CloudSQL 2代外部主实例无法在副本中创建用户

I’ve run into similar scenarios with Cloud SQL replicas before, so let’s walk through why this might be happening and how to get your app users created:

First, Rule Out Replication Health #

Even though the docs state replicas support user creation, those operations are actually routed to the primary instance behind the scenes, then replicated back to the replica. If replication is broken, this entire flow falls apart.

To check replication status, log into your replica via MySQL client and run:

SHOW SLAVE STATUS\G

Look for Slave_IO_Running: Yes and Slave_SQL_Running: Yes—if either is No, you’ve got a replication issue to resolve first. Common fixes include verifying network connectivity between primary and replica, or fixing conflicting schema changes that might be blocking replication.

Verify Your Root User Privileges #

The root user on the replica should have full privileges, but sometimes post-setup glitches can restrict access. Confirm with this query:

SHOW GRANTS FOR 'root'@'%';

You should see GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' WITH GRANT OPTION; at the top. If not, head to the Cloud Console, reset the root password for the replica (this syncs with the primary), and try creating users again.

Double-Check CLI/Terraform Targets #

When using gcloud or Terraform, make 100% sure you’re targeting the replica instance, not the primary. For gcloud, the correct command looks like:

gcloud sql users create app_user % --instance=your-replica-name --password=your-strong-pass

If you accidentally target the primary, the user will exist there but might take time to replicate to the replica. If you target the replica and nothing happens, check the Cloud SQL logs—they’ll usually show permission errors or instance state issues that caused the failure.

Validate Your MySQL CREATE USER Syntax #

Syntax errors are easy to overlook. Ensure your command follows this structure:

CREATE USER 'app_user'@'%' IDENTIFIED BY 'secure_password_123';
-- Don’t forget to grant necessary app privileges
GRANT SELECT, INSERT, UPDATE ON your_app_db.* TO 'app_user'@'%';

Also, never attempt this as the mysql.sys user—it’s a system account with zero user-creation privileges. Always log in as root.

Last Resort: Refresh the Replica #

Sometimes a simple restart of the replica instance from the Cloud Console can fix stuck replication or permission sync issues. Just note this will cause a brief outage for the replica, so plan accordingly.

内容的提问来源于stack exchange，提问作者dkuji