Google Cloud adds group IAM auth to AlloyDB preview

Google Cloud has added Identity and Access Management group authentication to AlloyDB in preview, extending a group-based access model already available in Cloud SQL.

The feature lets organisations manage database access through Google Groups instead of assigning permissions to users individually. It is aimed at large estates where teams may manage hundreds of database instances and thousands of users.

AlloyDB is Google Cloud's PostgreSQL-compatible managed database service. Until now, AlloyDB and Cloud SQL have supported native IAM authentication that maps individual Google Cloud identities directly to database users, but that model becomes harder to manage at scale.

This can complicate on-boarding and off-boarding, and make it harder to keep permissions consistent across development, staging and production systems. It can also encourage the use of broad shared accounts or service accounts, weakening auditability and increasing exposure if credentials are misused.

Group access

Under the new model, security teams can define up to 200 functional Google Groups and use them to control access at database or table level. Google Cloud's managed database infrastructure validates a user's group context before allowing access.

Google Cloud is also positioning the feature for businesses deploying AI agents that need to interact with databases. In those cases, group-based identity can help avoid situations where an agent uses a generic shared account and gains broader access than the end user should have.

Instead, an organisation can pass the end user's identity and authentication scope through an agent to the database layer, allowing queries to run on the user's behalf. This can help maintain more precise audit trails by showing what data was accessed or modified, and for whom.

The launch brings AlloyDB closer to Cloud SQL in Google's database security model. For companies running both services, it provides a more consistent way to apply access controls across relational database estates.

Security model

Organisations can combine IAM group authentication with other controls, including VPC Service Controls, Organisation Policies, IAM conditions and Private Service Connect. Together, these tools are designed to tie database access to corporate identities and network boundaries rather than static passwords.

Google Cloud presented the change as part of a broader move away from password-based database administration. Database access has long depended on individual credentials, rotation policies and manual provisioning, all of which add work for administrators and can create security risks if not maintained consistently.

For large enterprises, the pressure is not limited to employee access. The growth of software agents and automated services adds another layer of complexity, especially where systems must act on behalf of individual users while preserving clear records for compliance and internal controls.

Customer uptake of the same authentication pattern in Cloud SQL informed the extension to AlloyDB. Google Cloud did not provide adoption figures, but described the release as a step towards a unified security stance across its managed database services.

One customer cited is Bilt, which uses AlloyDB in its database environment. The company said the combination of group-based IAM, automated group management and Privileged Access Manager entitlements had changed how access is handled internally.

"By combining AlloyDB's group-based IAM with our automated group management and Privileged Access Manager (PAM) entitlements, we've eliminated the risk of shared credentials entirely. Database and role provisioning are now fully templated from day one, allowing our engineers to securely access only the data they need and exactly when they need it," said Kosta Krauth, Chief Technology Officer, Bilt.

The preview release adds another security-focused feature to AlloyDB as cloud providers compete to make managed databases easier to govern in large organisations. More broadly, the emphasis on identity-based controls reflects a wider shift in enterprise security towards Zero Trust models, where access decisions depend on verified users, defined roles and tightly scoped permissions rather than standing credentials.

Google Cloud said the AlloyDB update also fits into its wider identity stack, including Cloud Identity and Workforce Identity Federation, as it seeks to reduce manual administration in database environments while maintaining stronger access controls and audit records.