Configure MySQL Community Server (Hardened)

Configuration files

AWS: /etc/my.cnf and /etc/my.cnf.d/zz-hardening.cnf (bind-address 127.0.0.1; mysqlx off/loopback; auth_socket plugin loaded — duplicated in both files deliberately). GCE: /etc/mysql/mysql.conf.d/zz-hardening.cnf (same bind/mysqlx keys) over the Ubuntu defaults in /etc/mysql/.

Credential rotation

Not applicable to root (socket auth). For app users you create: ALTER USER ... IDENTIFIED BY with your own secret.

Monitoring & logging

• Logs: AWS: /var/log/mysqld.log; `journalctl -u mysqld -f`. GCE: /var/log/mysql/error.log; `journalctl -u mysql -f`
• Health: sudo mysql -e 'SELECT 1' (AWS: first boot is complete when /var/lib/mysql-firstboot.done exists; GCE: ready as soon as the mysql service is active) — wire this into your cloud's monitoring agent or an external probe.
• Cloud-native agents (CloudWatch agent, Google Cloud Ops Agent) install normally on this image if you want metrics/log shipping — none is pre-installed or phoning home by default.

Upgrades

Prefer replacing the instance with the newest image version (monthly + event-driven CVE rebuilds). In place: `sudo dnf update mysql-community-server` (AWS) or `sudo apt upgrade mysql-server` (GCE) between refreshes. Major-version upgrades follow MySQL's documented path — take a backup first.

Backup & restore

mysqldump --all-databases via `sudo mysql`, or stop mysqld and snapshot the volume. Restore: standard mysql import into a fresh instance.