MySQL

Covers MySQL 8 on your own servers, Amazon RDS and Aurora MySQL, Azure Database for MySQL and Google Cloud SQL for MySQL. Tested on MySQL 8.0 and 8.4.

Before you start

• MySQL 8. The gateway computes tokens inside MySQL with SHA2(), and setup checks that they match the gateway’s own.
• An administrator who can create a user and grant privileges.
• The database’s host name on the gateway’s allowed hosts (Allow the host).

Network access

The gateway connects to the server’s port, 3306 by default, over TLS. Open that port to the gateway as described in Network access. The certificate and host name are always checked (ssl-mode=VERIFY_IDENTITY).

Create a read-only login

Run this as an administrator. Replace sales with the database (schema) Portward will read and <password> with a strong password.

CREATE USER 'portward_reader'@'%' IDENTIFIED BY '<password>';
GRANT SELECT ON sales.* TO 'portward_reader'@'%';

To accept the login only from the gateway, replace % with the gateway’s address in both lines.

Portward reads the tables and views in that one database. Don’t grant anything else. With INSERT, UPDATE, DELETE, CREATE, DROP, ALTER, INDEX or TRIGGER on the database, every table counts as one the login could change. Setup refuses a login with an administrator privilege on *.*.

Hosted versions

Amazon RDS and Aurora MySQL

• Run the SQL above as the master user. The master user itself is refused, because it holds administrator privileges on *.* with the grant option.
• In setup, use the instance or cluster endpoint and add that exact name to the allowed hosts.
• You don’t need to paste a CA. The gateway checks the certificate against Amazon’s RDS CA bundle.
• Allow port 3306 from the gateway in the instance’s security group.

Azure Database for MySQL (flexible server)

• Run the SQL above as the server’s admin login. The admin login itself is refused, because it holds administrator privileges.
• Keep the server parameter require_secure_transport on.
• You don’t need to paste a CA. Azure’s certificate comes from a public CA.
• Under Networking, allow the gateway’s address in the firewall rules, or reach the server through a private network the gateway can use.

Google Cloud SQL for MySQL

Connect directly with the shared CA (every install), or through the Cloud SQL Auth Proxy (your own server or the Azure VM only), exactly as on the PostgreSQL page’s Google Cloud SQL section. The root user is refused; create portward_reader with the SQL above.

Connect it in setup

Choose MySQL and fill in Name (the name people and the AI see, such as sales), Host, Port (empty means 3306), Database, User (portward_reader) and Password. Paste Server CA certificate (PEM) only for a company CA or Cloud SQL’s CA.

What the setup check tests

Before it saves, setup connects with the login and checks, in this order:

1. The host is on the allowed hosts (“isn’t in the hosts the gateway operator allowed for setup”). An RDS or Aurora name allowed only by a wildcard gets “is on a domain other customers share”.
2. It can sign in (“login failed: check the user and password”).
3. The session is encrypted (“the connection isn’t using TLS”).
4. The login is not an administrator (“connect with a read-only login, not an administrator”). The gateway reads SHOW GRANTS, including every role granted to the login, and refuses SUPER, FILE, SHUTDOWN, RELOAD, CREATE USER, SYSTEM_USER, ALL, any ..._ADMIN privilege, or the grant option on *.*.
5. A token computed inside MySQL matches the gateway’s own (“in-database tokens don’t match; MySQL 8 is required”).
6. It lists the tables and views in the database. A table the login could write to is listed as one it could change, and can’t be exposed.

Each time the gateway starts, it runs the same checks and refuses a login that can write to a table it exposes (“use a read-only login”).