Google Cloud PostgreSQL User Management

I’m wrapping up a Cloud SQL for PostgreSQL deployment and now need a solid user-management layer. The focus is squarely on two areas: setting up user authentication and defining granular authorization rules.

I want all authentication to flow through OAuth so that identities are managed centrally in Google Cloud IAM and can later tie into any SSO provider we adopt. Alongside OAuth, I’d like a rotating-password policy in place for the handful of service accounts that cannot use OAuth directly.

Here’s what I need from you:
• Configure OAuth 2.0 access for Cloud SQL (PostgreSQL) using Google Cloud IAM.
• Create role-based authorization that matches our existing schema design (read-only, read-write, ).
• Implement the rotating-password policy for the service accounts, including automation scripts or Cloud Functions so passwords refresh on schedule without downtime.
• Provide concise documentation and a short walkthrough so my DBA team can extend or modify the setup later.

I’ll consider the job complete when I can:
1. Log in through OAuth with a test user and see only the objects assigned to that role.
2. Watch a service account password rotate on schedule and confirm the application reconnects seamlessly.

If you’re comfortable with Google Cloud IAM, Cloud SQL, pg_roles, and scripting (gcloud, Terraform, or Python), I’m ready to get started right away.