Percona Server MySQL

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Percona Server for MySQL. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login).

Under Network settings, select your VPC and subnet. Create or select a security group that allows inbound port 22 from your management network and inbound port 3306 from any client networks that will connect to MySQL. Leave the root volume at the default size or larger. The MySQL data volume is attached automatically from the image.

Select Launch instance. First boot initialisation generates the passwords and starts Percona Server. It takes a minute or two after the instance state becomes Running and the status checks pass.

The following command launches an instance from the SecureAnyCloud Percona Server for MySQL Marketplace AMI into an existing subnet and security group. Replace the values as follows:

• <ami-id>: the AMI ID shown on the Marketplace listing
• <key-name>: your EC2 key pair name
• <subnet-id>: your subnet ID
• <security-group-id>: a security group that opens inbound port 22 and port 3306 from your client networks

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":30,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=percona-01}]'

On success the command prints a JSON document. Note the instance ID. Once the instance is running, retrieve its public address with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant you launched. For Percona Server for MySQL 8 on Ubuntu 24.04, the login user is ubuntu.

ssh <login-user>@<public-ip>

Wait until the instance has passed both EC2 status checks before you connect. The first boot service runs as part of system startup, so Percona Server is initialised and the credentials file is in place by the time you can log in.

The first boot service generates fresh root and SecureAnyCloud passwords for this instance. It writes them, with the connection details, to /root/percona-credentials.txt, which only root can read. Display the file from your SSH session:

sudo cat /root/percona-credentials.txt

The file looks like this, with a unique pair of passwords on your instance:

# Percona Server for MySQL 8 - generated on first boot.
mysql.host=54.211.13.92 mysql.port=3306 mysql.root.user=root mysql.root.pass=<your generated root password> mysql.sac.user=sac mysql.sac.pass=<your generated application user password>

Use the mysql.root.pass value as the password for the root account, and the mysql.sac.pass value as the password for the SecureAnyCloud application user. Both accounts have full privileges across all databases. The SecureAnyCloud user is also reachable remotely on port 3306, while the root user is restricted to root@localhost.

Percona Server runs under systemd as the mysql service and starts automatically on boot. Confirm that the service is active:

sudo systemctl status mysql.service --no-pager

The output shows the unit as active (running):

* mysql.service - Percona Server Loaded: loaded (/usr/lib/systemd/system/mysql.service; enabled; preset: enabled) Drop-In: /etc/systemd/system/mysql.service.d `-10-firstboot-order.conf Active: active (running) since Sun 2026-05-24 23:56:44 UTC; 12s ago

Confirm that the MySQL wire protocol listens on port 3306 and the identity page listens on port 80:

sudo ss -tln | grep -E ':80 |:3306 '

The output shows both ports bound on all interfaces:

LISTEN 0 200 0.0.0.0:3306 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:*

Open a MySQL session as the root user, with the password from the credentials file:

PASS=$(sudo awk -F= '/^mysql.root.pass=/{print $2}' /root/percona-credentials.txt)
sudo mysql -u root -p"$PASS"

Confirm that the build identifies as Percona Server, not stock MySQL, and that the InnoDB buffer pool uses the image default size:

SELECT VERSION(); SELECT @@version_comment AS version_comment; SELECT @@innodb_buffer_pool_size AS innodb_buffer_pool_size;

The output identifies Percona Server 8.0 and shows the default 512 MiB buffer pool:

VERSION() 8.0.45-36 version_comment Percona Server (GPL), Release '36', Revision '8fe4a72d' innodb_buffer_pool_size 536870912

List the system and user databases:

SHOW DATABASES;

The fresh server reports the four system databases:

Database information_schema mysql performance_schema sys

When you are done, exit the mysql client with exit; or Ctrl-D.

From the mysql client, create your first database, create a table, and insert a row:

PASS=$(sudo awk -F= '/^mysql.root.pass=/{print $2}' /root/percona-credentials.txt)
sudo mysql -u root -p"$PASS"

CREATE DATABASE my_app; USE my_app; CREATE TABLE accounts ( id INT AUTO_INCREMENT PRIMARY KEY, email VARCHAR(255) NOT NULL UNIQUE, created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ) ENGINE=InnoDB; INSERT INTO accounts (email) VALUES ('alice@example.com'); SELECT * FROM accounts;

The SELECT returns the row you inserted, with its auto-generated identifier and timestamp:

+----+--------------------+---------------------+ | id | email | created_at | +----+--------------------+---------------------+ | 1 | alice@example.com | 2026-05-25 00:01:23 | +----+--------------------+---------------------+

The SecureAnyCloud user is created with full privileges and is reachable from any host ('SecureAnyCloud'@'%'). Open port 3306 to your application CIDR in the EC2 security group, then connect from your application host:

mysql -h <public-ip> -P 3306 -u sac -p

When prompted, paste the mysql.sac.pass value from the credentials file. Use the SecureAnyCloud account for application connections because it can be reached over the network. The root account is intentionally restricted to localhost, a database hardening best practice.

A small nginx service on port 80 serves a static page that identifies the running product. From the instance, fetch the page:

curl -s http://127.0.0.1/ | head -8

nginx serves the identity page, which identifies the running product as Percona Server for MySQL:

<!doctype html> <html lang="en"> <head> <meta charset="utf-8" /> <meta name="viewport" content="width=device-width,initial-scale=1" /> <title>Percona Server for MySQL - sac AWS Marketplace AMI</title>

This page does not proxy to MySQL. The MySQL wire protocol on port 3306 is the actual product. To disable the page on a production instance, stop nginx.service (sudo systemctl disable --now nginx.service).

Database files live on a dedicated EBS volume mounted at /var/lib/mysql. Confirm the mount and the free space:

df -h /var/lib/mysql /

The output shows the data disk separate from the OS disk:

Filesystem Size Used Avail Use% Mounted on /dev/nvme1n1 30G 194M 28G 1% /var/lib/mysql /dev/root 19G 4.0G 15G 22% /

To grow the data volume, resize the underlying EBS volume in the AWS console or with the AWS CLI. Then run growpart and resize2fs on the instance to extend the filesystem live without downtime.

Percona Server is a single systemd unit, mysql.service. Manage it with the standard service commands:

sudo systemctl status mysql.service
# current state
sudo systemctl restart mysql.service
# rolling restart (brief connection drop)
sudo systemctl stop mysql.service
# stop the daemon
sudo systemctl start mysql.service
# start the daemon

The nginx identity page runs as nginx.service. The per-instance first boot service is percona-firstboot.service. It is a one-shot service and has already completed by the time you log in.

The image ships with innodb_buffer_pool_size = 512M, a sensible default for an m5.large (8 GB RAM). For production workloads on larger instances, raise it to roughly 60-70% of host RAM. Edit /etc/mysql/mysql.conf.d/99-sac.cnf:

[mysqld] bind-address = 0.0.0.0 datadir = /var/lib/mysql default-authentication-plugin = caching_sha2_password innodb_buffer_pool_size = 5G
# 5 GiB on an m5.xlarge with 16 GB RAM max_connections = 200

Apply the change with sudo systemctl restart mysql.service.

To rotate the root password, log in with the existing password and run ALTER USER:

PASS=$(sudo awk -F= '/^mysql.root.pass=/{print $2}' /root/percona-credentials.txt)
sudo mysql -u root -p"$PASS" -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '<new-password>';"

After rotation, update /root/percona-credentials.txt with the new password so that the credentials file stays accurate. To rotate the application credential, repeat the process for the SecureAnyCloud user (ALTER USER 'SecureAnyCloud'@'%' IDENTIFIED BY '...').

For ad hoc logical backups, use mysqldump, which ships in the image:

PASS=$(sudo awk -F= '/^mysql.root.pass=/{print $2}' /root/percona-credentials.txt)
sudo mysqldump -u root -p"$PASS" --all-databases --single-transaction --routines --triggers --events \
  > /tmp/mysql-backup-$(date +%F).sql

For production environments, use Percona XtraBackup, the hot backup tool for InnoDB. XtraBackup is part of the Percona suite and is available from the same Percona apt repository that the server was installed from. Install it with:

sudo apt-get install -y percona-xtrabackup-80

XtraBackup documentation: https://docs.percona.com/percona-xtrabackup/8.0/.