prod-db-connect

To safely connect to a production Postgres database for ad hoc inspection, use cloud-sql-proxy with IAM service-account impersonation to establish a temporary session that dynamically discovers Cloud SQL settings and requires explicit approval before any write operations.

Yes, targeted data fixes on production records are possible by dynamically discovering Cloud SQL project and instance settings, staging the exact update, and applying transaction guards that require logged approval before any write operation is executed.

IAM impersonation secures Cloud SQL Postgres connections by using service-account delegation rather than static credentials. Combined with cloud-sql-proxy, it ensures production database access is authenticated, scoped to the session, and requires logged approval for writes.

Yes, the workflow supports verifying live rows in production before applying updates by enabling read-only investigation of schema-adjacent issues and existing records. You inspect the live data, prepare the exact update, and verify it safely post-write using transaction guards.

Limitations of using cloud-sql-proxy for production database support include its restriction to Cloud SQL Postgres instances and the strict requirement for logged approval and transaction guards before any write, making it unsuitable for automated or unattended bulk data migrations.