Do same‑instance Cloud SQL restores preserve IAM bindings and custom flags?

Answer

Yes. A point‑in‑time restore that targets the existing Cloud SQL instance (a "same‑instance" restore) leaves the instance’s IAM bindings and custom flags unchanged.

Why this happens

• IAM bindings are attached to the instance resource as an IAM policy; they are not stored inside the backup snapshot, so the restore operation does not overwrite them.
• Custom flags (e.g., max_connections, log_min_duration_statement) live in the instance’s settings.databaseFlags metadata. The restore only replaces the underlying database files and the initial configuration captured at backup time; the settings section is preserved.

Verification steps

1. After the restore completes, run:

gcloud sql instances describe INSTANCE_NAME --format='json'

and check that the settings.databaseFlags array matches the pre‑restore values.

2. Check the IAM policy:

gcloud projects get-iam-policy PROJECT_ID \
    --filter='resource:sqladmin.googleapis.com/Instance,INSTANCE_NAME'

or view the IAM tab in the Cloud Console for the instance and confirm the bindings are identical.

3. Optionally, diff the settings block from a pre‑restore describe output with the post‑restore output to ensure no unintended changes.

Missing diagnostic detail

To be certain the above applies, confirm that you performed a same‑instance restore (using the "Restore backup" action on the existing instance) rather than creating a new instance from the backup. If you created a new instance, IAM bindings and flags would need to be reapplied manually.