Can't connect to cloud sql instance (sql server) from GCP Dataflow python environment

Question

I'm running a Python Jupyter Notebook in a GCP Dataflow environment. From there, I need to connect to a SQL sever database that's also hosted on GCP Cloud SQL. Both, the Dataflow environment and the Cloud SQL database belong to the same project and the database is in the same region as the Dataflow environment. In the notebook I import pymssql and I try to connect:

import pymssql
conn = pymssql.connect(private_IP_address,  'sqlserver', my_password, my_database, port=1433)

And then I'm getting this error_log from the database log:

{
textPayload: "
2020-11-05 22:32:11.39 Logon       Login failed for user '0b6ac33c6f3ffac\0b6ac33c6f3ffac$'. Reason: Token-based server access validation failed with an infrastructure error. Login lacks connect endpoint permission. [CLIENT: 127.0.0.1]
"
insertId: "s=78a0260e8570497095a8a31a7c378bb3;i=1f23ae;b=0539ace45f6f4b56b03c745b0479107b;m=10a6f7f8e7e;t=5b363aac03490;x=9030d75bb0dadd2-0@a1"
resource: {2}
timestamp: "2020-11-05T22:32:11.410576Z"
severity: "INFO"
labels: {23}
logName: "projects/shapiro-metals/logs/cloudsql.googleapis.com%2Fsqlserver.err"
receiveTimestamp: "2020-11-05T22:32:12.582961041Z"
}

I've been searching around and I couldn't find any simple explanation of exactly what I'm missing; hoping someone can help?

Answer 1

Facing the same error after changing to Public IP address and other troubleshooting, this issue is the same with this public tracker and Google Cloud SQL Engineering Team is working on solving this issue.

You can star the public issue tracker feature requests and add comment in the thread that you are also affected to ensure that you will receive updates about it.