Before starting a local App Engine development server that connects to a Cloud SQL for PostgreSQL instance, how do you keep all Cloud SQL traffic encrypted and authenticated to Cloud IAM and PostgreSQL?

The Cloud SQL Auth Proxy is the recommended and most secure way to connect to Cloud SQL instances, especially from local development environments. It encrypts all traffic using TLS 1.3 and authenticates connections using Cloud IAM, eliminating the need for SSL certificates or whitelisted IP addresses. By running it locally and configuring your application to connect to localhost, you ensure secure communication to your Cloud SQL instance. Installing PostgreSQL locally (option 1) bypasses Cloud SQL entirely. Using a Compute Engine instance with HAProxy (option 3) adds unnecessary complexity and cost for local development. Connecting directly to the private IP (option 4) is not possible from a local machine without a VPN, and client-side encryption is a separate concern from secure transport.