Install MySQL Community Server (Hardened)

Prerequisites

• An account on the target cloud with permission to launch VM instances (no special IAM roles are required by this product unless stated below — IAM required: none).
• An SSH key pair registered in the target cloud (all access is key-only; password SSH is disabled).
• Instance size ≥ 4 vCPU (pricing floor; 8 vCPU recommended).
• No internet access or external dependency is required at deploy time — the image is self-contained.

AWS

1. Subscribe and launch (4 vCPU+ recommended for production workloads; gp3 volume sized for your data).
   Expected result Instance 2/2 checks; `sudo mysql -e 'SELECT VERSION()'` returns 8.4.x.
2. Remote access is OFF by default (3306 bound to 127.0.0.1). To enable: set bind-address to your VPC address in BOTH /etc/my.cnf and /etc/my.cnf.d/zz-hardening.cnf, `sudo systemctl restart mysqld`, create a non-root app user with a strong password, AND open 3306 in the security group to your app subnet only.
   Expected result App connects from inside the VPC; 3306 remains unreachable from the internet.

Google Cloud

1. Deploy from the Marketplace listing (or the deployment package): OS Login, IAP-only SSH — 3306 is closed by the package by default.
   Expected result gcloud compute ssh <vm> --tunnel-through-iap works; `sudo mysql -e 'SELECT VERSION()'` returns 8.0.x.
2. For in-VPC clients: set bind-address in /etc/mysql/mysql.conf.d/zz-hardening.cnf to the VM's internal address, `sudo systemctl restart mysql`, create a non-root app user, and add a firewall rule for 3306 from your subnet only.
   Expected result App connects from inside the VPC; the internet cannot reach 3306.

Validate

sudo mysql -e 'SELECT 1'  (AWS: first boot is complete when /var/lib/mysql-firstboot.done exists; GCE: ready as soon as the mysql service is active)

First boot: AWS: mysqld auto-initializes /var/lib/mysql on first start, then a one-shot unit (mysql-firstboot.service, marker /var/lib/mysql-firstboot.done) switches root to auth_socket and verifies it — seconds; the temporary password MySQL writes to /var/log/mysqld.log during initialization is invalidated in that same boot. GCE: the Ubuntu package initialized the data directory at image build with root already on auth_socket; only the server-uuid (auto.cnf) is regenerated on your first start. No credential is generated on either cloud.

First login / credentials

1. SSH in with the key pair you chose at launch (AWS: ssh ec2-user@<public-ip>; GCP: gcloud compute ssh <vm> --tunnel-through-iap).
2. Open a root database shell with `sudo mysql` — root authenticates through the unix socket (auth_socket); there is no root password to find or type.
3. Create your own application user before anything connects: CREATE USER 'app'@'%' IDENTIFIED BY '<strong-secret>'; GRANT ... ; then follow the remote-access step on this page — 3306 is bound to 127.0.0.1 until you change it.

Secure it

• Restrict SSH (22) to your own IP range in the cloud firewall/security group.
• Open application ports only per the ports table — closed-by-default is deliberate.
• Volume encryption: use your cloud's native volume encryption (enabled by default on most accounts); the image adds no proprietary encryption layer.

Costs & quotas

Software is billed by the marketplace at the listed rate; infrastructure (VM, storage, egress) is billed by your cloud at its standard rates. The recommended size fits default service quotas in most accounts — if you scale out, review your cloud's quota console before launch.

Next: configuration · troubleshooting · security notes