The situation:
The Cloud SQL proxy failed at startup with: couldn't connect to "PROJECT:REGION:INSTANCE": ensure that the account has access ... Error during createEphemeral for PROJECT:REGION:INSTANCE: googleapi: Error 403: The client is not authorized to make this request., notAuthorized. The instance connection name was correct and the service account already had the Cloud SQL Client role , in one case two identically-configured service accounts behaved differently, one working and one failing.
What actually fixes it (verified in the thread):
This is a known IAM propagation quirk, not a proxy bug: re-grant the role to force it to take effect. Remove the Cloud SQL Client role from the failing service account in IAM & Admin > IAM (uncheck it and Save), verify the account disappears from the list, then Add it back with the Cloud SQL Client role and Save. Multiple users confirmed this fixed the identical 403 createEphemeral error, with one reporting the fix was still relevant two years later. Also double-check the connection name for typos , project IDs use dashes, not underscores, which was the original reporter's first mistake. Source: https://github.com/GoogleCloudPlatform/cloud-sql-proxy/issues/37