MySQL

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for MySQL Community Server. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group that allows inbound port 22 from your management network.

To let application-tier instances connect to MySQL, add an inbound rule for TCP port 3306 from the security group of your application subnet. Leave the root volume at the default size or larger. The MySQL data volume is attached automatically from the image.

Select Launch instance. First-boot initialisation initialises the data directory and generates the root and SecureAnyCloud passwords. It takes a minute or two after the instance state becomes Running and the status checks pass.

Run the following command to launch an instance from the SecureAnyCloud MySQL Community Server Marketplace AMI into an existing subnet and security group.

Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens inbound port 22 from your management network.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":12,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=mysql-01}]'

On success, the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from Step 2. The SSH login user depends on the operating system of the AMI variant you launched:

AMI variant SSH login user

MySQL Community Server 8.0 on Ubuntu 24.04 ubuntu

ssh <login-user>@<public-ip>

Wait until the instance has passed both EC2 status checks before you connect. The first-boot service runs before the SSH daemon is ready, so MySQL is initialised by the time you can log in.

The first-boot service generates a fresh root password and a separate SecureAnyCloud administrative user password for this instance. It writes them, with the connection details, to /root/mysql-credentials.txt, which only the root user can read.

Display the file from your SSH session:

sudo cat /root/mysql-credentials.txt

The file looks like this, with unique passwords on your instance:

# MySQL Community Server 8.0 — Per-Instance Credentials
# Generated on first boot: Sun May 24 21:42:18 UTC 2026
#
# Open the local mysql client with:
#
sudo mysql -u root (uses socket auth — no password needed)
# Or remotely from an app tier:
# mysql -u sac -p -h <instance-ip> -P 3306 sac
# MYSQL_PORT=3306 MYSQL_SOCKET=/var/run/mysqld/mysqld.sock MYSQL_DEFAULT_DATABASE=sac MYSQL_ROOT_PASSWORD=<your generated root password> MYSQL_SAC_USER=sac MYSQL_SAC_PASSWORD=<your generated sac password>

The root user authenticates with the new password over TCP, and with operating system socket authentication when invoked with sudo.

The SecureAnyCloud user is a standard administrative user with full privileges on the preconfigured SecureAnyCloud database. It is intended for application connections from other instances in your VPC.

MySQL runs under systemd as the mysql service and starts automatically on boot. Confirm that it is active:

systemctl is-active mysql

The command prints active. Then confirm that the MySQL wire protocol is listening on port 3306 on all interfaces, so application-tier instances can connect across the VPC:

ss -tln | grep 3306

The output shows a listening socket on 0.0.0.0:3306. The MySQL X Protocol on 33060 is restricted to the loopback address by default.

The mysql command-line client ships with the image. The most convenient local connection uses Unix socket authentication as root, without prompting for a password:

sudo mysql -u root

The command opens the mysql> interactive prompt. Type exit to leave it.

To connect over TCP, which is how application code connects, pass the host, port and password on the command line. Replace <password> with the value of MYSQL_ROOT_PASSWORD from the credentials file:

mysql -u root -p'<password>' -h 127.0.0.1 -P 3306

To run a single statement without entering the interactive shell, add -e. To verify the connection non-interactively, query the server version:

sudo mysql -u root -e "SELECT VERSION();"

The query returns the running MySQL release:

+-----------+ | VERSION() | +-----------+ | 8.0.46 | +-----------+

List the databases on the instance. The four MySQL system schemas are present, alongside the preconfigured SecureAnyCloud database that is ready for your application data:

sudo mysql -u root -e "SHOW DATABASES;"

+--------------------+ | Database | +--------------------+ | sac | | information_schema | | mysql | | performance_schema | | sys | +--------------------+

The SecureAnyCloud database is empty by default, and the SecureAnyCloud administrative user has full privileges on it. To create your own database for a new application, run a CREATE DATABASE statement:

sudo mysql -u root -e "CREATE DATABASE IF NOT EXISTS my_app CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"

Connect to the SecureAnyCloud database and create a small schema. Replace <root-password> with the value of MYSQL_ROOT_PASSWORD:

sudo mysql -u root sac

CREATE TABLE products ( id INT AUTO_INCREMENT PRIMARY KEY, name VARCHAR(120) NOT NULL, price DECIMAL(10, 2) NOT NULL ); INSERT INTO products (name, price) VALUES ('Mechanical Keyboard', 89.00), ('Wireless Mouse', 39.50); SELECT id, name, price FROM products ORDER BY id;

Inside mysql, the second block creates a table, inserts two rows and queries them back. Each statement returns its result and a row count. Type exit to leave the prompt.

A common pattern is to create one MySQL user per application database, with privileges scoped to that database only. The following statements create a user named app with a password and grant it full access to the my_app database created in Step 7. Replace <app-password> with a strong password for the application:

sudo mysql -u root <<SQL CREATE USER 'app'@'%' IDENTIFIED WITH caching_sha2_password BY '<app-password>'; GRANT ALL PRIVILEGES ON my_app.* TO 'app'@'%'; FLUSH PRIVILEGES; SQL

The 'app'@'%' host specifier permits the user to connect from any IP address. Combine it with a security group rule that allows inbound 3306 only from your application subnet, so network access is scoped correctly.

The caching_sha2_password plugin requires a recent version of the MySQL connector library in your application.

From an application instance in the same VPC, connect with the SecureAnyCloud administrative user or the per-application user you created. Replace <instance-ip> with the private IP address of the database instance:

mysql -u sac -p -h <instance-ip> -P 3306 sac

In application code, point your library's connection string at the database instance. For example, with the Python mysql-connector-python package:

import mysql.connector conn = mysql.connector.connect( host='<instance-ip>', port=3306, user='sac', password='<sac-password>', database='sac', )

MySQL data, transaction logs and binary logs are stored under /var/lib/mysql, a dedicated EBS volume separate from the operating system disk. Confirm the mount:

findmnt /var/lib/mysql

TARGET SOURCE FSTYPE OPTIONS /var/lib/mysql /dev/nvme1n1 ext4 rw,relatime

Check the available space:

df -h /var/lib/mysql

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 30G 192M 28G 1% /var/lib/mysql

To grow the data volume, increase its size in the AWS console or with the AWS CLI. Then expand the filesystem on the instance:

sudo growpart /dev/nvme1n1 1 || true
sudo resize2fs /dev/nvme1n1

On a fresh instance, the data volume is 30 GiB by default. The fstab entry is keyed on the filesystem UUID, so the mount survives reboots and AMI relaunches regardless of NVMe device name ordering.

MySQL runs under systemd as the mysql service. Use the standard systemctl commands to check, restart, stop or start it:

sudo systemctl status mysql
sudo systemctl restart mysql
sudo systemctl stop mysql
sudo systemctl start mysql

Read the server logs with journalctl:

sudo journalctl -u mysql --since "10 minutes ago" --no-pager

MySQL also writes its error log to /var/log/mysql/error.log. You can enable the optional slow query log in /etc/mysql/mysql.conf.d/mysqld.cnf.

mysqldump ships with the image and produces a portable SQL script that you can restore into any MySQL or compatible server. The following command dumps the SecureAnyCloud database to a file:

sudo mysqldump --single-transaction --routines --triggers sac \
  > /tmp/sac-backup.sql

The --single-transaction flag uses a consistent snapshot of the InnoDB tables without holding write locks, so the dump runs against a live production database.

Copy the dump file to durable storage, such as Amazon S3, with the AWS CLI. Replace <your-backup-bucket> with the name of an S3 bucket your instance role can write to:

aws s3 cp /tmp/sac-backup.sql s3://<your-backup-bucket>/sac-$(date -u +%Y%m%d).sql

To restore a dump into a new instance, create a destination database and pipe the script through the mysql client. Replace <target-database> with the name of the database you want to restore into:

sudo mysql -u root -e "CREATE DATABASE <target-database>;"
sudo mysql -u root <target-database> < /tmp/sac-backup.sql

For larger databases, consider physical backups with AWS EBS snapshots of the data volume. An EBS snapshot taken with the database in a consistent state restores the entire /var/lib/mysql directory in one step.

The image runs as a single MySQL primary. For high availability and read scaling, launch one or more replica instances from the same Marketplace AMI. Configure them with CHANGE REPLICATION SOURCE TO to follow the primary.

The image ships the standard mysql binary, so every replication topology supported by MySQL Community Server is available. The MySQL Reference Manual covers replication configuration in detail.

For automatic failover, layer a high availability tool such as MySQL InnoDB Cluster, ProxySQL or Orchestrator on top of the replica set. SecureAnyCloud support can advise on the topology that best fits your workload.