Please follow the instructions on connecting with a service account using Cloud SQL proxy.
A few things to note:
Google Cloud SQL Admin API
The Google Cloud SQL Admin API must be enabled. We don't perform admin actions, but this is a requirement for any proxy-based access including read-only.
Service account access
Please give the service account
email@example.com the IAM permission "Cloud SQL client". This only allows us to connect to the proxy, but does not allow us any database permissions.
Database username and password
Once we have connected to your instance using Cloud SQL Proxy, we still need a normal Postgres user to access your tables.