Can't connect remotely

Check: bind-address (AWS: /etc/my.cnf AND my.cnf.d/zz-hardening.cnf; GCE: /etc/mysql/mysql.conf.d/zz-hardening.cnf); cloud firewall. Fix: Both must be opened deliberately — see deploy step 2.

`sudo mysql` denied (AWS)

Check: ls /var/lib/mysql-firstboot.done. Fix: If missing, first boot hasn't finished or failed: `journalctl -u mysql-firstboot` (the unit retries on the next boot rather than stamping done with root locked out).

mysqld won't start after config edit

Check: `journalctl -u mysqld -n 50` (AWS) / `journalctl -u mysql -n 50` (GCE). Fix: Revert the edit; on AWS keys in /etc/my.cnf override my.cnf.d — check both.

Troubleshoot MySQL Community Server (Hardened) — Derek Coleman & Associates Inc Docs

Symptom	Check	Fix
Can't connect remotely	bind-address (AWS: /etc/my.cnf AND my.cnf.d/zz-hardening.cnf; GCE: /etc/mysql/mysql.conf.d/zz-hardening.cnf); cloud firewall	Both must be opened deliberately — see deploy step 2.
`sudo mysql` denied (AWS)	ls /var/lib/mysql-firstboot.done	If missing, first boot hasn't finished or failed: `journalctl -u mysql-firstboot` (the unit retries on the next boot rather than stamping done with root locked out).
mysqld won't start after config edit	`journalctl -u mysqld -n 50` (AWS) / `journalctl -u mysql -n 50` (GCE)	Revert the edit; on AWS keys in /etc/my.cnf override my.cnf.d — check both.

Logs & useful commands

AWS: /var/log/mysqld.log; `journalctl -u mysqld -f`. GCE: /var/log/mysql/error.log; `journalctl -u mysql -f`
Health: sudo mysql -e 'SELECT 1' (AWS: first boot is complete when /var/lib/mysql-firstboot.done exists; GCE: ready as soon as the mysql service is active)
First boot state: AWS: mysqld auto-initializes /var/lib/mysql on first start, then a one-shot unit (mysql-firstboot.service, marker /var/lib/mysql-firstboot.done) switches root to auth_socket and verifies it — seconds; the temporary password MySQL writes to /var/log/mysqld.log during initialization is invalidated in that same boot. GCE: the Ubuntu package initialized the data directory at image build with root already on auth_socket; only the server-uuid (auto.cnf) is regenerated on your first start. No credential is generated on either cloud.

Still stuck? Email support@dcassociatesgroup.com with the product name, cloud + region, instance size, and the output of the health command — first response within 1 business day, most tickets same-day.