Since 13 October 2026, a Cloud SQL instance created in a new project gets Private Service Connect as its private connectivity unless you choose private services access or both. Ask the Admin API about such an instance and the response has no ipAddresses field. It has a dnsName that ends in a dot and a pscServiceAttachmentLink , and nothing you could hand to psql.

Two days after the change I created a throwaway PSC instance in a demo project to see what my own app would do with it. Its Cloud SQL table showed a dash in the Private IP column, and Open Tunnel did nothing.

An instance on the older private services access setup does show an address, something like 10.50.0.7 , and a laptop can't reach that one either. Both kinds need a machine inside Google's network that can reach the database, and with IAP that machine doesn't need an external IP.

Why the Cloud SQL Auth Proxy on a laptop times out

With private services access the instance runs in a VPC that Google manages, peered to yours.…