIMARY",
      "ipAddress": "10.0.0.1"
    }
  ],
  "serverCaCert": {
    ...
  },
  "instanceType": "CLOUD_SQL_INSTANCE",
  "project": "project-id",
  "serviceAccountEmailAddress": "[email protected]",
  "backendType": "SECOND_GEN",
  "selfLink": "https://sqladmin.googleapis.com/v1/projects/project-id/instances/instance-id",
  "connectionName": "project-id:region:instance-id",
  "name": "instance-id",
  "region": "us-west1",
  "gceZone": "us-west1-a"
}

Look for the ipAddress field in the response.

REST v1beta4

Create the instance

This example creates an instance. Some optional parameters, such as backups and binary logging are also included. For a complete list of parameters for this call, see the instances:insert page. For information about instance settings, including valid values for region, see Instance settings

Do not include sensitive or personally identifiable information in your instance ID; it is externally visible.
You do not need to include the project ID in the instance name. This is done automatically where appropriate (for example, in the log files).

Before using any of the request data, make the following replacements:

• PROJECT_ID: your project ID
• INSTANCE_ID: your instance ID
• REGION: the region
• DATABASE_VERSION: enum string of the database version (for example, POSTGRES_16)
• PASSWORD: the password for the root user
• MACHINE_TYPE: enum string of the machine (tier) type, as: db-custom-[CPUS]-[MEMORY_MBS]

• EDITION_TYPE: your Cloud SQL edition

• DATA_CACHE_ENABLED: (optional) set to true to enable data cache for your instance
• PRIVATE_NETWORK: Specify the name of the Virtual Private Cloud (VPC) network that you want to use for this instance. Private services access must already be configured for the network.
• AUTHORIZED_NETWORKS: For public IP connections, specify the connections from authorized networks that can connect to your instance.
• CA_MODE: specify a certificate authority hierarchy for the instance, either GOOGLE_MANAGED_INTERNAL_CA or GOOGLE_MANAGED_CAS_CA. If you don't specify serverCaMode, then the default configuration is GOOGLE_MANAGED_INTERNAL_CA. This feature is in Preview.

To set a password policy while creating an instance, include the passwordValidationPolicy object in the request. Set the following parameters, as required:

• enablePasswordPolicy: Enables the password policy when set to true.

  To remove the password policy, you can use a PATCH request with null as the value for enablePasswordPolicy. In this case, the other password policy parameters are reset.

• minLength: Specifies the minimum number of characters that the password must have.
• complexity: Checks if the password is a combination of lowercase, uppercase, numeric, and non-alphanumeric characters. The default value is COMPLEXITY_DEFAULT.
• reuseInterval: Specifies the number of previous passwords that you can't reuse.
• disallowUsernameSubstring: Prevents the use of the username in the password when set to true.
• passwordChangeInterval: Specifies the minimum duration after which you can change the password. The value is in seconds with up to nine fractional digits, terminated by s. For example, 3.5s.

To create the instance so that it can integrate with Vertex AI, include the enableGoogleMlIntegration object in the request. This integration lets you apply large language models (LLMs), which are hosted in Vertex AI, to a Cloud SQL for PostgreSQL database.

Set the following parameters, as required:

• enableGoogleMlIntegration: when this parameter is set to true, Cloud SQL instances can connect to Vertex AI to pass requests for real-time predictions and insights to the AI
• cloudsql.enable_google_ml_integration: when this parameter is set to on, Cloud SQL can integrate with Vertex AI

HTTP method and URL:

POST https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances

Request JSON body:

{
  "name": "INSTANCE_ID",
  "region": "REGION",
  "databaseVersion": "DATABASE_VERSION",
  "rootPassword": "PASSWORD",
  "settings": {
    "tier": "MACHINE_TYPE",
    "edition": "EDITION_TYPE",
    "enableGoogleMlIntegration": "true" | "false"
    "databaseFlags":
    [
      {
        "name": "cloudsql.enable_google_ml_integration",
        "value": "on" | "off"
      }
    ]
    "dataCacheConfig" = {
      "dataCacheEnabled": DATA_CACHE_ENABLED
    },
    "backupConfiguration": {
      "enabled": true
    },
    "passwordValidationPolicy": {
      "enablePasswordPolicy": true
      "minLength": "MIN_LENGTH",
      "complexity": COMPLEXITY_DEFAULT,
      "reuseInterval": "REUSE_INTERVAL",
      "disallowUsernameSubstring": "DISALLOW_USERNAME_SUBSTRING",
      "passwordChangeInterval": "PASSWORD_CHANGE_INTERVAL"
    }
    "ipConfiguration": {
      "privateNetwork": "PRIVATE_NETWORK",
      "authorizedNetworks": [AUTHORIZED_NETWORKS],
      "ipv4Enabled": false,
      "enablePrivatePathForGoogleCloudServices": true,
      "serverCaMode": "CA_MODE"
    }
  }
}

To send your request, expand one of these options:

curl -X POST \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     -H "Content-Type: application/json; charset=utf-8" \
     -d @request.json \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method POST `
    -Headers $headers `
    -ContentType: "application/json; charset=utf-8" `
    -InFile request.json `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#operation",
  "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/instances/INSTANCE_ID",
  "status": "PENDING",
  "user": "[email protected]",
  "insertTime": "2020-01-01T19:13:21.834Z",
  "operationType": "CREATE",
  "name": "OPERATION_ID",
  "targetId": "INSTANCE_ID",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/PROJECT_ID/operations/OPERATION_ID",
  "targetProject": "PROJECT_ID"
}

The response is a long-running operation, which might take a few minutes to complete.

Retrieve the IPv4 address

Retrieve the automatically assigned IPv4 address for the new instance:

Before using any of the request data, make the following replacements:

• project-id: your project ID
• instance-id: instance ID created in prior step

HTTP method and URL:

GET https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id

To send your request, expand one of these options:

curl -X GET \
     -H "Authorization: Bearer $(gcloud auth print-access-token)" \
     "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id"

$cred = gcloud auth print-access-token
$headers = @{ "Authorization" = "Bearer $cred" }

Invoke-WebRequest `
    -Method GET `
    -Headers $headers `
    -Uri "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id" | Select-Object -Expand Content

You should receive a JSON response similar to the following:

{
  "kind": "sql#instance",
  "state": "RUNNABLE",
  "databaseVersion": "MYSQL_8_0_18",
  "settings": {
    "authorizedGaeApplications": [],
    "tier": "db-f1-micro",
    "kind": "sql#settings",
    "pricingPlan": "PER_USE",
    "replicationType": "SYNCHRONOUS",
    "activationPolicy": "ALWAYS",
    "ipConfiguration": {
      "authorizedNetworks": [],
      "ipv4Enabled": true
    },
    "locationPreference": {
      "zone": "us-west1-a",
      "kind": "sql#locationPreference"
    },
    "dataDiskType": "PD_SSD",
    "backupConfiguration": {
      "startTime": "18:00",
      "kind": "sql#backupConfiguration",
      "enabled": true,
      "binaryLogEnabled": true
    },
    "settingsVersion": "1",
    "storageAutoResizeLimit": "0",
    "storageAutoResize": true,
    "dataDiskSizeGb": "10"
  },
  "etag": "--redacted--",
  "ipAddresses": [
    {
      "type": "PRIMARY",
      "ipAddress": "10.0.0.1"
    }
  ],
  "serverCaCert": {
    ...
  },
  "instanceType": "CLOUD_SQL_INSTANCE",
  "project": "project-id",
  "serviceAccountEmailAddress": "[email protected]",
  "backendType": "SECOND_GEN",
  "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/project-id/instances/instance-id",
  "connectionName": "project-id:region:instance-id",
  "name": "instance-id",
  "region": "us-west1",
  "gceZone": "us-west1-a"
}

Look for the ipAddress field in the response.