6.2 Cloud SQL Availability and Recovery
Key Takeaways
Regional HA and cross-region read replicas protect different failure boundaries.
PITR restores into a new instance rather than undoing a deletion in place.
Recovery windows and backup options depend on engine, edition and configuration.
Relational Storage Patterns: Cloud SQL and Cloud Spanner
Modern cloud-native architectures require developers to select relational storage systems that balance relational semantics, transaction consistency, operational overhead, and scalability. In Google Cloud, relational database workloads primarily target two managed services: Cloud SQL for traditional single-region or replicated relational workloads, and Cloud Spanner for enterprise systems demanding horizontal scaling, multi-region active-active availability, and strictly serializable ACID transactions. The Google Cloud Professional Cloud Developer exam rigorously tests your ability to configure high availability, design anti-hotspotting schemas, manage database connection scaling, and evaluate the trade-offs between Cloud SQL and Cloud Spanner.
The HA and PITR examples below focus on Cloud SQL PostgreSQL; compare the current engine-specific documentation for MySQL or SQL Server.
Cloud SQL: Fully Managed Relational Engines
Cloud SQL delivers fully managed instances of three industry-standard relational database engines:
- PostgreSQL (supported versions depend on edition and lifecycle; check the current version policy)
- MySQL (supported versions depend on the version policy)
- SQL Server (supported versions and editions depend on the current service matrix)
Core Management Capabilities
- Automated Maintenance and Patching: Google Cloud automatically patches the underlying operating system and database engine during configurable weekly maintenance windows. Developers can specify rollout channels (
previeworproduction) and set maintenance deny periods of up to 90 days to prevent updates during business-critical sales cycles. - Storage Autoscaling: When enabled, Cloud SQL can increase storage as space becomes low. Capacity cannot be reduced in place. Thresholds, increase rules, and maintenance behavior depend on disk type and edition; monitor storage and set a suitable limit rather than relying on a universal percentage or cooldown.
- Data Encryption: Data is encrypted at rest by default, with supported CMEK options. Use the Auth Proxy/connectors or explicitly configured TLS for network connections; a database endpoint does not universally enforce TLS 1.3 by default.
High Availability (HA) & Disaster Recovery in Cloud SQL
Cloud SQL High Availability (HA) provides resilience against zonal infrastructure outages through regional synchronous replication.
+--------------------------------------------------------------------------+
| Cloud SQL High Availability (HA) Regional Configuration |
+--------------------------------------------------------------------------+
| Region: us-central1 |
| |
| Primary Zone: us-central1-a Standby Zone: us-central1-c |
| +---------------------------+ +---------------------------+ |
| | Primary Database Instance | | Standby Instance | |
| | (Serves Read/Write App) | | (Passive, Pre-warmed VM) | |
| +-------------+-------------+ +-------------+-------------+ |
| | | |
| v v |
| +-------------+-------------+ +-------------+-------------+ |
| | Primary Persistent Disk |===========>| Standby Persistent Disk | |
| | (Active Data Storage) |Synchronous | (Mirrored Storage) | |
| +---------------------------+Replication +---------------------------+ |
+--------------------------------------------------------------------------+
HA Architecture & Failover Mechanics
- Topology: An HA instance consists of a primary instance in a primary zone (e.g.,
us-central1-a) and a standby instance in a secondary zone within the same region (e.g.,us-central1-c). - Synchronous Block-Level Replication: Storage replication between the primary and standby nodes is handled at the regional persistent disk level. Every committed database transaction must be written synchronously to disks in both zones before being acknowledged to the application client, guaranteeing a Recovery Point Objective (RPO) of 0 (zero data loss).
- Failure Detection: Managed health checking determines whether automatic failover is appropriate. Application failure detection, retries, and total recovery time must be measured separately.
- Failover Duration: Failover interrupts existing connections; duration varies with configuration and recovery. Do not equate an availability SLA with a guaranteed per-incident RTO. The standby instance attaches the mirrored persistent disk, initializes database engine processes, and assumes the primary instance's static IP and DNS name. Application clients reconnect to the exact same IP address or connection string without manual reconfiguration.
Read Replicas and Read Scaling
- Asynchronous Replication: Read replicas replicate asynchronously from the primary instance. Because replication is asynchronous, read replicas experience replication lag and are suitable for read-heavy query offloading, reporting, and dashboard generation, but not for strict read-your-writes consistency.
- Cross-Zone vs. Cross-Region Replicas: Read replicas can reside in the same zone, a different zone within the same region, or in an entirely different geographic region. Cross-region read replicas provide localized low-latency reads for global users and serve as disaster recovery standbys that can be manually promoted to a standalone read-write database if a regional disaster occurs.
- Replica Promotion: Promoting a read replica converts it into an independent read-write Cloud SQL instance. This breaks the original replication relationship. Re-establishing replication requires a deliberate recovery or migration procedure; it is not an automatic undo.
Backups & Point-In-Time Recovery (PITR)
| Capability | Automated Backups | Point-In-Time Recovery (PITR) |
|---|---|---|
| Mechanism | Daily scheduled disk snapshots taken during a defined backup window. | Engine-specific recovery logs, such as PostgreSQL WAL or MySQL binary logs, together with backups. |
| Recovery Granularity | Restores state to the exact moment the daily snapshot completed. | Restores state to a supported timestamp within the retention window. |
| Retention Period | Depends on the standard/enhanced backup option and retention configuration. | For Cloud SQL PostgreSQL: 1-7 days in Enterprise, 1-35 days in Enterprise Plus; check engine and backup settings. |
| Restoration Target | Restores into the existing instance (overwriting data) or into a brand-new instance. | Must restore into a brand-new Cloud SQL instance; cannot overwrite in-place. |
| Primary Use Case | Disaster recovery after catastrophic loss; baseline archival. | Undoing developer errors (accidental DROP TABLE, bad migration script, data corruption). |
Exam Trap: PITR restores data to a new instance, not to the existing instance. When recovering from an accidental table deletion, developers must restore PITR data to a new database instance, extract the dropped tables or records, and re-import them into the production database—or redirect application traffic to the newly restored instance.
Official references checked October 18, 2026: Google Cloud 1, Google Cloud 2.
A developer accidentally drops a Cloud SQL table and needs point-in-time recovery. Which recovery target is correct?
Rewind the running instance in place without a new instance.
Restore to a new instance, verify the data, then recover records or deliberately redirect clients.
Use a read-only replica as an automatic historical snapshot at any timestamp.
Assume regional HA undoes logical deletes.
Sections you finish are checked off in the contents.