Managed Databases on Google Cloud
|
This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production. See the section bibliography for the reference material consulted while preparing these pages. |
Service names, editions and lifecycle statuses below were checked against the official Google Cloud documentation on 2026-10-01 and against gcloud CLI 586 (release 586.0.0 of 2026-09-22). Database products change names, editions and availability often (Memorystore for Memcached is being retired, Vertex AI Search became Agent Search, Firestore gained editions), so confirm the status of anything you are about to adopt on its product page. This is a landing page, not a hands-on walkthrough: for setup steps and CLI examples for a given engine, follow the link in the table to this section’s own page. The same overview exists for Azure and AWS.
The running scenario, Bookshelf, uses three of these services: a Cloud SQL for PostgreSQL instance bookshelf-catalog
(database catalog) for the catalog-api with AlloyDB bookshelf-alloy as the scale-up variant, a Firestore database
orders with MongoDB compatibility for the orders-api (MongoDB Atlas is the alternative), and a Memorystore for Valkey
instance bookshelf-cache. The question this page answers is how to arrive at choices like those.
Choosing an engine first, a service second
Pick the data model and access pattern before looking at Google Cloud product names. That decision is engine-neutral and is covered in Choosing the Right Database, which compares relational, document, search, vector, graph and other categories. Only once the engine family is fixed does the Google Cloud question arise: which of a first-party service, a Google Cloud Marketplace SaaS offering or a self-managed deployment fits your team. Each row of the next table states which of those three kinds the option is.
Engine-to-Google Cloud option map
For every engine this site documents, the table gives the Google Cloud option(s), the kind of option, this section’s page that covers it and this site’s reference for the engine itself. "First-party" means a Google-operated managed service. "Marketplace SaaS" means a partner-operated service that you subscribe to through Google Cloud Marketplace; it is billed through your Google Cloud account, often counts toward committed spend, and is usually reachable over Private Service Connect. "Self-managed" means you run the engine yourself on Google Kubernetes Engine (GKE) or Compute Engine.
| Engine | Google Cloud option(s) | Kind | This section | Engine reference |
|---|---|---|---|---|
PostgreSQL |
Cloud SQL for PostgreSQL; AlloyDB for PostgreSQL; Spanner with the PostgreSQL interface |
First-party |
Cloud SQL / AlloyDB for PostgreSQL / Spanner, Firestore and Bigtable |
|
MySQL |
Cloud SQL for MySQL |
First-party |
||
SQL Server |
Cloud SQL for SQL Server; SQL Server on Compute Engine |
First-party / self-managed |
||
MongoDB |
Firestore with MongoDB compatibility (Enterprise edition); MongoDB Atlas on Google Cloud; MongoDB on GKE |
First-party / Marketplace SaaS / self-managed |
MongoDB Reference, Authentication, authorization & encryption |
|
Redis |
Memorystore for Valkey; Memorystore for Redis Cluster; Memorystore for Redis; Redis Cloud |
First-party / Marketplace SaaS |
||
Elasticsearch |
Elastic Cloud on Google Cloud (hosted and serverless); Elastic Cloud on Kubernetes (ECK) on GKE |
Marketplace SaaS / self-managed |
||
Lucene / Solr |
No managed Solr service from Google Cloud (re-verify before relying on this); Solr on GKE with the Solr Operator or on Compute Engine; Agent Search (formerly Vertex AI Search) as the managed search alternative |
Self-managed / first-party alternative |
||
Couchbase |
Couchbase Capella; Couchbase Autonomous Operator on GKE |
Marketplace SaaS / self-managed |
||
Neo4j |
Neo4j AuraDB; Neo4j Helm chart on GKE; Spanner Graph as the first-party graph alternative |
Marketplace SaaS / self-managed / first-party alternative |
Memorystore and Partner Databases / Spanner, Firestore and Bigtable |
|
Qdrant |
Qdrant Cloud on Google Cloud regions; Qdrant Helm chart on GKE |
Marketplace SaaS / self-managed |
||
Prometheus |
Google Cloud Managed Service for Prometheus with Cloud Monitoring and Grafana; Prometheus on GKE |
First-party / self-managed |
Memorystore and Partner Databases / Monitoring and Observability |
|
Vector search (cross-engine) |
pgvector on Cloud SQL; ScaNN and pgvector on AlloyDB; Firestore KNN; Spanner; BigQuery |
First-party / Marketplace SaaS |
Cloud SQL, AlloyDB for PostgreSQL, AI, Data and Analytics Overview |
Where the Google Cloud column says "alternative", the Google Cloud service is a different engine that solves a similar problem, not a hosted version of the engine on this site. Agent Search is a managed retrieval service rather than a Solr or Lucene deployment, and Spanner Graph speaks GQL rather than Neo4j’s Cypher dialect. The pages Lucene vs. Solr vs. Elasticsearch vs. OpenSearch and Neo4j vs. relational and other graph databases explain the differences. The Google Cloud column of the vector comparison lives in Comparing Vector Databases, and the landscape in The Vector Database Landscape.
Marketplace SaaS databases run in the partner’s own accounts, not in your project. You subscribe in Google Cloud Marketplace, the charges appear on your Google Cloud bill, and you connect over the public internet or, where the vendor offers it, over Private Service Connect so that traffic stays on Google’s network. Self-managed deployments run in your project: you own patching, backups, upgrades and failover, but you also get the full engine feature set and a free choice of version. Running stateful engines on GKE is covered in GKE Clusters.
Google’s first-party-only engines
Four Google Cloud databases have no engine reference on this site, because they exist only as Google products. They come up in the same decisions.
| Service | What it is | Page |
|---|---|---|
Spanner |
Horizontally scalable relational database with strong consistency across regions, capacity sold in processing units, GoogleSQL and PostgreSQL dialects, and Graph, full-text and vector search in the Enterprise editions. Choose it when a relational workload must scale writes beyond one primary or span regions. |
|
Firestore |
Serverless document database in Native or Datastore mode (Standard edition) or Native or MongoDB-compatible mode (Enterprise edition), with real-time listeners, security rules for mobile and web clients, and KNN vector search. |
|
Bigtable |
Wide-column store for very high-throughput, low-latency key access such as time series and IoT, with an HBase-compatible client and GoogleSQL support. Not a general relational database. |
|
BigQuery |
Serverless analytical data warehouse billed for storage and for bytes scanned or reserved slots. For analytical (OLAP) queries over large datasets, not transactional workloads. See the next section for its vector search. |
Firestore and Filestore are different products that happen to share a prefix: Firestore is the document database, and Filestore is the managed NFS file service in Block and File Storage on Google Cloud.
BigQuery vector search
BigQuery stores embeddings in an ARRAY<FLOAT64> column and finds nearest neighbours with the VECTOR_SEARCH table
function. It is the right fit when the vectors already live in the warehouse, the workload is batch or analytical
(deduplication, clustering, offline recommendations), and a latency of hundreds of milliseconds to seconds is acceptable.
For a low-latency online lookup behind an API, use a database built for it: pgvector or ScaNN on
AlloyDB and Cloud SQL, Firestore, or
Vertex AI Vector Search (renamed Agent Retrieval in the 2026 rebrand, still in Preview when this page was checked).
Without an index, VECTOR_SEARCH runs an exact brute-force scan, which is accurate and fine for small tables. For large
tables, CREATE VECTOR INDEX builds an approximate index (IVF or TREE_AH, the latter based on ScaNN) that trades a
little recall for speed. Vector indexes need the Enterprise or Enterprise Plus edition (reservations); on-demand
projects can still run the brute-force query. The example creates a small embeddings table for the Bookshelf catalog,
indexes it and searches it; the vector literals are shortened to three dimensions for readability, whereas a real
embedding model produces hundreds.
gcloud services enable bigquery.googleapis.com
export PROJECT_ID=$(gcloud config get-value project)
export LOCATION=US
bq --location=$LOCATION mk --dataset $PROJECT_ID:bookshelf
bq query --use_legacy_sql=false "
CREATE TABLE bookshelf.book_embeddings AS
SELECT * FROM UNNEST([
STRUCT('b1' AS book_id, [0.1, 0.2, 0.3] AS embedding),
STRUCT('b2', [0.9, 0.1, 0.0]),
STRUCT('b3', [0.2, 0.2, 0.4])
])"
bq query --use_legacy_sql=false "
CREATE VECTOR INDEX book_embeddings_idx
ON bookshelf.book_embeddings(embedding)
OPTIONS (index_type = 'IVF', distance_type = 'COSINE')"
bq query --use_legacy_sql=false "
SELECT base.book_id, distance
FROM VECTOR_SEARCH(
TABLE bookshelf.book_embeddings, 'embedding',
(SELECT [0.15, 0.2, 0.35] AS embedding),
top_k => 2, distance_type => 'COSINE')"
Derived from the BigQuery documentation — Introduction to vector search, Manage vector indexes and the VECTOR_SEARCH function reference. The dataset location cannot be changed after creation, so pick it deliberately.
The query returns the two nearest books by cosine distance. The concepts behind the metrics and index types are explained in Similarity Metrics & Semantic Search and ANN Indexes: Flat, IVF, HNSW and Beyond. BigQuery can also generate the embeddings itself by calling a remote model, which belongs to the data and AI overview in AI, Data and Analytics Overview.
Choosing a database: a decision flow
The flow starts from the workload, not from a product. It names the first-party default at each leaf; every leaf has the Marketplace and self-managed alternatives listed in the map above.
Treat the tree as a starting point. A real decision also weighs team skills, existing licences, the compliance regime and the portability you want: Cloud SQL and AlloyDB speak the standard PostgreSQL and MySQL protocols and are easy to leave, whereas Spanner, Firestore and Bigtable give up some portability for capabilities nothing else offers. The engine-neutral version of the same reasoning is in Choosing the Right Database.
Common concerns across every engine
Each page linked from the map covers engine-specific setup and tuning. The concerns below apply, in some form, to every first-party option, and several apply to the self-managed ones as well.
Networking: Private Service Access and Private Service Connect
Cloud SQL, AlloyDB and Memorystore run in a Google-managed VPC, not in yours, so a private connection needs a bridge. There are two, and the choice shapes your IP planning:
-
Private Service Access (PSA) peers your VPC with the service producer’s VPC through an allocated internal range (a VPC Network Peering connection). It is the older model for Cloud SQL and AlloyDB. It is simple, but it consumes a whole CIDR block (at least a
/24is recommended) and peering is not transitive, so on-premises networks and other VPCs reach the database only through custom route advertisement. -
Private Service Connect (PSC) gives each instance an endpoint with an IP address from your own subnet, with no peering and no range allocation. It is available for Cloud SQL, AlloyDB and Memorystore (Memorystore for Valkey and Redis Cluster are PSC-based), works across VPCs and organizations, and is how Marketplace partners such as MongoDB Atlas, Elastic Cloud and Qdrant Cloud usually expose their private endpoints. Prefer it for new work.
Spanner, Firestore, Bigtable and BigQuery are reached through Google APIs rather than an address in a VPC, so you restrict them with IAM, Private Google Access and, where required, VPC Service Controls. The network pieces are in VPC Networking on Google Cloud. From a laptop, reach a private database through the Cloud SQL Auth Proxy or an IAP tunnel (VPN and Hybrid Connectivity) rather than by giving it a public IP.
Authentication: IAM database authentication and secrets
Two mechanisms replace a long-lived password in application configuration:
-
IAM database authentication (Cloud SQL and AlloyDB for PostgreSQL and MySQL, Memorystore for Valkey) lets a service account or user present a short-lived token in place of a password. The service account is the one attached to the Cloud Run service, the GKE workload identity or the VM, as explained in Identity and Access. The Cloud SQL Auth Proxy and the language connectors request and refresh the token for you. Spanner, Firestore and Bigtable have no database password at all: access is IAM only, which makes them a good fit for keyless workloads.
-
Secret Manager for credentials that remain: the password of a built-in database user, a Marketplace partner API key or a self-managed engine’s admin password. Applications read the secret at start-up or mount it as a Cloud Run secret volume. See Secret Manager and Cloud KMS and Runtime Configuration; for Spring Boot configuration import, see Configuration and Profiles.
A connection URL should refer to the secret by placeholder and never embed it, for example when the value is injected from Secret Manager as an environment variable:
spring.datasource.url=jdbc:postgresql:///catalog?cloudSqlInstance=my-project-id:us-central1:bookshelf-catalog&socketFactory=com.google.cloud.sql.postgres.SocketFactory
spring.datasource.username=catalog-api
spring.datasource.password=${DB_PASSWORD}
Derived from the
Cloud SQL documentation — About the Cloud SQL connectors
page. my-project-id and DB_PASSWORD are placeholders; with IAM database authentication the password line disappears.
Backups and point-in-time recovery
| Service | Automated backups / PITR | Notes |
|---|---|---|
Cloud SQL |
Automated daily backups with a retention you set, and point-in-time recovery from write-ahead or binary logs. |
On-demand backups are kept until deleted. Restores create or overwrite an instance; retained backups after instance deletion are an opt-in setting. |
AlloyDB |
Automated and on-demand backups plus continuous backup and recovery to any point in a configurable window. |
Cross-region backups and secondary clusters cover regional disasters. |
Spanner, Firestore, Bigtable |
Backups and point-in-time recovery (version retention for Spanner, opt-in PITR for Firestore, backups for Bigtable). |
Spanner and Bigtable support scheduled and copied backups. Firestore PITR is enabled per database. |
Memorystore |
Persistence through RDB snapshots or AOF, where the product supports it. |
A cache is normally rebuildable; treat backups as a convenience, not as the system of record. |
Self-managed on GKE or Compute Engine |
None by default. |
Use the engine’s own dump or snapshot tooling, or disk snapshots through Backup and DR, and test the restore. |
The Backup and DR Service (see Block and File Storage on Google Cloud) can sit on top of several of these
services to give one backup plan and retention policy. Backups protect against bad data and an accidental DROP TABLE;
high availability, below, does not.
High availability and replicas
-
Regional high availability keeps a standby or additional copies in another zone of the same region and fails over automatically. Cloud SQL calls it
--availability-type=regional; AlloyDB offers primary and standby in a cluster with a 99.99% SLA; Memorystore replicates across zones; Spanner, Firestore and Bigtable replicate across zones without a setting, and add multi-region configurations. See Google Cloud Global Infrastructure for the region and zone model. -
Read replicas scale read traffic and can be placed in another region for disaster recovery. Cloud SQL has read replicas and cascading replicas; AlloyDB has read pool instances and cross-region secondary clusters; Memorystore for Valkey has replicas and cross-region replication. They replicate asynchronously, so a promoted replica may lack the last writes.
Encryption
Data is encrypted at rest by default with Google-managed keys on every service above. Customer-managed encryption keys
(CMEK) in Cloud KMS are available on most of them, and must be chosen when the instance is created: you cannot add CMEK to
an existing Cloud SQL instance. In transit, require TLS in the client (for PostgreSQL, sslmode=verify-full) or use the
connectors and the Auth Proxy, which encrypt and authenticate for you. Key choices and rotation are in
Secret Manager and Cloud KMS.
Maintenance, versions and extended support
Managed services patch inside a maintenance window you choose, with optional deny periods around critical business dates; major-version upgrades are yours to schedule. Each engine major version has an end-of-standard-support date. After it, Cloud SQL keeps the instance running but charges an extended-support fee per vCPU, applied automatically for end-of-life major versions since 2025-05-01, unless you upgrade first. Defaults at the time of checking: Cloud SQL defaults to PostgreSQL 18 and MySQL 8.4 (MySQL 9.7 went GA on 2026-08-13, and SQL Server 2025 on 2026-04-06), and AlloyDB defaults to PostgreSQL 17 (PostgreSQL 18 went GA on 2026-03-25). Check each product’s version-support page before choosing a version, and follow Cloud SQL and AlloyDB for PostgreSQL for upgrade mechanics.
Cost drivers and free trials
Every service bills differently, but the same drivers recur: compute (vCPUs and memory, processing units, node hours), storage and provisioned IOPS, backup storage beyond the free allowance, cross-zone and cross-region network egress, and extended support. Serverless options (Firestore, BigQuery on demand) trade a higher unit cost for paying only while used; provisioned capacity with committed use discounts is cheaper for steady load. Use the pricing pages and the pricing calculator rather than hard-coding numbers from a guide, because prices differ by region and change.
Three products offer a free trial instance to evaluate them without a billing commitment beyond your normal account: Cloud SQL (30 days), AlloyDB (30 days) and Spanner (90 days). Trial instances are limited in size and are deleted or converted when the period ends, so do not host production data on them. The broader free program, including the Always Free tier, is described in Cost Management and Billing.
Migrating an existing database to Google Cloud
Two services handle most moves, and they solve different problems:
-
Database Migration Service (DMS) migrates databases into Cloud SQL and AlloyDB with continuous replication, so the cutover is a short promotion rather than a long outage. Homogeneous migrations (PostgreSQL to PostgreSQL, MySQL to MySQL, and SQL Server to Cloud SQL for SQL Server) copy the data and then stream changes. Heterogeneous migrations (for example Oracle to PostgreSQL) add schema and code conversion with Gemini-assisted conversion workspaces. DMS has no MongoDB to Firestore path; for MongoDB use
mongodumpandmongorestoreor Datastream, covered in MongoDB on Google Cloud. -
Datastream is a serverless change data capture (CDC) and replication service. It streams changes from Oracle, MySQL, PostgreSQL, SQL Server and MongoDB sources into BigQuery or Cloud Storage, which suits analytics feeds rather than a one-time database cutover.
For a same-engine move the native tools are often simpler: pg_dump and pg_restore for PostgreSQL, mysqldump or native
replication for MySQL, and snapshot or backup import where the service supports it. Whichever path you pick, assess
compatibility first, rehearse the cutover, and measure replication lag before switching traffic. The wider migration
playbook is in Architecture, Migration and Multicloud.
Clean up
The BigQuery example above creates a dataset, a table and a vector index. Deleting the dataset with -r removes all of
them. The other services on this page are only described here; their clean-up steps are on their own pages.
bq rm -r -f -d $PROJECT_ID:bookshelf
Derived from the BigQuery documentation — Manage datasets page. A deleted dataset can be restored within its time travel window (seven days by default).
Related pages
-
Choosing the Right Database — engine-neutral decision guide.
-
Comparing Vector Databases — the cross-engine vector database comparison with a Google Cloud column.
-
GKE Clusters — running self-managed engines on GKE.
-
Identity and Access — service accounts used for IAM database authentication.