You are configuring the networking of a Cloud SQL instance. The only application that connects to this database resides on a Compute Engine VM in the same project as the Cloud SQL instance. The VM…

Removing the internal IP would break the private, secure connectivity between the VM and the Cloud SQL instance, which is the opposite of improving security.

Relying solely on Private Service Connect while disabling both IPs would break all connectivity unless Private Service Connect endpoints are explicitly configured, adding unnecessary complexity.

Specifying an authorized network with the VM's CIDR range still leaves the Cloud SQL instance reachable over the public internet, only restricting which public IPs can connect - it does not remove the external exposure.

When a VM and Cloud SQL instance share the same VPC network and both have private IP addresses, connectivity over the internal network is already possible. Removing the external IP from the Cloud SQL instance eliminates any exposure to the public internet, improving network security without affecting the application's ability to connect via the private IP.