# Bad: Hardcoded credentials in your app
# config.js
const dbConnection ={
host:'db-ip-address',
user:'admin',
password:'SuperSecret123!'
}
# Good: Cloud Run with IAM -based auth
# Cloud Run service account has cloudsql.client role
# No credentials in code!
# app.yaml
service_account:
[email protected]
# Terraform: Grant minimal permissions
resource "google_project_iam_member ""cloud_sql"{
project=var.project_id
role ="roles/cloudsql.client"
member="serviceAccount:${google_service_account.app.email} "
}