Managed Databases on Google Cloud

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

See the section bibliography for the reference material consulted while preparing these pages.

Service names, editions and lifecycle statuses below were checked against the official Google Cloud documentation on 2026-10-01 and against gcloud CLI 586 (release 586.0.0 of 2026-09-22). Database products change names, editions and availability often (Memorystore for Memcached is being retired, Vertex AI Search became Agent Search, Firestore gained editions), so confirm the status of anything you are about to adopt on its product page. This is a landing page, not a hands-on walkthrough: for setup steps and CLI examples for a given engine, follow the link in the table to this section’s own page. The same overview exists for Azure and AWS.

The running scenario, Bookshelf, uses three of these services: a Cloud SQL for PostgreSQL instance bookshelf-catalog (database catalog) for the catalog-api with AlloyDB bookshelf-alloy as the scale-up variant, a Firestore database orders with MongoDB compatibility for the orders-api (MongoDB Atlas is the alternative), and a Memorystore for Valkey instance bookshelf-cache. The question this page answers is how to arrive at choices like those.

Choosing an engine first, a service second

Pick the data model and access pattern before looking at Google Cloud product names. That decision is engine-neutral and is covered in Choosing the Right Database, which compares relational, document, search, vector, graph and other categories. Only once the engine family is fixed does the Google Cloud question arise: which of a first-party service, a Google Cloud Marketplace SaaS offering or a self-managed deployment fits your team. Each row of the next table states which of those three kinds the option is.

Engine-to-Google Cloud option map

For every engine this site documents, the table gives the Google Cloud option(s), the kind of option, this section’s page that covers it and this site’s reference for the engine itself. "First-party" means a Google-operated managed service. "Marketplace SaaS" means a partner-operated service that you subscribe to through Google Cloud Marketplace; it is billed through your Google Cloud account, often counts toward committed spend, and is usually reachable over Private Service Connect. "Self-managed" means you run the engine yourself on Google Kubernetes Engine (GKE) or Compute Engine.

Engine Google Cloud option(s) Kind This section Engine reference

PostgreSQL

Cloud SQL for PostgreSQL; AlloyDB for PostgreSQL; Spanner with the PostgreSQL interface

First-party

Cloud SQL / AlloyDB for PostgreSQL / Spanner, Firestore and Bigtable

SQL Reference

MySQL

Cloud SQL for MySQL

First-party

Cloud SQL

SQL Reference

SQL Server

Cloud SQL for SQL Server; SQL Server on Compute Engine

First-party / self-managed

Cloud SQL

SQL Reference

MongoDB

Firestore with MongoDB compatibility (Enterprise edition); MongoDB Atlas on Google Cloud; MongoDB on GKE

First-party / Marketplace SaaS / self-managed

MongoDB on Google Cloud

MongoDB Reference, Authentication, authorization & encryption

Redis

Memorystore for Valkey; Memorystore for Redis Cluster; Memorystore for Redis; Redis Cloud

First-party / Marketplace SaaS

Memorystore and Partner Databases

Redis Reference, Deploying Redis on Google Cloud

Elasticsearch

Elastic Cloud on Google Cloud (hosted and serverless); Elastic Cloud on Kubernetes (ECK) on GKE

Marketplace SaaS / self-managed

Memorystore and Partner Databases

Elasticsearch Reference

Lucene / Solr

No managed Solr service from Google Cloud (re-verify before relying on this); Solr on GKE with the Solr Operator or on Compute Engine; Agent Search (formerly Vertex AI Search) as the managed search alternative

Self-managed / first-party alternative

Memorystore and Partner Databases

Apache Solr Reference, Apache Lucene Reference

Couchbase

Couchbase Capella; Couchbase Autonomous Operator on GKE

Marketplace SaaS / self-managed

Memorystore and Partner Databases

Couchbase Reference

Neo4j

Neo4j AuraDB; Neo4j Helm chart on GKE; Spanner Graph as the first-party graph alternative

Marketplace SaaS / self-managed / first-party alternative

Memorystore and Partner Databases / Spanner, Firestore and Bigtable

Neo4j Reference

Qdrant

Qdrant Cloud on Google Cloud regions; Qdrant Helm chart on GKE

Marketplace SaaS / self-managed

Memorystore and Partner Databases

Qdrant Reference

Prometheus

Google Cloud Managed Service for Prometheus with Cloud Monitoring and Grafana; Prometheus on GKE

First-party / self-managed

Memorystore and Partner Databases / Monitoring and Observability

Prometheus & Monitoring

Vector search (cross-engine)

pgvector on Cloud SQL; ScaNN and pgvector on AlloyDB; Firestore KNN; Spanner; BigQuery VECTOR_SEARCH; Memorystore; Vertex AI Vector Search (Agent Retrieval); plus the partner options above

First-party / Marketplace SaaS

Cloud SQL, AlloyDB for PostgreSQL, AI, Data and Analytics Overview

Comparing Vector Databases, PostgreSQL & pgvector

Where the Google Cloud column says "alternative", the Google Cloud service is a different engine that solves a similar problem, not a hosted version of the engine on this site. Agent Search is a managed retrieval service rather than a Solr or Lucene deployment, and Spanner Graph speaks GQL rather than Neo4j’s Cypher dialect. The pages Lucene vs. Solr vs. Elasticsearch vs. OpenSearch and Neo4j vs. relational and other graph databases explain the differences. The Google Cloud column of the vector comparison lives in Comparing Vector Databases, and the landscape in The Vector Database Landscape.

Marketplace SaaS databases run in the partner’s own accounts, not in your project. You subscribe in Google Cloud Marketplace, the charges appear on your Google Cloud bill, and you connect over the public internet or, where the vendor offers it, over Private Service Connect so that traffic stays on Google’s network. Self-managed deployments run in your project: you own patching, backups, upgrades and failover, but you also get the full engine feature set and a free choice of version. Running stateful engines on GKE is covered in GKE Clusters.

Google’s first-party-only engines

Four Google Cloud databases have no engine reference on this site, because they exist only as Google products. They come up in the same decisions.

Service What it is Page

Spanner

Horizontally scalable relational database with strong consistency across regions, capacity sold in processing units, GoogleSQL and PostgreSQL dialects, and Graph, full-text and vector search in the Enterprise editions. Choose it when a relational workload must scale writes beyond one primary or span regions.

Spanner, Firestore and Bigtable

Firestore

Serverless document database in Native or Datastore mode (Standard edition) or Native or MongoDB-compatible mode (Enterprise edition), with real-time listeners, security rules for mobile and web clients, and KNN vector search.

Spanner, Firestore and Bigtable / MongoDB on Google Cloud

Bigtable

Wide-column store for very high-throughput, low-latency key access such as time series and IoT, with an HBase-compatible client and GoogleSQL support. Not a general relational database.

Spanner, Firestore and Bigtable

BigQuery

Serverless analytical data warehouse billed for storage and for bytes scanned or reserved slots. For analytical (OLAP) queries over large datasets, not transactional workloads. See the next section for its vector search.

AI, Data and Analytics Overview

Firestore and Filestore are different products that happen to share a prefix: Firestore is the document database, and Filestore is the managed NFS file service in Block and File Storage on Google Cloud.

BigQuery stores embeddings in an ARRAY<FLOAT64> column and finds nearest neighbours with the VECTOR_SEARCH table function. It is the right fit when the vectors already live in the warehouse, the workload is batch or analytical (deduplication, clustering, offline recommendations), and a latency of hundreds of milliseconds to seconds is acceptable. For a low-latency online lookup behind an API, use a database built for it: pgvector or ScaNN on AlloyDB and Cloud SQL, Firestore, or Vertex AI Vector Search (renamed Agent Retrieval in the 2026 rebrand, still in Preview when this page was checked).

Without an index, VECTOR_SEARCH runs an exact brute-force scan, which is accurate and fine for small tables. For large tables, CREATE VECTOR INDEX builds an approximate index (IVF or TREE_AH, the latter based on ScaNN) that trades a little recall for speed. Vector indexes need the Enterprise or Enterprise Plus edition (reservations); on-demand projects can still run the brute-force query. The example creates a small embeddings table for the Bookshelf catalog, indexes it and searches it; the vector literals are shortened to three dimensions for readability, whereas a real embedding model produces hundreds.

gcloud services enable bigquery.googleapis.com
export PROJECT_ID=$(gcloud config get-value project)
export LOCATION=US

bq --location=$LOCATION mk --dataset $PROJECT_ID:bookshelf

bq query --use_legacy_sql=false "
CREATE TABLE bookshelf.book_embeddings AS
SELECT * FROM UNNEST([
  STRUCT('b1' AS book_id, [0.1, 0.2, 0.3] AS embedding),
  STRUCT('b2', [0.9, 0.1, 0.0]),
  STRUCT('b3', [0.2, 0.2, 0.4])
])"

bq query --use_legacy_sql=false "
CREATE VECTOR INDEX book_embeddings_idx
ON bookshelf.book_embeddings(embedding)
OPTIONS (index_type = 'IVF', distance_type = 'COSINE')"

bq query --use_legacy_sql=false "
SELECT base.book_id, distance
FROM VECTOR_SEARCH(
  TABLE bookshelf.book_embeddings, 'embedding',
  (SELECT [0.15, 0.2, 0.35] AS embedding),
  top_k => 2, distance_type => 'COSINE')"

Derived from the BigQuery documentation — Introduction to vector search, Manage vector indexes and the VECTOR_SEARCH function reference. The dataset location cannot be changed after creation, so pick it deliberately.

The query returns the two nearest books by cosine distance. The concepts behind the metrics and index types are explained in Similarity Metrics & Semantic Search and ANN Indexes: Flat, IVF, HNSW and Beyond. BigQuery can also generate the embeddings itself by calling a remote model, which belongs to the data and AI overview in AI, Data and Analytics Overview.

Choosing a database: a decision flow

The flow starts from the workload, not from a product. It names the first-party default at each leaf; every leaf has the Marketplace and self-managed alternatives listed in the map above.

flowchart TD Start["What is the workload?"] --> Q1{"Relational data with SQL and joins?"} Q1 -- Yes --> Q2{"Must scale writes or span regions with strong consistency?"} Q2 -- Yes --> Spanner["Spanner"] Q2 -- No --> Q3{"Need PostgreSQL with analytics or vector search at scale?"} Q3 -- Yes --> AlloyDB["AlloyDB for PostgreSQL"] Q3 -- No --> CloudSQL["Cloud SQL for PostgreSQL, MySQL or SQL Server"] Q1 -- No --> Q4{"Documents or key-value?"} Q4 -- Yes --> Q5{"MongoDB drivers and API required?"} Q5 -- Yes --> Mongo["Firestore with MongoDB compatibility or MongoDB Atlas"] Q5 -- No --> Q6{"Mobile or web clients with real-time sync?"} Q6 -- Yes --> Firestore["Firestore"] Q6 -- No --> Bigtable["Bigtable for massive key access and time series"] Q4 -- No --> Q7{"In-memory cache or session store?"} Q7 -- Yes --> Memorystore["Memorystore for Valkey"] Q7 -- No --> Q8{"Search, graph or vectors?"} Q8 -- "Full-text search" --> Elastic["Elastic Cloud or Solr on GKE"] Q8 -- "Graph" --> Graph["Neo4j AuraDB or Spanner Graph"] Q8 -- "Vectors" --> Vec["pgvector, AlloyDB ScaNN, Qdrant Cloud or BigQuery"] Q8 -- "Metrics" --> Prom["Managed Service for Prometheus"]

Treat the tree as a starting point. A real decision also weighs team skills, existing licences, the compliance regime and the portability you want: Cloud SQL and AlloyDB speak the standard PostgreSQL and MySQL protocols and are easy to leave, whereas Spanner, Firestore and Bigtable give up some portability for capabilities nothing else offers. The engine-neutral version of the same reasoning is in Choosing the Right Database.

Common concerns across every engine

Each page linked from the map covers engine-specific setup and tuning. The concerns below apply, in some form, to every first-party option, and several apply to the self-managed ones as well.

Networking: Private Service Access and Private Service Connect

Cloud SQL, AlloyDB and Memorystore run in a Google-managed VPC, not in yours, so a private connection needs a bridge. There are two, and the choice shapes your IP planning:

  • Private Service Access (PSA) peers your VPC with the service producer’s VPC through an allocated internal range (a VPC Network Peering connection). It is the older model for Cloud SQL and AlloyDB. It is simple, but it consumes a whole CIDR block (at least a /24 is recommended) and peering is not transitive, so on-premises networks and other VPCs reach the database only through custom route advertisement.

  • Private Service Connect (PSC) gives each instance an endpoint with an IP address from your own subnet, with no peering and no range allocation. It is available for Cloud SQL, AlloyDB and Memorystore (Memorystore for Valkey and Redis Cluster are PSC-based), works across VPCs and organizations, and is how Marketplace partners such as MongoDB Atlas, Elastic Cloud and Qdrant Cloud usually expose their private endpoints. Prefer it for new work.

Spanner, Firestore, Bigtable and BigQuery are reached through Google APIs rather than an address in a VPC, so you restrict them with IAM, Private Google Access and, where required, VPC Service Controls. The network pieces are in VPC Networking on Google Cloud. From a laptop, reach a private database through the Cloud SQL Auth Proxy or an IAP tunnel (VPN and Hybrid Connectivity) rather than by giving it a public IP.

Authentication: IAM database authentication and secrets

Two mechanisms replace a long-lived password in application configuration:

  • IAM database authentication (Cloud SQL and AlloyDB for PostgreSQL and MySQL, Memorystore for Valkey) lets a service account or user present a short-lived token in place of a password. The service account is the one attached to the Cloud Run service, the GKE workload identity or the VM, as explained in Identity and Access. The Cloud SQL Auth Proxy and the language connectors request and refresh the token for you. Spanner, Firestore and Bigtable have no database password at all: access is IAM only, which makes them a good fit for keyless workloads.

  • Secret Manager for credentials that remain: the password of a built-in database user, a Marketplace partner API key or a self-managed engine’s admin password. Applications read the secret at start-up or mount it as a Cloud Run secret volume. See Secret Manager and Cloud KMS and Runtime Configuration; for Spring Boot configuration import, see Configuration and Profiles.

A connection URL should refer to the secret by placeholder and never embed it, for example when the value is injected from Secret Manager as an environment variable:

spring.datasource.url=jdbc:postgresql:///catalog?cloudSqlInstance=my-project-id:us-central1:bookshelf-catalog&socketFactory=com.google.cloud.sql.postgres.SocketFactory
spring.datasource.username=catalog-api
spring.datasource.password=${DB_PASSWORD}

Derived from the Cloud SQL documentation — About the Cloud SQL connectors page. my-project-id and DB_PASSWORD are placeholders; with IAM database authentication the password line disappears.

Backups and point-in-time recovery

Service Automated backups / PITR Notes

Cloud SQL

Automated daily backups with a retention you set, and point-in-time recovery from write-ahead or binary logs.

On-demand backups are kept until deleted. Restores create or overwrite an instance; retained backups after instance deletion are an opt-in setting.

AlloyDB

Automated and on-demand backups plus continuous backup and recovery to any point in a configurable window.

Cross-region backups and secondary clusters cover regional disasters.

Spanner, Firestore, Bigtable

Backups and point-in-time recovery (version retention for Spanner, opt-in PITR for Firestore, backups for Bigtable).

Spanner and Bigtable support scheduled and copied backups. Firestore PITR is enabled per database.

Memorystore

Persistence through RDB snapshots or AOF, where the product supports it.

A cache is normally rebuildable; treat backups as a convenience, not as the system of record.

Self-managed on GKE or Compute Engine

None by default.

Use the engine’s own dump or snapshot tooling, or disk snapshots through Backup and DR, and test the restore.

The Backup and DR Service (see Block and File Storage on Google Cloud) can sit on top of several of these services to give one backup plan and retention policy. Backups protect against bad data and an accidental DROP TABLE; high availability, below, does not.

High availability and replicas

  • Regional high availability keeps a standby or additional copies in another zone of the same region and fails over automatically. Cloud SQL calls it --availability-type=regional; AlloyDB offers primary and standby in a cluster with a 99.99% SLA; Memorystore replicates across zones; Spanner, Firestore and Bigtable replicate across zones without a setting, and add multi-region configurations. See Google Cloud Global Infrastructure for the region and zone model.

  • Read replicas scale read traffic and can be placed in another region for disaster recovery. Cloud SQL has read replicas and cascading replicas; AlloyDB has read pool instances and cross-region secondary clusters; Memorystore for Valkey has replicas and cross-region replication. They replicate asynchronously, so a promoted replica may lack the last writes.

Encryption

Data is encrypted at rest by default with Google-managed keys on every service above. Customer-managed encryption keys (CMEK) in Cloud KMS are available on most of them, and must be chosen when the instance is created: you cannot add CMEK to an existing Cloud SQL instance. In transit, require TLS in the client (for PostgreSQL, sslmode=verify-full) or use the connectors and the Auth Proxy, which encrypt and authenticate for you. Key choices and rotation are in Secret Manager and Cloud KMS.

Maintenance, versions and extended support

Managed services patch inside a maintenance window you choose, with optional deny periods around critical business dates; major-version upgrades are yours to schedule. Each engine major version has an end-of-standard-support date. After it, Cloud SQL keeps the instance running but charges an extended-support fee per vCPU, applied automatically for end-of-life major versions since 2025-05-01, unless you upgrade first. Defaults at the time of checking: Cloud SQL defaults to PostgreSQL 18 and MySQL 8.4 (MySQL 9.7 went GA on 2026-08-13, and SQL Server 2025 on 2026-04-06), and AlloyDB defaults to PostgreSQL 17 (PostgreSQL 18 went GA on 2026-03-25). Check each product’s version-support page before choosing a version, and follow Cloud SQL and AlloyDB for PostgreSQL for upgrade mechanics.

Cost drivers and free trials

Every service bills differently, but the same drivers recur: compute (vCPUs and memory, processing units, node hours), storage and provisioned IOPS, backup storage beyond the free allowance, cross-zone and cross-region network egress, and extended support. Serverless options (Firestore, BigQuery on demand) trade a higher unit cost for paying only while used; provisioned capacity with committed use discounts is cheaper for steady load. Use the pricing pages and the pricing calculator rather than hard-coding numbers from a guide, because prices differ by region and change.

Three products offer a free trial instance to evaluate them without a billing commitment beyond your normal account: Cloud SQL (30 days), AlloyDB (30 days) and Spanner (90 days). Trial instances are limited in size and are deleted or converted when the period ends, so do not host production data on them. The broader free program, including the Always Free tier, is described in Cost Management and Billing.

Migrating an existing database to Google Cloud

Two services handle most moves, and they solve different problems:

  • Database Migration Service (DMS) migrates databases into Cloud SQL and AlloyDB with continuous replication, so the cutover is a short promotion rather than a long outage. Homogeneous migrations (PostgreSQL to PostgreSQL, MySQL to MySQL, and SQL Server to Cloud SQL for SQL Server) copy the data and then stream changes. Heterogeneous migrations (for example Oracle to PostgreSQL) add schema and code conversion with Gemini-assisted conversion workspaces. DMS has no MongoDB to Firestore path; for MongoDB use mongodump and mongorestore or Datastream, covered in MongoDB on Google Cloud.

  • Datastream is a serverless change data capture (CDC) and replication service. It streams changes from Oracle, MySQL, PostgreSQL, SQL Server and MongoDB sources into BigQuery or Cloud Storage, which suits analytics feeds rather than a one-time database cutover.

For a same-engine move the native tools are often simpler: pg_dump and pg_restore for PostgreSQL, mysqldump or native replication for MySQL, and snapshot or backup import where the service supports it. Whichever path you pick, assess compatibility first, rehearse the cutover, and measure replication lag before switching traffic. The wider migration playbook is in Architecture, Migration and Multicloud.

Clean up

The BigQuery example above creates a dataset, a table and a vector index. Deleting the dataset with -r removes all of them. The other services on this page are only described here; their clean-up steps are on their own pages.

bq rm -r -f -d $PROJECT_ID:bookshelf

Derived from the BigQuery documentation — Manage datasets page. A deleted dataset can be restored within its time travel window (seven days by default).