Appointment booking down: every API request returns 500

Chifae Rendez-vous, a medical appointment booking platform for about thirty practices in Rabat and Salé, runs its API api-rdv on Cloud Run (europe-west1), with a Cloud SQL PostgreSQL database pg-rdv-prod. The database password is stored in Secret Manager (db-password-rdv) and read by the application the first time it accesses the database.

Last night, following an audit, Imane (security lead) replaced the Compute Engine default service account (Editor role on the whole project!) with a dedicated least-privilege runtime account: run-rdv@chifae-prod-5094.iam.gserviceaccount.com. The deployment completed without errors.

Since the practices opened, no patient can book anymore: the mobile app shows “Server error”. The on-call developer blames the database.

You are on your workstation, with gcloud configured on the project chifae-prod-5094, region europe-west1.