If you intend to use "Allow only SSL connections" option on your Cloud SQL
database, the service account must include the following permission to be
able to generate ephemeral client certificates:

```ini
cloudsql.sslCerts.createEphemeral
```

GCP does not currently support granting this permission to custom roles so
you'd need to assign "Cloud SQL Admin" role to the Teleport service account.

Note that "Allow only SSL connections" setting only forces the client to
provide a client certificate - all communication between Teleport and the
database is still over TLS even with this setting disabled.