|
1 | 1 | --- |
2 | | -# generated by https://github.com/hashicorp/terraform-plugin-docs |
3 | | -page_title: "mysql Provider" |
4 | | -subcategory: "" |
| 2 | +layout: "mysql" |
| 3 | +page_title: "Provider: MySQL" |
| 4 | +sidebar_current: "docs-mysql-index" |
5 | 5 | description: |- |
6 | | - |
| 6 | + A provider for MySQL Server. |
7 | 7 | --- |
8 | 8 |
|
9 | | -# mysql Provider |
10 | | - |
11 | | - |
12 | | - |
13 | | - |
14 | | - |
15 | | -<!-- schema generated by tfplugindocs --> |
16 | | -## Schema |
17 | | - |
18 | | -### Required |
19 | | - |
20 | | -- `endpoint` (String) |
21 | | -- `username` (String) |
22 | | - |
23 | | -### Optional |
24 | | - |
25 | | -- `authentication_plugin` (String) |
26 | | -- `azure_config` (Block List) (see [below for nested schema](#nestedblock--azure_config)) |
27 | | -- `conn_params` (Map of String) |
28 | | -- `connect_retry_timeout_sec` (Number) |
29 | | -- `custom_tls` (Block List) (see [below for nested schema](#nestedblock--custom_tls)) |
30 | | -- `iam_database_authentication` (Boolean) |
31 | | -- `max_conn_lifetime_sec` (Number) |
32 | | -- `max_open_conns` (Number) |
33 | | -- `password` (String) |
34 | | -- `private_ip` (Boolean) |
35 | | -- `proxy` (String) |
36 | | -- `tls` (String) |
37 | | - |
38 | | -<a id="nestedblock--azure_config"></a> |
39 | | -### Nested Schema for `azure_config` |
40 | | - |
41 | | -Optional: |
42 | | - |
43 | | -- `client_id` (String) |
44 | | -- `client_secret` (String) |
45 | | -- `environment` (String) |
46 | | -- `tenant_id` (String) |
47 | | - |
48 | | - |
49 | | -<a id="nestedblock--custom_tls"></a> |
50 | | -### Nested Schema for `custom_tls` |
51 | | - |
52 | | -Required: |
53 | | - |
54 | | -- `ca_cert` (String) |
55 | | -- `client_cert` (String) |
56 | | -- `client_key` (String) |
57 | | - |
58 | | -Optional: |
59 | | - |
60 | | -- `config_key` (String) |
| 9 | +# MySQL Provider |
| 10 | + |
| 11 | +[MySQL](http://www.mysql.com) is a relational database server. The MySQL |
| 12 | +provider exposes resources used to manage the configuration of resources |
| 13 | +in a MySQL server. |
| 14 | + |
| 15 | +Use the navigation to the left to read about the available resources. |
| 16 | + |
| 17 | +## Example Usage |
| 18 | + |
| 19 | +The following is a minimal example: |
| 20 | + |
| 21 | +```hcl |
| 22 | +# Configure the MySQL provider |
| 23 | +provider "mysql" { |
| 24 | + endpoint = "my-database.example.com:3306" |
| 25 | + username = "app-user" |
| 26 | + password = "app-password" |
| 27 | +} |
| 28 | +
|
| 29 | +# Create a Database |
| 30 | +resource "mysql_database" "app" { |
| 31 | + name = "my_awesome_app" |
| 32 | +} |
| 33 | +``` |
| 34 | + |
| 35 | +This provider can be used in conjunction with other resources that create |
| 36 | +MySQL servers. For example, ``aws_db_instance`` is able to create MySQL |
| 37 | +servers in Amazon's RDS service. |
| 38 | + |
| 39 | +```hcl |
| 40 | +# Create a database server |
| 41 | +resource "aws_db_instance" "default" { |
| 42 | + engine = "mysql" |
| 43 | + engine_version = "5.6.17" |
| 44 | + instance_class = "db.t1.micro" |
| 45 | + name = "initial_db" |
| 46 | + username = "rootuser" |
| 47 | + password = "rootpasswd" |
| 48 | +
|
| 49 | + # etc, etc; see aws_db_instance docs for more |
| 50 | +} |
| 51 | +
|
| 52 | +# Configure the MySQL provider based on the outcome of |
| 53 | +# creating the aws_db_instance. |
| 54 | +provider "mysql" { |
| 55 | + endpoint = "${aws_db_instance.default.endpoint}" |
| 56 | + username = "${aws_db_instance.default.username}" |
| 57 | + password = "${aws_db_instance.default.password}" |
| 58 | +} |
| 59 | +
|
| 60 | +# Create a second database, in addition to the "initial_db" created |
| 61 | +# by the aws_db_instance resource above. |
| 62 | +resource "mysql_database" "app" { |
| 63 | + name = "another_db" |
| 64 | +} |
| 65 | +``` |
| 66 | + |
| 67 | +Using encrypted connections can be done by using the `custom_tls` field in the provider |
| 68 | + |
| 69 | +```hcl |
| 70 | +provider "mysql" { |
| 71 | + endpoint = "my-database.example.com:3306" |
| 72 | + username = "app-user" |
| 73 | + custom_tls { |
| 74 | + config_key = "custom_key" |
| 75 | + ca_cert = "/path/to/certs/ca.pem" |
| 76 | + client_cert = "/path/to/certs/client_cert.pem" |
| 77 | + client_key = "/path/to/certs/client_key.pem" |
| 78 | + } |
| 79 | +} |
| 80 | +``` |
| 81 | + |
| 82 | +And via Variables: |
| 83 | + |
| 84 | +```hcl |
| 85 | +variable "mysql_tls_ca_cert" { |
| 86 | + sensitive = true |
| 87 | + type = string |
| 88 | +} |
| 89 | +variable "mysql_tls_client_cert" { |
| 90 | + sensitive = true |
| 91 | + type = string |
| 92 | +} |
| 93 | +variable "mysql_tls_client_key" { |
| 94 | + sensitive = true |
| 95 | + type = string |
| 96 | +} |
| 97 | +
|
| 98 | +provider "mysql" { |
| 99 | + endpoint = "my-database.example.com:3306" |
| 100 | + username = "app-user" |
| 101 | + custom_tls { |
| 102 | + config_key = "custom_key" |
| 103 | + ca_cert = var.mysql_tls_ca_cert |
| 104 | + client_cert = var.mysql_tls_client_cert |
| 105 | + client_key = var.mysql_tls_client_key |
| 106 | + } |
| 107 | +} |
| 108 | +``` |
| 109 | + |
| 110 | +**Note** It it is _strongly_ recommended to ensure that these values/variables are marked as sensitive |
| 111 | + |
| 112 | + |
| 113 | + |
| 114 | + |
| 115 | +### GCP CloudSQL Connection |
| 116 | + |
| 117 | +For connections to GCP hosted instances, the provider can connect through the Cloud SQL MySQL library. |
| 118 | + |
| 119 | +To enable Cloud SQL MySQL library, add `cloudsql://` to the endpoint `Network type` DSN string and connection name of the instance in following format: `project/region/instance` (or `project:region:instance`). |
| 120 | + |
| 121 | +```hcl |
| 122 | +# Configure the MySQL provider for CloudSQL Mysql |
| 123 | +provider "mysql" { |
| 124 | + endpoint = "cloudsql://project:region:instance" |
| 125 | + username = "app-user" |
| 126 | + password = "app-password" |
| 127 | +} |
| 128 | +``` |
| 129 | + |
| 130 | +For a connection to an instance with no public IP add the `private_ip` option to the provider configuration. |
| 131 | + |
| 132 | +```hcl |
| 133 | +# Configure the MySQL provider for CloudSQL Mysql |
| 134 | +provider "mysql" { |
| 135 | + endpoint = "cloudsql://project:region:instance" |
| 136 | + username = "app-user" |
| 137 | + password = "app-password" |
| 138 | + private_ip = true |
| 139 | +} |
| 140 | +``` |
| 141 | + |
| 142 | +See also: [Authentication at Google](https://cloud.google.com/docs/authentication#service-accounts). |
| 143 | + |
| 144 | +### Azure MySQL server with AzureAD auth enabled connection |
| 145 | + |
| 146 | +To use this authentication, add `azure://` to the endpoint. This will lead to ignore `password` field which would be replaced by Azure AD |
| 147 | +token of currently obtained identity. You have to use `username` as stated in Azure documentation. |
| 148 | + |
| 149 | +```hcl |
| 150 | +# Configure the MySQL provider for Azure Mysql Server with AzureAD authentication enabled |
| 151 | +provider "mysql" { |
| 152 | + endpoint = "azure://your-azure-instance-name.mysql.database.azure.com" |
| 153 | + |
| 154 | + # or if you granted access to AAD group: username = "Active_Directory_GroupName" |
| 155 | +} |
| 156 | +``` |
| 157 | + |
| 158 | +By default the provider will connect using DefaultAzureCredential from the Azure SDK for Go. The credentials can be provided by setting the `AZURE_*` environment variables, using a workload identity or a managed identity present on the host. |
| 159 | + |
| 160 | +You can also further configure the Azure connection using the `azure_config` block: |
| 161 | + |
| 162 | +```hcl |
| 163 | +# Configure the MySQL provider for Azure Mysql Server with specific credentials |
| 164 | +provider "mysql" { |
| 165 | + endpoint = "azure://your-azure-instance-name.mysql.database.azure.com" |
| 166 | + |
| 167 | +
|
| 168 | + azure_config { |
| 169 | + tenant_id = "your-tenant-id" |
| 170 | + client_id = "your-client-id" |
| 171 | + client_secret = var.client_secret |
| 172 | + } |
| 173 | +} |
| 174 | +``` |
| 175 | + |
| 176 | +See also: [Azure Active Directory authentication for MySQL](https://learn.microsoft.com/en-us/azure/mysql/flexible-server/how-to-azure-ad). |
| 177 | + |
| 178 | +## SOCKS5 Proxy Support |
| 179 | + |
| 180 | +The MySQL provider respects the `ALL_PROXY` and/or `all_proxy` environment variables. |
| 181 | + |
| 182 | +``` |
| 183 | +$ export all_proxy="socks5://your.proxy:3306" |
| 184 | +``` |
| 185 | + |
| 186 | +## Argument Reference |
| 187 | + |
| 188 | +The following arguments are supported: |
| 189 | + |
| 190 | +* `endpoint` - (Required) The address of the MySQL server to use. Most often a "hostname:port" pair, but may also be an absolute path to a Unix socket when the host OS is Unix-compatible. Can also be sourced from the `MYSQL_ENDPOINT` environment variable. |
| 191 | +* `username` - (Required) Username to use to authenticate with the server, can also be sourced from the `MYSQL_USERNAME` environment variable. |
| 192 | +* `password` - (Optional) Password for the given user, if that user has a password, can also be sourced from the `MYSQL_PASSWORD` environment variable. |
| 193 | +* `proxy` - (Optional) Proxy socks url, can also be sourced from `ALL_PROXY` or `all_proxy` environment variables. |
| 194 | +* `tls` - (Optional) The TLS configuration. One of `false`, `true`, or `skip-verify`. Defaults to `false`. Can also be sourced from the `MYSQL_TLS_CONFIG` environment variable. |
| 195 | +* `custom_tls` - (Optional) Sets custom tls options for the connection. Documentation for encrypted connections can be found [here](https://dev.mysql.com/doc/refman/8.0/en/using-encrypted-connections.html). Consider setting shorter `connect_retry_timeout_sec` for debugging, as the default is 10 minutes .This is a block containing an optional `config_key`, which value is discarded but might be useful when troubleshooting, and the following required arguments: |
| 196 | + * `ca_cert` - Local filesystem path or string containing Certificate - If value begins with `-----BEGIN` we assume you're passing the certificate directly, otherwise a file from the local filesystem will be used. |
| 197 | + * `client_cert` - Local filesystem path or string containing Certificate - If value begins with `-----BEGIN` we assume you're passing the certificate directly, otherwise a file from the local filesystem will be used. |
| 198 | + * `client_key` - Local filesystem path or string containing Certificate - If value begins with `-----BEGIN` we assume you're passing the certificate directly, otherwise a file from the local filesystem will be used. |
| 199 | + |
| 200 | +* `max_conn_lifetime_sec` - (Optional) Sets the maximum amount of time a connection may be reused. If d <= 0, connections are reused forever. |
| 201 | +* `max_open_conns` - (Optional) Sets the maximum number of open connections to the database. If n <= 0, then there is no limit on the number of open connections. |
| 202 | +* `conn_params` - (Optional) Sets extra mysql connection parameters (ODBC parameters). Most useful for session variables such as `default_storage_engine`, `foreign_key_checks` or `sql_log_bin`. |
| 203 | +* `authentication_plugin` - (Optional) Sets the authentication plugin, it can be one of the following: `native` or `cleartext`. Defaults to `native`. |
| 204 | +* `iam_database_authentication` - (Optional) For Cloud SQL databases, it enabled the use of IAM authentication. Make sure to declare the `password` field with a temporary OAuth2 token of the user that will connect to the MySQL server. |
| 205 | +* `private_ip` - (Optional) Whether to use a connection to an instance with a private ip. Defaults to `false`. This argument only applies to CloudSQL and is ignored elsewhere. |
| 206 | +* `azure_config` - (Optional) Sets the Azure configuration for the connection. This is a block containing the following arguments: |
| 207 | + * `client_id` - (Optional) The client ID for the Azure AD application. Can also be sourced from the `AZURE_CLIENT_ID` or `ARM_CLIENT_ID` environment variables. |
| 208 | + * `client_secret` - (Optional) The client secret for the Azure AD application. Can also be sourced from the `AZURE_CLIENT_SECRET` or `ARM_CLIENT_SECRET` environment variables. |
| 209 | + * `tenant_id` - (Optional) The tenant ID for the Azure AD application. Can also be sourced from the `AZURE_TENANT_ID` or `ARM_TENANT_ID` environment variables. |
| 210 | + * `environment` - (Optional) The Azure environment to use. Can also be sourced from the `AZURE_ENVIRONMENT` or `ARM_ENVIRONMENT` environment variables. Possible values are `public`, `china`, `german`, `usgovernment`. Defaults to `public`. |
0 commit comments