Troubleshoot AlloyDB Auth Proxy connections

To resolve connection, authentication, or network errors when connecting to your AlloyDB for PostgreSQL instance with the AlloyDB Auth Proxy, check the following common issues and solutions:

  • Check the AlloyDB Auth Proxy output carefully and look for errors. Often, the error messages provide the information you need to determine the source of the problem and how to solve it.

  • If you are getting a 403 Forbidden error, and you are using a service account to authenticate the AlloyDB Auth Proxy, make sure the service account has the correct permissions.

    The predefined AlloyDB Identity and Access Management (IAM) roles that provide these permissions are AlloyDB Client (roles/alloydb.client) and AlloyDB Admin (roles/alloydb.admin). In addition, you must add the Service Usage Consumer (roles/serviceusage.serviceUsageConsumer) role.

  • Make sure to enable the AlloyDB API.

    If it is not enabled, you see output like Error 403: Access Not Configured in your AlloyDB Auth Proxy logs.

  • If you are connecting using UNIX sockets, confirm that the sockets were created by listing the directory you provided when you started the AlloyDB Auth Proxy.

  • If you have an outbound firewall policy, make sure it allows connections to port 5433 on the target AlloyDB instance.

  • Quota issues: If you see errors related to quotas being exceeded, either identify the source of the quota problem (for example, an application is misusing the connector and unnecessarily creating new connections) or contact support to request an increase to the AlloyDB API quota.

  • If you get a 400 Bad Request response with an error message containing reauth related error, refresh your Application Default Credentials by using the Google Cloud CLI:

    gcloud auth application-default login

    For more information, see How Application Default Credentials works.