googleapis/mcp-toolbox · error

error creating user: %w

Error message

error creating user: %w

What it means

Thrown in CreateUsers when the sqladmin Users.Insert call (projects.instances.users.insert) fails after passing the password validation. The API rejected or failed the user-creation request.

Source

Thrown at internal/sources/cloudsqladmin/cloud_sql_admin.go:222

	}

	user := sqladmin.User{
		Name: name,
	}

	if iamUser {
		user.Type = "CLOUD_IAM_USER"
	} else {
		user.Type = "BUILT_IN"
		if password == "" {
			return nil, fmt.Errorf("missing 'password' parameter for non-IAM user")
		}
		user.Password = password
	}

	resp, err := service.Users.Insert(project, instance, &user).Do()
	if err != nil {
		return nil, fmt.Errorf("error creating user: %w", err)
	}

	return resp, nil
}

func (s *Source) GetInstance(ctx context.Context, projectId, instanceId, accessToken string) (any, error) {
	service, err := s.GetService(ctx, accessToken)
	if err != nil {
		return nil, err
	}

	resp, err := service.Instances.Get(projectId, instanceId).Do()
	if err != nil {
		return nil, fmt.Errorf("error getting instance: %w", err)
	}
	return resp, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Check whether the user already exists before inserting (idempotency).
2. Strengthen the password to satisfy any password validation policy on the instance.
3. Grant roles/cloudsql.admin to the caller.
4. Inspect the wrapped googleapi.Error code/message for the precise API reason (409 exists, 403 permission, 404 instance).
5. Confirm the instance name/project are correct and the instance is runnable.

Example fix

// before: weak password rejected by policy
Users.Insert(project, instance, &sqladmin.User{Name: "app", Password: "123"})
// after
Users.Insert(project, instance, &sqladmin.User{Name: "app", Password: "Str0ng-Passw0rd!"})

// check for existing user before insert
existing, err := service.Users.List(project, instance).Do()
if err == nil {
    for _, u := range existing.Items {
        if u.Name == name {
            return nil // user already exists
        }
    }
}
if len(password) < 8 {
    return fmt.Errorf("password too short for typical Cloud SQL policies")
}

func isConflict(err error) bool {
    var gerr *googleapi.Error
    return errors.As(err, &gerr) && gerr.Code == 409
}

out, err := src.CreateUsers(ctx, project, instance, name, password, iamUser, token)
if err != nil {
    var gerr *googleapi.Error
    if errors.As(err, &gerr) {
        if gerr.Code == 409 {
            return fmt.Errorf("user %q already exists", name)
        }
        if gerr.Code == 403 {
            return fmt.Errorf("missing cloudsql.users.create permission: %w", err)
        }
    }
    return fmt.Errorf("create user failed: %w", err)
}

When it happens

Trigger: Calling create_user when the user already exists, the password violates the instance's password policy (Cloud SQL built-in password validation for Postgres/MySQL), the instance is not found, or IAM lacks cloudsql.users.create.

Common situations: Duplicate username on retry; password rejected by validate_password policy on MySQL instances; IAM principal missing roles/cloudsql.admin; host parameter conflicts on MySQL instances.

Related errors

• error cloning instance: %w
• error creating database: %w
• error getting instance: %w
• error listing databases: %w
• error listing instances: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/5fa1889c76d643b6. Report an issue: GitHub.