googleapis/mcp-toolbox · error

error creating user

Error message

error creating user: %w

What it means

Thrown in CreateUsers when the sqladmin Users.Insert call (projects.instances.users.insert) fails after passing the password validation. The API rejected or failed the user-creation request.

Solutions

1. Check whether the user already exists before inserting (idempotency).
2. Strengthen the password to satisfy any password validation policy on the instance.
3. Grant roles/cloudsql.admin to the caller.
4. Inspect the wrapped googleapi.Error code/message for the precise API reason (409 exists, 403 permission, 404 instance).
5. Confirm the instance name/project are correct and the instance is runnable.

Example fix

// before: weak password rejected by policy
Users.Insert(project, instance, &sqladmin.User{Name: "app", Password: "123"})
// after
Users.Insert(project, instance, &sqladmin.User{Name: "app", Password: "Str0ng-Passw0rd!"})

// check for existing user before insert
existing, err := service.Users.List(project, instance).Do()
if err == nil {
    for _, u := range existing.Items {
        if u.Name == name {
            return nil // user already exists
        }
    }
}
if len(password) < 8 {
    return fmt.Errorf("password too short for typical Cloud SQL policies")
}

func isConflict(err error) bool {
    var gerr *googleapi.Error
    return errors.As(err, &gerr) && gerr.Code == 409
}

out, err := src.CreateUsers(ctx, project, instance, name, password, iamUser, token)
if err != nil {
    var gerr *googleapi.Error
    if errors.As(err, &gerr) {
        if gerr.Code == 409 {
            return fmt.Errorf("user %q already exists", name)
        }
        if gerr.Code == 403 {
            return fmt.Errorf("missing cloudsql.users.create permission: %w", err)
        }
    }
    return fmt.Errorf("create user failed: %w", err)
}

When it happens

Trigger: Calling create_user when the user already exists, the password violates the instance's password policy (Cloud SQL built-in password validation for Postgres/MySQL), the instance is not found, or IAM lacks cloudsql.users.create.

Common situations: Duplicate username on retry; password rejected by validate_password policy on MySQL instances; IAM principal missing roles/cloudsql.admin; host parameter conflicts on MySQL instances.

Related errors

• error cloning instance
• error creating database
• error executing sql
• error getting instance
• error listing databases

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/5fa1889c76d643b6. Report an issue: GitHub.

Appendix: source

Thrown at internal/sources/cloudsqladmin/cloud_sql_admin.go:222

	}

	user := sqladmin.User{
		Name: name,
	}

	if iamUser {
		user.Type = "CLOUD_IAM_USER"
	} else {
		user.Type = "BUILT_IN"
		if password == "" {
			return nil, fmt.Errorf("missing 'password' parameter for non-IAM user")
		}
		user.Password = password
	}

	resp, err := service.Users.Insert(project, instance, &user).Do()
	if err != nil {
		return nil, fmt.Errorf("error creating user: %w", err)
	}

	return resp, nil
}

func (s *Source) GetInstance(ctx context.Context, projectId, instanceId, accessToken string) (any, error) {
	service, err := s.GetService(ctx, accessToken)
	if err != nil {
		return nil, err
	}

	resp, err := service.Instances.Get(projectId, instanceId).Do()
	if err != nil {
		return nil, fmt.Errorf("error getting instance: %w", err)
	}
	return resp, nil
}

View on GitHub (pinned to 8cc6e09de2)