On a Compute Engine VM using Cloud SQL Proxy and the VM's service account, which IAM role provides least privilege while allowing the VM to connect to Cloud SQL?

The Cloud SQL Client role (roles/cloudsql.client) grants permissions to connect to Cloud SQL instances using the Cloud SQL Proxy. This is the principle of least privilege, as it provides only the necessary permissions for connection without granting broader administrative access. Assigning the Project Editor or Project Owner roles would grant excessive permissions, including the ability to modify or delete resources across the entire project, far beyond what's needed for Cloud SQL Proxy connectivity. The Cloud SQL Editor role (roles/cloudsql.editor) allows managing Cloud SQL instances, such as creating or deleting databases, which is also more privilege than required for simply connecting via the proxy.