Connect Google AlloyDB to Excel, Sheets and AI

An agent in the VPC is the whole design

AlloyDB is built to be private, and the Network Agent is built to make only outbound connections. Those two facts fit together neatly enough that the private path is the default rather than the hardened option.

• Run the agent on a VM in the same VPC and it reaches the instance over its private IP. Nothing about AlloyDB is published, and no public IP is needed.
• The agent dials out and never listens, so there is no ingress rule to add and nothing for anyone outside the VPC to reach.
• Because AlloyDB is addressed by IP rather than by hostname, there is nothing in the address for Query Streams to recognise. The AlloyDB badge comes from choosing this card, not from sniffing the address — so a plain Postgres connection to the same IP stays labelled as plain Postgres.
• AlloyDB is PostgreSQL-compatible and nothing else. Unlike Cloud SQL, which also offers MySQL and SQL Server, there is one engine here and no engine picker.

Through the Auth Proxy, turn SSL off

The other supported path is Google's AlloyDB Auth Proxy, and it changes one answer on the form.

• Run the proxy on the agent's machine and point the card at 127.0.0.1. The card notices localhost and says what to do next.
• The proxy encrypts the tunnel itself. Asking the Postgres driver to negotiate its own TLS on top of that is what produces the SSL error people hit here, so clear the checkbox for a proxied connection.
• On a direct private-IP connection, leave the checkbox on. AlloyDB is the exception among hosted providers here — the checkbox genuinely controls whether TLS is used, rather than being overridden by the agent.
• When TLS is on, the traffic is encrypted but the certificate chain is not verified.

Ordinary Postgres once connected

There is no AlloyDB-specific machinery past the address and the proxy. What arrives is Postgres.

• The connection is saved as PostgreSQL with AlloyDB kept as the badge. There is no connection type called AlloyDB.
• Authentication is a database username and password. Google Cloud IAM database authentication is not supported by this card.
• There is no pooler configuration and no pooled endpoint to choose. The agent connects directly.
• public is the default schema, and it is what a cross-source reference carries.

-- Ordinary Postgres, read-only, over the private IP
SELECT   c.name,
         COUNT(o.id)   AS orders,
         SUM(o.amount) AS revenue
FROM     public.customers AS c
JOIN     public.orders    AS o ON o.customer_id = c.id
WHERE    o.placed_at >= now() - interval '30 days'
GROUP BY c.name
ORDER BY revenue DESC;