A Principled Technologies report: Hands-on testing. Real-world results.
PaaS and IaaS: What to know for MySQL deployments
PaaS deployments: Azure Database for MySQL – Flexible Server
Best practices for deploying Azure Database for MySQL – Flexible Server
Understanding Azure Database for MySQL – Flexible Server
Benefits of deploying Azure Database for MySQL – Flexible Server
Planning for your deployment on Azure PaaS
Service tiers and Azure VM series overview
Azure VM service tiers and workload considerations
AMD processor-based VM series to consider
Configurable options and limitations
Deploying Azure Database for MySQL – Flexible Server
Creating an Azure Database for MySQL – Flexible Server via the Azure portal
Creating an Azure Database for MySQL – Flexible Server via Azure CLI
Overview of using Azure Resource Manager templates
Managing Azure Database for MySQL – Flexible Server
Scaling up an existing deployment
Managing Azure Database for MySQL – Flexible Server using the Azure portal
Connecting to Azure Database for MySQL – Flexible Server with Azure CLI and creating a database
Connecting to Azure Database for MySQL – Flexible Server with MySQL Workbench
User management and access controls
Threat detection, prevention, and mitigation
Backup and disaster recovery best practices
Automated and on-demand backups
Monitoring performance and health
Documentation and knowledge base
IaaS deployments: MySQL on Azure IaaS
Planning for your MySQL deployment on Azure IaaS
Azure VM series operating system choices
AMD processor-based VM series to consider
Installing MySQL 8 on the Ubuntu VM
Connection configuration parameters
InnoDB configuration parameters
MySQL security features and considerations
Role-based access control (RBAC)
Full and incremental (a.k.a. point-in-time) recovery
MySQL™ is one of the most used open-source relational databases in the market, and organizations can easily pair it with Microsoft Azure technologies to gain the flexibility and reliability benefits of the cloud. With its beginnings in the 1990s,1 MySQL has many features for handling structured and unstructured data, complex queries, and transactional or reporting applications. By choosing to run MySQL on Azure, customers can enjoy a myriad of VM choices, storage configurations, monitoring tools, security, and high availability (HA) options.
This document addresses best practices for deploying Azure Database for MySQL – Flexible Server and MySQL on Azure infrastructure as a service (IaaS). It covers VM selection, deployment procedures, monitoring and maintenance, storage considerations, database configuration considerations, and backup and restore.
As organizations continue to shift their MySQL databases to the cloud, selecting the right deployment model becomes a critical decision that can impact flexibility, scalability, and operational efficiency. Two predominant cloud service models—Platform as a Service (PaaS) and Infrastructure as a Service (IaaS)—offer distinct advantages depending on the needs of an organization. PaaS streamlines application deployment by providing a ready-to-use platform that abstracts much of the underlying infrastructure complexity. IaaS provides a highly customizable cloud environment where businesses can have complete control over the operating system, storage, and networking.
By offering PaaS and IaaS solutions for MySQL, Azure allows organizations to select the model that best suits their needs while continuing to use familiar Microsoft and Azure tools. Choosing between the Azure PaaS and IaaS offerings comes down to the balance among organizations' needs for control, convenience, and available resources.
PaaS refers to cloud computing services that provide a managed platform for customers to develop, host, and manage applications without manually building, maintaining, and securing the underlying infrastructure. PaaS platforms deploy and configure infrastructure and automatically handle all maintenance, patching, and updates. With Azure Database for MySQL – Flexible Server, this means that customers can focus on business-critical activities, including application development, instead of devoting resources to database management tasks, such as HA, disaster recovery, backups, and geographic data replication.
PaaS offers these specific advantages:
PaaS provides features that could bring additional advantages for staff and operations, including pre-coded application components, such as workflows, directory services, security features, and search.
In contrast to the benefits of PaaS, IaaS demands more technical resources and effort for deployment and configuration but provides complete control over the OS and database. This level of control is crucial in scenarios such as hosting legacy applications, meeting stringent regulatory and compliance requirements, or scenarios where organizations need higher levels of customization.
IaaS offers the following specific benefits:
IaaS provides flexibility and a greater degree of control over your infrastructure. Manual deployment, management, and maintenance could require higher operational overhead and technical knowledge. For organizations that require this level of control and customization or that have in-house technical expertise, IaaS could be a good choice.
To make the right choice between PaaS and IaaS for your organization, you need to consider your specific needs and workloads. In this report, we explain how to plan and deploy either an Azure Database for MySQL – Flexible Server solution or MySQL on Azure IaaS.
The section covers deployment procedures and considerations for Azure Database for MySQL – Flexible Server, including compute selection, storage options, deployment methods, monitoring and maintenance considerations, failover and HA configurations, and backup and restore options.
Azure Database for MySQL – Flexible Server is a fully managed, fully functional MySQL database PaaS platform. Azure automates database deployment, management, maintenance, hosting, and HA tasks for the virtual infrastructure hosting the database. After deployment, users and applications can access the database service via a client of their choosing. To manage shifting needs, admins can adjust database parameters to match workload requirements. They can also use the auto scale IOPS capability to cater to specific workload requirements and scale compute and storage resources dynamically in times of unexpectedly high demand.
Azure also offers robust networking, security, provisioning, and redundancy capabilities that can be costly and complex to maintain in a self-hosted environment.
Azure Database for MySQL – Flexible Server supports MySQL versions 5.7 and 8.0.2 Azure automates regular patches and updates within the supported MySQL versions on either a customer-defined (where customers choose the day and time for Azure to perform maintenance) or system-managed maintenance schedule.3 Azure Database for MySQL – Flexible Server is available in 55 Azure regions.4
Deploying Azure Database for MySQL – Flexible Server gives you all the benefits that PaaS solutions in the Azure ecosystem offer—ease of deployment and configuration, on-demand scalability, simplified management and automated maintenance, resiliency and availability, and security. Azure Database for MySQL – Flexible Server also integrates with Azure App Service, Azure Kubernetes Service, and Azure Cognitive Services, which makes deploying and managing databases for cloud-native applications and workloads simple and convenient for developers working in the Azure ecosystem. Using a managed database service allows organizations to focus on development without devoting time to database management and maintenance, backups, manually scaling, or database security. To gain better scalability and performance, GeekWire decided to migrate its WordPress site to the Microsoft Azure platform. By taking advantage of fully managed services like Azure Database for MySQL, the company can scale on-demand while cutting costs 45 percent.5
Similarly, we previously conducted hands-on testing to demonstrate the ease and benefits of migrating an existing MySQL database to Azure Database for MySQL – Flexible Server on an AMD EPYC™ processor-based VM. Read the report at https://facts.pt/WA4Av1Z.
(Note: Azure Database for MySQL – Flexible Server is “a fully managed production-ready database service designed for more granular control and flexibility over database management functions and configuration settings.”6 The offering has supplanted Azure Database for MySQL – Single Server, which Microsoft retired on September 16, 2024. Azure discontinued support for deploying Single Server instances from the Azure portal on January 16, 2023, and Azure CLI on March 19, 2024.7)
You can create an Azure Database for MySQL – Flexible Server instance in one of three service tiers, differentiated by the underlying Azure compute:
Within these service tiers, Azure offers multiple VM options.
Azure VMs come in predefined groupings, or series of configurations. Within each series type, there are generations (e.g., v5, v6), and each VM size within the series has a certain number of virtual CPUs (vCPUs) and amount of virtual RAM. Azure documentation recommends certain families of VMs for specific application use cases. For example, Microsoft recommends E-series and D-series VMs for relational database applications.8 To explore the different VM series types and their common use cases, see https://learn.microsoft.com/azure/virtual-machines/sizes.
When deploying MySQL on Azure, you will determine the appropriate VM series and type for your specific use case. For production workloads, you will most likely select VMs from either the general purpose or memory optimized categories because MySQL will heavily use CPU, RAM, or both. You are unlikely to need high performance computing or GPU instances in a typical MySQL use case.
Table 1 provides detailed information on the three service tiers.
VM type | Number of vCores | Processor OEM | Target workloads | |
Burstable |
Web servers, development build environments, small databases
|
|||
Standard_B*ms | 1, 2, 4, 8, 12, 16, 20 | Intel® | ||
Standard_B*s | 2 | Intel | ||
General Purpose |
Enterprise applications, such as SAP or Microsoft Dynamics, high-traffic web servers, production-sized development environments
|
|||
Standard_D*ads_v5 | 2, 4, 8, 16, 32, 48, 64, 96 | AMD | ||
Standard_D*ds_v4 | 2, 4, 8, 16, 32, 48, 64 | Intel | ||
Business Critical |
Data analytics, large in-memory relational databases, scientific simulations, data warehousing
|
|||
Standard_E*ads_v5 | 2, 4, 8, 16, 20, 32, 48, 64, 96 | AMD | ||
Standard_E*ds_v5 | 2, 4, 8, 16, 20, 32, 48, 64, 96 | Intel | ||
Standard_E*ds_v4 | 2, 4, 8, 16, 20, 32, 48, 64 | Intel | ||
Standard_E*ids_v4 | 80 | Intel |
B-series burstable VMs can be valuable for test or development workloads or use cases where baseline CPU utilization is low overall but may require periods of higher performance based on intermittent demand. In addition, burstable VMs do not offer HA.10 Customers might also use B-series VMs for low-traffic web servers or applications, microservices, or other less critical workloads.
D-series general purpose compute VMs are the standard tier of Azure VMs. Customers might choose them for general production use cases and workloads. Microsoft recommends these VMs for enterprise customers with general purpose workloads that do not require a compute-to-memory ratio higher than 1:4 (for each vCore there is 4GiB memory). Examples of these workloads include e-commerce systems, production websites, hosted services, virtual desktop infrastructure hosting, and small to medium-sized databases.11
E-series business critical VMs “are optimized for in-memory applications”12 and feature a higher than typical ratio of memory to compute power (up to 8GB of memory per vCore, compared to 4GB per vCore in the General Purpose VM service tier).13 The Business Critical tier also offers accelerated logs, where logs reside on higher IOPS disks, at no additional cost.14 Microsoft recommends these VMs for workloads that require in-memory processing such as analytics, high-performance transactional workloads, exceptionally large databases, or business intelligence applications.
The two AMD EPYC™ processor-based VM series available for Azure Database for MySQL – Flexible Servers are the Dadsv5 General Purpose tier VMs and the Eadsv5 memory-optimized Business Critical tier VMs. The Dadsv5 series provides a balanced ratio of compute to memory resources with 4 GiB of memory per virtual core, while the Eadsv5 series VMs feature 8 GiB of memory per vCore in most configurations.15
The Dadsv5 series features scalability up to 96 vCPUs and 384 GiBs of RAM, and use AMD EPYC 7763v processors that "can achieve a boosted maximum frequency of 3.5GHz.”16 For more information on the Dadsv5 VMs, see https://learn.microsoft.com/azure/virtual-machines/dasv5-dadsv5-series. Dadsv6 VMs based on 4th Gen AMD EPYC processors are currently in preview.17
Eadsv5-series VMs feature memory-heavy 8:1 RAM-to-vCPU ratios in most configurations,18 with the smallest Eadsv5 VM having 16 GiBs of RAM with two vCores, and the largest VM configuration having 672 GiBs of RAM with 112 vCores. For more information on the Eadsv5 series, see https://learn.microsoft.com/azure/virtual-machines/easv5-eadsv5-series.
Azure Database for MySQL – Flexible Server instances have several provisioning and configuration options to consider prior to deployment, including service region, availability zone, authentication method, access scope, and HA. In addition to choosing an Azure region for the server, administrators can specify a particular availability zone within that region to collocate the database service with other Azure services or hosted applications that will use it. Customers can provision HA in either zone-redundant or same-zone configurations during the initial server deployment or enabled after the fact in the Azure portal. See the section HA best practices for details.
Azure Database for MySQL – Flexible Server instances support both traditional MySQL authentication via a user-defined administrator username and password and Microsoft Entra authentication for accessing and administering the server. Customers can enable either or both depending on application and security requirements. Administrators can also control network access to the server in many granular ways. They can allow inbound connections from public IP addresses or whitelist specific IP addresses or ranges in the Azure firewall. They can also permit other Azure services to access the resource, or they can restrict access sources to specific private endpoints or Azure virtual networks. All Azure Database for MySQL – Flexible Server deployments support encrypted TLS/SSL connections.
Due to its nature as a PaaS offering, Azure Database for MySQL – Flexible Server does not offer the same level of operating system (OS) control as a self-managed IaaS deployment of MySQL. If the configurable options detailed in this deployment guide are not sufficient for your workload or use case infrastructure requirements, you might find that the higher level of OS control offered by an IaaS deployment works better for your needs, but at the cost of higher manual effort for backup, maintenance, security, scalability, and replication.
Azure Database for MySQL – Flexible Server sets maximum IOPS for each instance type, and the maximums differ for each instance size (visit this page for detailed memory and sizing options):19
Administrators can set a pre-provisioned IOPS level during deployment or opt to let Azure auto-scale IOPS as needed. Administrators specify the initial storage size in GiB during deployment and can enable Azure to scale storage dynamically as needed to prevent interruption of service due to storage capacity. Administrators can also manually scale up the storage capacity at any time but cannot scale storage down after initially provisioning the server.
Administrators choose backup retention periods of 1 to 35 days for daily automated backups and can specify whether backups are locally redundant, zone-redundant (for zone-redundant HA deployments), or geographically redundant in paired Azure regions. Administrators can enable geo-redundancy at any time for locally redundant backups. In addition to daily automated server backup snapshots, Azure backs up transaction logs every five minutes.
Azure Database for MySQL – Flexible Server also allows administrators to initiate on-demand backups manually through the Azure portal. Azure can store up to 50 on-demand backups.20
This section details the process and configuration options for deploying Azure Database for MySQL – Flexible Server via the Azure portal or the Azure CLI and discusses basic methods to connect to the MySQL resource once deployed. Our examples detail a specific configuration we chose for our sample deployment, but we discuss all relevant configuration options in the step-by-step instructions below.
Administrators can also deploy Azure Database for MySQL – Flexible Server directly from the command line using Azure Cloud Shell or Azure CLI. We used Azure Cloud Shell for our sample deployment, but the following steps should work with an authenticated user on Azure CLI version 2.0 or later as well.
az group create --name sampleresourcegroup --location eastus
az mysql flexible-server create --name samplemysqlserver --resource-group sampleresourcegroup
az mysql flexible-server show --resource-group sampleresourcegroup --name samplemysqlserver
az mysql flexible-server connect -n samplemysqlserver -u <username> -p <password>
Azure Database for MySQL – Flexible Server supports provisioning via Azure Resource Manager (ARM) templates. An ARM template is a JSON file that defines the infrastructure and configuration for a deployment, which could consist of multiple databases on a single server or across multiple servers. ARM templates enable customers to automate provisioning and deployment of Azure Database for MySQL – Flexible Server instances with the same configuration options that users can specify when manually deploying instances via the Azure portal.
See the appendix for an example ARM template that you can use to deploy an Azure Database for MySQL – Flexible Server instance based on our sample configuration.
Users can scale up or down Azure Database for MySQL – Flexible Server compute resources by adjusting the VM series type in the Azure portal. Users can also scale up storage, but not scale it down. Changing the VM type will require a server restart. You can follow these steps to scale up an existing Azure Database for MySQL – Flexible Server in the Azure portal:
Users can manage Azure Database for MySQL – Flexible Server primarily using the Azure portal. To manage your server, select your Azure Database for MySQL – Flexible Server instance in the Azure portal and open the Overview panel by clicking the Overview menu. Then if you click Databases, you can click Add to create a new database on the server, which allows you to specify the database name, collation, and character set. You can also click Delete to remove a database from the server.
Administrators can also modify MySQL server parameters by clicking Server parameters in the left-side menu. There you can view all server parameters and modify them where possible. Modifying static parameters will prompt you to restart the server either immediately or later. This management option also allows you to reset all server parameters to default if they are misconfigured. For more detailed information about modifying MySQL server parameters, see https://learn.microsoft.com/azure/mysql/flexible-server/how-to-configure-server-parameters-portal.
The settings section of the menu also allows administrators to configure or enable replication, HA, backup settings, security settings, alerts and monitors, and other basic configuration options after server deployment.
az mysql flexible-server connect -n samplemysqlserver -u <username> -p <password>
az mysql flexible-server db create -d sampledbname --server-name samplemysqlserver --resource-group sampleresourcegroup
az mysql flexible-server connect -n samplemysqlserver -u <username> -p <password> -d sampledbname
az mysql flexible-server connect -n <server-name> -u <username> -p "<password>" -d <database-name> --querytext "<query text>"
For more information about the connect command, see the Azure CLI documentation: https://learn.microsoft.com/azure/mysql/flexible-server/connect-azure-cli.
This section describes how to connect to a newly created Azure Database for MySQL – Flexible Server instance from the official MySQL workbench tool. This example assumes that you have allowed public access. If you have limited access to a private endpoint, then install MySQL workbench on another VM with access to the private virtual network instead of a client device.
For more information about using MySQL Workbench with Azure Database for MySQL – Flexible Server, visit https://learn.microsoft.com/azure/mysql/flexible-server/connect-workbench.
Azure Database for MySQL – Flexible Server provisions physically separated primary and standby replicas in the same availability zone (zonal) or across availability zones (zone-redundant). Both configurations allow automatic failover with zero data loss.
Availability zones are separate data centers within the same region. Each data center has independent power, cooling, and networking. Azure services move to the nearest working availability zone in the event of a failure.
Azure always deploys standby replicas in the same VM configuration, and customers can remove them by disabling HA. Azure performs stop, start, and restart operations on both primary and standby servers at the same time.
Azure applies maintenance activities, such as updates, to the standby server first, and then promotes the standby server to primary while Azure updates the original primary server. This provides continuous uptime.
Zonal redundancy (primary and standby replicas in the same availability zone) provides redundancy with lower latency than the zone-redundant configuration. Zonal redundancy could protect from node-level failures while reducing downtime during planned and unplanned events.
Azure backs up data and logs onto local redundant storage. Admins can choose the region and availability zone for deployment. Zonal redundancy offers an uptime SLA of 99.95 percent.21
Zone redundancy (primary and standby replicas in different zones) provides the highest level of availability at the cost of some latency. The latency will show at the application level but is necessary to keep replicas up to date.22 According to Azure, the latency will not affect read-only queries, but customers can expect a 5 to 10 percent impact for writes and commits.23
Zone redundancy provides complete physical separation between the primary and standby stacks. Azure mirrors data and logs three times onto zone-redundant storage for additional data protection.
Admins can choose the region and availability zones for both primary and standby locations. Zone-redundancy offers an uptime SLA of 99.99 percent.24
Note: The Burstable compute tier does not support HA.
Azure encrypts server, database, and backup data with a service-managed key by default, but customers can choose a user-managed key for encryption instead. Azure Database for MySQL – Flexible Server integrates with Microsoft Entra and Azure Key Vault to create an Azure-wide authentication method. Role-based access and user-managed identities give admins flexibility in managing data access. Customers can use customer-managed or service-managed keys to encrypt their Azure Database for MySQL – Flexible Server instances and backups. Azure stores the customer-managed key in an Azure Key Vault instance, which is highly available and scalable. Customers also have the option to have FIPS 140-validated hardware security modules back Azure Key Vaults. The Azure Key Vault and Azure Database for MySQL service must belong to the same Microsoft Entra tenant.25
Azure Database for MySQL – Flexible Server undergoes regular maintenance to ensure the managed database remains secure, stable, and current. During these maintenance periods, the server receives new features, updates, and patches. The standard maintenance cycle occurs at least every 30 days. Admins have the option to schedule maintenance on a specific day and time window of their choice, or they can allow the system to automatically select a day and time window for you. If you do not specify a preference, the system will choose a time between 11 PM and 7 AM in the server’s regional time zone.26
MySQL authentication is the default method of connecting to Azure Database for MySQL – Flexible Server. However, admins can select Microsoft Entra as an additional or the sole method of connection.27
Admins can restrict network access via allow list (public IPs) or use Azure tools to create a private network for access control.28
At an additional cost, admins can deploy Microsoft Defender for open-source relational databases to help monitor, investigate, and mitigate attacks. Microsoft Defender for open-source relational databases integrates with Microsoft Sentinel. After deploying Defender, the following activities will trigger alerts:
See the full list of alerts at https://learn.microsoft.com/azure/defender-for-cloud/alerts-open-source-relational-databases.
Administrators choose backup retention periods of 1 to 35 days for daily automated backups and can specify whether backups are locally redundant, zone-redundant (for zone-redundant HA deployments), or geographically redundant in paired Azure regions. Users can enable geo-redundancy at any time for locally redundant backups. In addition to daily automated server backup snapshots, Azure takes transaction log backups every five minutes. If a daily backup fails for any reason, Azure retries the backup every 20 minutes until successful.
Azure Database for MySQL – Flexible Server also allows administrators to initiate on-demand backups manually through the Azure portal. Users can request and store up to 50 on-demand backups.29
Azure Monitor monitors Azure Database for MySQL – Flexible Server. All Azure metrics have a one-minute frequency with 30 days of history. Monitor pulls metrics, such as CPU and storage performance data, from Azure and the database. Admins can place metrics on a dashboard with various charts and alerts.30 See the full list of metrics at https://learn.microsoft.com/azure/mysql/flexible-server/concepts-monitoring.
Some Azure Database for MySQL – Flexible Server metrics:
Admins can pull server logs using the Azure portal and CLI. Azure disables this feature by default, but admins can easily enable it in the Azure portal. Monitor retains logs for up to seven days or up to a maximum size of 7 GiB. The 7 GiB storage is free and non-extendable. Azure hashes out personally identifying information from logs, such as hostnames, IP addresses, and usernames. Admins can see this information by enabling audit logs.31
Because Azure Database for MySQL – Flexible Server integrates with Azure Monitor, admins can use Azure workbooks to parse and display metrics. Azure Database for MySQL – Flexible Server comes with three workbook templates: overview, auditing, and query performance. Admins can edit and customize templates as needed.
Admins can enable slow query logging (which Azure disables by default) to help troubleshoot slow queries. Admins can access the log via the Azure portal and CLI. Admins have access to several parameters to help filter the slow query logs:
Azure offers four tiers of support plans. All customers have the basic Request Support tier, which includes access to Azure documentation and community resources, the ability to submit support tickets, access to the Azure Advisor service, and Azure health status notifications.
Azure offers the Developer support tier at $29 per month. Azure intends for the tier to support test and development environments. The tier includes all of the resources in the basic tier with the addition of “third-party software support with interoperability and configuration guidance and troubleshooting” and offers full access to Azure support by email during business hours after customers initiate a support request.32 Azure limits developer support tickets to severity level C (minimal business impact) and have a guaranteed response time of 8 business hours.
Next is the Standard support tier at $100 per month. Azure intends for the tier to support production workloads and applications. It includes all resources and features of the basic and developer tiers with the addition of 24/7 access to technical support by phone or email. The tier also includes ticket creation with severity level B (moderate business impact) and level A (critical business impact) with response times of within 4 hours and 1 hour, respectively.33
Azure offers the Professional Direct support tier for $1,000 per month. Azure intends for the tier to support business-critical workloads and applications. This tier includes all the features of the other tiers but with shorter response times: 4 business hours for severity level C, 2 hours (regardless of business hours) for severity level B, and 1 hour for severity level A. The tier also provides access to a pool of ProDirect delivery managers for architectural and operational support and service review and advisory consultation and guidance.34
For more detailed information about the Azure support plans available, visit https://azure.microsoft.com/support/plans/.
In addition to Azure support, there are several community resources available to supplement the official documentation and support resources and connect users with other Azure administrators and Microsoft engineers:
Documentation and knowledge base
Azure Database for MySQL – Flexible Server has extensive official documentation, tutorials, and quick start guides for various common tasks and use cases:
Whether on site or in the cloud, a MySQL deployment requires careful consideration of several factors, which we list below. Each environment and application is different, so this list is not exhaustive; you should consider your environment’s specifics in your planning.
Storage: Azure offers several varieties of storage, each with a range of capabilities, that administrators can attach to virtual machines. Workloads that create a small-block random input/output (IO) pattern, such as most traditional online transaction processing (OLTP) workloads, may require virtual disks backed by high-speed SSDs that have higher input/output operations per second (IOPS) ratings. On the other hand, if your MySQL data is mostly at rest or does not need significant bursts of random IO, it may be best to consider more cost-effective, lower-IOPS options.
VM selection and configuration: Azure also provides many VM series with a range of specifications and costs. Azure has optimized each series for different use cases and workloads, so you can balance cost and performance according to your needs. You should carefully configure the VM you choose from the perspective of virtual storage and operating system software. Your choice of VM type will dictate most options, such as core count and virtual RAM, but you might consider configuring multiple volumes if you require a high degree of customization. For operating system choices, nearly any Linux distribution will work with MySQL. However, you’ll likely want to use your organization’s standard OS for compliance reasons, and you should check the MySQL release version’s compatibility with the Linux® distribution version you choose at https://www.mysql.com/support/supportedplatforms/database.html.
Database and VM sizing: To select the appropriate Azure VM and disks, you will need some knowledge of your databases’ sizes. You should consider the current sizing of all elements of the MySQL database application, such as tables, indexes, and log files. You should also consider their projected growth over time. We discuss this more in depth later in this document.
MySQL configuration: MySQL is an advanced database management system (DBMS), with many configuration options available that you can modify to affect your application performance, such as cache settings, IO concurrency, logging settings, checkpoint behaviors, and more.
Networking: Azure offers robust networking options. You’ll want to be sure to explore the necessary networking options to set up the virtual networks you need, while controlling access to your MySQL database.
Monitoring and maintenance: While the PaaS offering from Microsoft includes patching and updates, the IaaS MySQL implementations are customer-supported and customer-patched. You should consider the maintenance needs of your MySQL implementation up front. In addition, you must monitor your database application, and Azure offers myriad options to do so. Combining these Azure Monitor tools with traditional MySQL monitoring approaches yields many options for a stronger implementation.
Security: Security is critical in any implementation, but especially in the cloud. In this section, we will review various security best practices for both Azure and MySQL.
Backup and restore: Any database implementation needs a carefully planned backup and restore framework. Later in this document, we discuss how to approach this critical piece of the puzzle in the context of running MySQL on Azure in an IaaS implementation.
There are three recommended AMD processor-based VM types: the Easv6 and Eadsv6 memory-optimized VMs and the Famsv6 compute-optimized VMs. All feature sizeable RAM-to-vCPU ratios, making them excellent candidates for database workloads where you need much of your working dataset cached in database buffers.
The Easv6 series and Eadsv6 series both feature scalability up to 96 vCPUs and 672 GiBs of RAM, and use AMD EPYC™ 9004 processors that "can achieve a boosted maximum frequency of 3.7GHz.”35 The Eadsv6 series VMs also include a local NVMe temp disk for application and system short-term storage, which is helpful for page files, swap files, and SQL tempdb files, among other things. For more information on the Easv6 VMs, see https://learn.microsoft.com/azure/virtual-machines/easv6-eadsv6-series. For more information on the Easdv6 VMs, see https://learn.microsoft.com/en-us/azure/virtual-machines/sizes/memory-optimized/eadsv6-series.
Famsv6 VMs feature full cores (no simultaneous multithreading) and memory-heavy 8:1 RAM-to-vCPU ratios,36 with the smallest Famsv6 VM having 16 GiBs of RAM, and the largest VM having 512 GiBs of RAM. For more information on the Famsv6 series, see https://learn.microsoft.com/azure/virtual-machines/fasv6-falsv6-series.
In addition to Famsv6 VMs, we also recommend Basv2, Falsv6 VMs, Fasv6, and Da-series v6 VMs for very small or non-production databases.
MySQL is compatible with many commonly available operating systems and is likely to run on all the operating systems the Azure catalog offers. MySQL documentation states that MySQL supports operating systems including Oracle Linux, Red Hat® Enterprise Linux®, CentOS, Ubuntu®, SUSE Enterprise Linux, Debian, Microsoft Windows and MacOS®.37 For this guide, we chose Ubuntu as the underlying operating system.
Because persistent and consistent data handling is a cornerstone of a reliable database application, storage design plays a key role in any database deployment. When designing in the context of Azure, you must consider Azure Disk Storage offerings and how to present those to the guest operating system, and thus, the database. In this section, we explore the Azure Disk Storage types and their features.
Azure Disk Storage is a service for managing Azure VMs’ virtualized disk storage. Azure manages the underlying storage hardware, eliminating the need for users to maintain infrastructure. Users can simply choose a size and disk type, provision the disk, and then attach the disk to a VM.
Azure offers five disk storage types: Ultra Disk, Premium SSD v2, Premium SSD, Standard SSD, and Standard HDD. Table 1 shows the specifications for each as well as examples of workloads for which each disk type is suited. Note that while these limits apply specifically to Azure Disk Storage, Azure VMs also have their own unique storage performance limits depending on the VM series, as we discuss below.
Ultra Disk | Premium SSD v2 | Premium SSD | Standard SSD | Standard HDD | |
---|---|---|---|---|---|
Disk type | SSD | SSD | SSD | SSD | HDD |
Scenario | IO-intensive workloads such as SAP HANA, top tier databases (for example, SQL, Oracle), and other transaction-heavy workloads. | Production and performance-sensitive workloads that consistently require low latency and high IOPS and throughput | Production and performance sensitive workloads | Web servers, lightly used enterprise applications and dev/test | Backup, non-critical, infrequent access |
Max disk size | 65,536 GiB | 65,536 GiB | 32,767 GiB | 32,767 GiB | 32,767 GiB |
Max throughput | 10,000 MB/s | 1,200 MB/s | 900 MB/s | 750 MB/s | 500 MB/s |
Max IOPS | 400,000 | 80,000 | 20,000 | 6,000 | 2,000, 3,000* |
Usable as OS Disk? | No | No | Yes | Yes | Yes |
*Applies only to disks with performance plus (preview) enabled. |
These disks come equipped with several benefits and features.
Storage availability and durability: Azure has designed managed disks for at least 5 nines (99.99999 percent) of availability via high levels of durability and redundancy.38 Azure achieves this redundancy by creating three replicas of your data, meaning that even in the event of one or two replicas failing, the remaining replicas can protect against data loss. In addition, locally redundant storage (LRS) disks provide at least 11 nines (99.99999999999 percent) of durability each year, and zone redundant storage (ZRS) disks provide at least 12 nines (99.999999999999 percent) of durability each year. Azure Disk Storage is integrated with both availability sets and availability zone features provided by Azure, providing further protection for user data. Availability set integration ensures that disks associated with VMs in an availability set are isolated from each other by placing the disks in different storage scale units known as stamps, thereby avoiding a single point of failure. Similarly, availability zone integration protects against a single point of failure by giving users the ability to place disks in data centers in separate physical locations.39
Storage scalability and using multiple volumes: Users can create up to 50,000 VM disks of a particular type per region in a subscription. Disks can range in capacity from 4 GiB to 64 TB, providing performance specs of anywhere from 120 to 400,000 IOPS and 25 MB/s to 10,000 MB/s of throughput, allowing you to customize the performance profile of your storage based on your needs.
For the data drive, consider using Premium SSD v2 disks which provide additional features, high IOPS, and high throughput for a competitive price. For the log drive, plan for capacity projections. On all disk types, you should thoroughly test performance and evaluate costs. In general, the Premium SSD v2 disks or the Premium P30-P80 disks are good choices for high IOPS. If you require extremely low latency, also consider evaluating Azure Ultra Disks. Note that Azure offers Premium SSD v2 disks in certain regions only.
Backup support for disks: Managed disks include support for Azure Backup, a service that can create a backup job with scheduled backups and customizable retention policies. Additionally, Azure Backup includes Azure Disk Backup, a native solution that automates periodic creation of point-in-time snapshots for managed disks and retention of said backups based on user-defined policy. It supports backups for both OS and data disks, regardless of whether they are currently attached to a running Azure VM.40 It is an agentless solution, meaning that the snapshot process does not affect application performance.
Snapshots and images: You can take a snapshot of your managed disks, creating a read-only full copy of the disk that exists independently of the source disk. You can use these to create new disks and to take a backup of a disk at any time. Azure takes snapshots from a single disk and stores them as standard managed disks by default. Azure incremental disk snapshots are a cost-effective way to create point-in-time backups of your Azure managed disks. Unlike full disk snapshots, which capture full disk data, incremental snapshots capture only the changes to disks since the last snapshot. This results in lower storage costs and faster snapshot creation times.41
Azure Disk Storage also supports the creation of custom images from either a user-managed VHD in a storage account or directly from a generalized VM. The capture process includes all managed disks attached to a VM, creating a single image. You can use these images to clone VMs that you have configured beyond the standard OS images provided by Azure.
Azure Elastic SAN is a service Azure provides that allows you to create and provision a cloud-based SAN interoperable with Azure VMs, as well as other Azure offerings such as Azure Kubernetes Service and Azure VMware Solutions.42 Azure Elastic SAN is not limited to working with one particular type of storage-consuming host or service. Additionally, you can provision volumes from a single SAN to use across multiple different Azure offerings. Azure simplifies the process of creating the SAN by handling the deployment, management, and initial configuration.
Elastic SANs can provide up to millions of IOPS with double-digit GiB/s of throughput and single-digit-millisecond latencies.43 Its benefit in a MySQL use case would be if you had to store and centrally manage many terabytes of database data across multiple MySQL instances. However, storage latencies on Elastic SAN would likely be higher than those of Premium SSD v2 instances or Azure Ultra Disks.
The individual volumes that you provision from the SAN share the SAN’s performance values, up to a limit of 80,000 IOPS per volume. Individual volumes can have high IOPS and throughput, but the total IOPS and throughput of all your volumes can’t exceed the total IOPS and throughput your SAN has. In addition to these performance benefits, Azure Elastic SAN brings a centralized approach to management and volume creation and maintenance, like in more traditional on-premises storage array approaches. You should consider Azure Elastic SAN as your storage solution when you need highly scalable storage with centralized management for large-scale applications or when your workloads require low latency, high IOPS, and high throughput across multiple volumes.44
Because you can connect Azure Elastic SAN with your Azure Virtual Machines, you could choose to back your MySQL databases with Azure Elastic SAN storage if your organization requires that approach.
Deploying MySQL on an Azure VM involves creating the necessary VMs and configuring Azure specifics—such as selecting subscriptions, regions, and disks—and then accessing the VM’s operating system and performing the necessary MySQL installation steps.
To demonstrate this, we used Ubuntu version 24.04 and a standard E2ads_v6 VM. We created an Ubuntu virtual machine by logging into the Azure Portal, navigating to the Virtual Machines service, and clicking Add. We set the Azure options and chose our OS image, Ubuntu 24.04 LTS. Next, we configured access essentials such as generating a new key pair and opening port 22. Finally, we configured disk and networking options, reviewed our VM, and clicked Create.
For step-by-step instructions, see below.
After Azure has successfully deployed the VM, you can check its status in the Azure portal (see Figure 7).
In this section, we present the steps to install MySQL on the VM. Note: Consider using Ubuntu Pro (https://ubuntu.com/pro), which includes Expanded Security Maintenance (ESM), security updates, and other tools.
sudo apt update
sudo apt install mysql-server-8.0sudo systemctl start mysql.service
sudo mysql mysql> ALTER USER ‘root’@’localhost’ IDENTIFIED WITH mysql_native_password BY ‘<password>’;mysql> exit
sudo mysql_secure_installation
sudo -u root -p
VM sizing for MySQL involves optimizing Azure resources such as vCPUs, memory, and storage to improve database performance, scalability, and reliability. Below, we look at some key components in a VM and how they could impact performance.
MySQL can benefit from multi-vCPU VMs on Azure for parallel query processing. You need to monitor CPU usage closely to make sure your MySQL server works efficiently for complex operations such as joins, sorting, aggregation, etc. You can use the built-in tools such as PERFORMANCE_SCHEMA to monitor CPU usage and troubleshoot time-consuming queries. Additionally, you can use native Linux tools such as top, iostat, and nmon to monitor your server’s CPU usage as well.
Memory is crucial for databases to function properly. During a typical database query, if the data is not already in memory, the database retrieves it from disk and then temporarily stores it in memory. Then, the database takes further query actions, such as any aggregation, grouping, and sorting. This makes it important that your VM has enough memory.
MySQL implements various cache mechanisms such as the query cache,45 InnoDB buffer pool, and key cache46 to store frequently accessed data in memory and minimize disk I/O latency. Additionally, MySQL benefits from Linux OS filesystem caching, even though it does not directly manage these caches. It is important to tune both MySQL and the Linux OS caches to maximize the advantages of caching and optimize the use of system resources.
Choose storage that meets the performance requirements of your application. Organizations should first measure the application demands, then use those IOPS measurements and projections to size and select Azure disks. Based on those projections, customers can choose both the disk layout (i.e., using multiple disks), and the disk model. A good starting point can be to use Premium SSD v2 due to its flexibility with adjusting IO performance. If you do select Premium SSD (non v2), then you could consider striping multiple less expensive disks if you require more IOPS than a single larger more expensive disk could deliver.
When choosing Azure Disk Storage for your high-performance applications, it is important to consider the disk’s IOPS, throughput, and latency characteristics to ensure they meet your application’s needs. OLTP applications need to process many concurrent user requests immediately. These requests are typically small and random IO operations that require very high disk IOPS. On the other hand, OLAP or data warehouse applications need to scan and read large volumes of data. These operations are generally large and sequential IO tasks that require high disk throughput.47
You can also consider configuring multiple disks into a RAID group to combine their IOPS, throughput, and storage capacity to deliver even higher performance for your applications. On Linux, you can use the MDADM utility to stripe disks together and create a software RAID.48
Choose an appropriate file system type (e.g., ext4 or XFS) and mount option (e.g., noatime, nobarrier, or nodiratime) for MySQL data directories to optimize disk IO performance and reduce file system overhead. Consider using separate file systems or mount points for MySQL data, binary logs, redo logs and other general logs49 to minimize contention and improve IO throughput (see the “Configuring multiple volumes” section below).
Historically, in specific cases, database architects and storage architects have recommended configuring multiple volumes with multiple underlying disks for database applications. This is not always necessary, and you should evaluate your situation as to whether this approach would provide performance or reliability advantages.
Examples of when to do this may include:
Adjust kernel parameters (sysctl settings) related to memory management, networking, disk IO, and process scheduling to optimize system performance for MySQL. Common kernel parameters to tune include vm.swappiness, vm.dirty_ratio, vm.dirty_background_ratio, fs.file-max, net.core.somaxconn, and kernel.shmmax. You can also consider various Linux filesystems, I/O schedulers, and NUMA settings. For a detailed explanation, please refer to https://www.percona.com/blog/linux-os-tuning-for-mysql-database-performance/.
MySQL has many parameters to optimize its performance. For an exhaustive list of all server parameters please visit https://dev.mysql.com/doc/refman/8.0/en/optimization.html. We discuss some important ones in this section.
Parameter | Description |
---|---|
max_connections | Sets the maximum number of concurrent connections to the MySQL server. Setting an appropriate max_connections value based on your application’s requirements and server resources aims to prevent resource contention at connection. |
InnoDB is the default storage engine in MySQL. It aims to provide high performance, reliability, and concurrency for transactional workloads. Below are several key parameters for improving performance:
Parameter | Description |
---|---|
innodb_buffer_pool_size | Defines the size of InnoDB buffer pool, which caches frequently accessed data and indexes. Increasing this parameter can improve read performance by caching more data in the memory and reducing disk read latency for frequently accessed data. |
innodb_log_file_size | Sets the size of InnoDB log files, which log all database changes. Adjusting innodb_log_file_size can impact write performance. |
innodb_io_capacity | Specifies the IOPS capacity for InnoDB background tasks such as flushing and checkpointing. You can adjust innodb_io_capacity to optimize I/O performance based on your underlying storage solutions. |
innodb_flush method | Defines the method used to flush in-memory data to Innodb data files. This parameter can affect your I/O throughput. You can choose the appropriate flush method to enhance performance based on your operating systems and storage configurations. |
innodb_use_native_aio | Controls whether InnoDB uses native asynchronous I/O. On Linux systems that support native asynchronous I/O, enabling this parameter can lead to better I/O performance for InnoDB. |
innodb_read_ahead_threshold | Defines the number of sequential pages that InnoDB uses to prefetch to the buffer. This parameter can help improve performance for workloads with more sequential access patterns |
innodb_random_read_ahead | Determines whether random read ahead is enabled. This parameter can help improve performance for workloads that involve more random reads. |
As your business grows and you begin to see workloads increase and your resource utilizations approaching their limits, you might want to consider scaling up your MySQL VM to increase resources such as CPU, memory, and storage to handle more work.51 You can change your VM size by using either the Azure Portal or Azure CLI. Scaling up will require you to first shut down the VM, which causes downtime. You should plan accordingly to minimize the impact of server outage. Scaling up to larger VM sizes will also incur higher costs. Please visit the Azure Linux Virtual Machines pricing calculator at https://azure.microsoft.com/pricing/details/virtual-machines/linux/ and make sure you understand the cost implications.
Another option to accommodate increased workloads is to scale out your MySQL VM. You can use Azure Virtual Machine Scale Sets (VMSS) to deploy and manage a set of identical and auto-scaling VMs. VMSS can automatically adjust the number of VMs in the scale set based on a predefined rule by scaling out VMs when workload increases and scaling in VMs when workload decreases. You can create VMSS from the Azure Portal or using Azure CLI. You can set the maximum and minimum instance count and scaling rules based on CPU, memory, or disk usage.52 For example, you can add rules to automatically spin up a new VM in the scale set when your CPU usage exceeds a certain threshold. The ideal use case for this would be if you needed separate, smaller, isolated MySQL instances.
Azure offers a variety of HA solutions to protect your applications and data from data center outages and maintenance events.53
As we note in the Azure disk storage features section, Azure managed disks are replicated three times and offer 3 nines of availability (99.999 percent) and 11 nines of durability (99.999999999 percent).54 Because MySQL is an application that would typically run on a single VM, using the Ultra Disks, Premium SSD v2, or Premium SSD offerings from Azure would work well these types are all managed.55
Availability zones are physically separate locations within an Azure region. Each zone has its own power, cooling, and networking. Deploying your MySQL VMs across multiple availability zones can enhance resiliency against data center failures.56 If one zone is compromised, your replicated apps and data are still available in another zone. Availability zones offer uptime percentages with Azure SLA of 99.99 percent.57
Azure has designed scale sets to support large-scale services that require HA, auto-scaling, and easy management of a group of VMs. You can deploy virtual machines in a VMSS into multiple availability zones or fault domains. If one of these VM instances has a problem, customers can continue to access your MySQL application through one of the other VM instances with minimal interruption.58
You can deploy your MySQL VMs on Availability sets, which distribute VMs across multiple fault and update domains. An update domain is a group of VMs and underlying physical hardware that you can update or reboot at the same time. A fault domain is a group of VMs that share common power source and network switch. By spreading VMs across multiple fault and update domains, Azure ensures that your application remains available even if one domain is being updated or failed. Availability sets meet the 99.95% Azure SLA.59
Microsoft recommends that users who are not already using Availability sets for their HA strategy deploy MySQL VMs across availability zones using VMSS flexible orchestration mode. They recommend this approach because VMSS flexible orchestration mode offers higher Azure SLA, larger VM scale, and enhanced VM management capabilities.60
MySQL provides many features that help customers build applications, efficiently manage data, protect data integrity, and provide fault-tolerant and HA environments.
In this section, we focus on some key concepts and methods related to MySQL HA and replication. For a full list of MySQL features, please visit https://dev.mysql.com/doc/refman/8.3/en/.
MySQL HA ensures a MySQL database system always remains accessible and operational even in the event of failures or disruptions. Key components of MySQL HA include replication, clustering, failover mechanisms and load balancing. Failover occurs when the primary (source) server becomes unavailable due to network issues, hardware failures, software crashes, or planned maintenance, and a standby server (replica) takes over as the new primary server. MySQL HA solutions such as MySQL Group Replication and MySQL InnoDB Cluster provide automated failover mechanisms, built-in monitoring, and management tools to facilitate seamless failover operations and maintain continuous database availability in production environments.61
MySQL supports copying data from the source database server to one or more replica servers. Organizations commonly use replication for data redundancy, scalability, HA, and enhanced performance. MySQL replication supports different types of synchronization. By default, replication is asynchronous, meaning that the source server does not wait for the confirmation from the replica servers. In a MySQL group replication cluster or a MySQL Network Database (NDB) cluster, replication is synchronous, ensuring that transactions are received on all nodes before acknowledging to the client.62 MySQL now also supports delayed synchronization where a replica deliberately lags behind the source by at least a specified amount of time. Delayed synchronization can be useful to protect against user mistakes on the source and test how the system behaves when there is a lag caused by heavy load on the replica.63
There are two primary types of replication formats in MySQL: statement-based replication (SBR) and row-based replication (RBR). SBR replicates complete SQL statements from the source to the replica, and RBR replicates only the modified rows. Additionally, MySQL allows you to configure a hybrid approach that combines both statement-based and row-based replication methods, choosing the most suitable method based on the nature of the changes to be replicated.64
When you deploy your MySQL server on Azure IaaS, you can leverage numerous security features that both Azure and MySQL provide to help protect your data, applications, and infrastructure.
Azure confidential computing is a set of technologies and features in Azure that work to protect data at rest and in transit. These technologies include a number of different Azure offerings, including confidential VMs such as ECadsv5/ECasv5 powered by AMD EPYC™ CPUs. Microsoft lists the following features of confidential VMs:65
Azure Key Vault is a cloud-based service Azure provides that allows you to securely store and manage confidential information such as keys, secrets, and certificates. Azure stores the information in a secure and centralized vault and protects it from unauthorized access. Azure Key Vaults can be either software-protected or hardware-protected by HSMs. Microsoft documentation states that ”software-protected keys, secrets, and certificates are safeguarded by Azure, using industry-standard algorithms and key lengths. For situations where you require added assurance, you can import or generate keys in HSMs that never leave the HSM boundary.”68 When deploying a MySQL server in Azure, you can store your sensitive information, such as your passwords, certificates, and database connection strings, in a secure Azure key vault to enhance security for your database server and applications.
Azure provides two important security features for its managed disks: encryption and Private Links. Two different types of encryption are available: server-side encryption and Azure Disk Encryption. Server-side encryption, which Azure enables by default for all managed disks and their associated snapshots and images, provides encryption at rest. The encrypting keys can be managed either by Azure (platform-managed keys) or by the user (customer-managed keys). Azure Disk Encryption uses OS-level features to encrypt OS and data disks used by Azure VMs, such as BitLocker for Windows-based VMs69 or DM-Crypt for Linux-based VMs.70 The process integrates with Azure Key Vault, allowing users to manage the disk encryption keys and secrets.
Private Links let you import or export a managed disk within a secure Azure virtual network without exposing traffic to the public internet. This service allows users to generate a time-bound Shared Access Signature (SAS) uniform resource identifier (URI) for managed disks that enables them to export the disk data to other regions.
Azure Virtual Network (vNET) allows you to create private, isolated, and secure network environments in the Azure cloud. Each vNET is logically isolated from other vNETs. You can define IP address ranges, subnets, and network security groups (NSGs) to control traffic flow and enforce security policies between your MySQL server VMs and applications within vNETs. To connect with other vNETs, Virtual Network Peering establishes peering connections between vNETs to enable seamless communication and resource sharing. To provide outbound internet connectivity, the Azure Network Address Translation (NAT) gateway can route VM traffic to the internet while keeping VMs and compute resources private. If you are deploying a containerized MySQL environment, vNET provides a container network interface (CNI) plugin to enable communication and connectivity for your containers within your Azure Kubernetes Service cluster.71
“A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.”72 It is crucial to implement proactive security measures to protect against and mitigate the impact of DDoS attacks. Azure DDoS Protection automatically detects and mitigates even the most complex DDoS attacks against Azure resources, including virtual networks, public IP addresses, and Azure Load Balancers. It provides always-on monitoring and automatic mitigation capabilities to defend against both the network layer and the application layer attacks.73
Azure Firewall allows you to define network security policies and rules to control inbound and outbound traffic for your Azure virtual network resources, based on IP addresses, ports, protocols, etc. You can create allow/deny rules, application rules, network rules, and NAT rules. Azure Firewall integrates with Azure Monitor for viewing and analyzing firewall logs.74
Azure Load Balancer distributes inbound network traffic across backend pool VMs such as VMs and VM scale sets, based on configured load-balancing rules and health probes. It helps evenly distribute network workload, prevent bottlenecks, and optimize network resource utilizations. Azure Load Balancing supports both public load balancing and internal load balancing. A public load balancer can provide a public IP address for virtual machines inside your vNET. Public load balancers load balance internet traffic to your VMs. An internal or private load balancer handles traffic inside a virtual network or across vNET peering connections.75
MySQL RBAC allows you to define and manage user access permissions based on roles. Roles are sets of privileges that admins can grant to users or other roles. Permissions are sets of operations (e.g., SELECT, INSERT, UPDATE, DELETE, CREATE, and DROP) that a role can perform on database objects. Admins can grant privileges to roles and revoke them. They can grant roles to a user account, which gives to the account the privileges associated with each role. With RBAC, you can implement fine-grained access controls, manage permissions through roles, and enhance the security and integrity of your MySQL databases.76
MySQL supports several authentication methods to verify user credentials and grant access to databases. By default, MySQL uses the mysql_native_password method, which hashes user passwords and stores them in the mysql.user table in the MySQL system database. sha256_password and auth_socket are more secure methods: sha256_password hashes passwords using the SHA-256 algorithm, and auth_socket plugin allows users to authenticate with MySQL server using the operating system’s credentials.77
Additionally, MySQL Enterprise Edition supports more authentication capabilities through LDAP, and pluggable authentication module (PAM), and Kerberos plugins. With LDAP authentication, MySQL stores user credentials in an LDAP directory, and validates these credentials against the LDAP server.78 In PAM authentication, MySQL delegates the authentication process to an external PAM unit that uses various methods supported by PAM.79 The Kerberos plugin enables users to authenticate to the MySQL server using Kerberos tickets.80
The MySQL Keyring component and plugin provide secure storage and management of sensitive data. Keyring enhances security by protecting these sensitive items from unauthorized access and provides a centralized mechanism for managing encryption keys and credentials. Keyring component can store keys in either a regular file locally on the host (component_keyring_file), in an encrypted and password-protected file on the host (component_keyring_encrypted_file), or even inside a vault in cloud (component_keyring_oci). Similarly, the keyring plugin stores keys in either a local file or an encrypted local file. The keyring service routines are a set of loadable functions that developers can call at both the SQL level and C language level.
MySQL supports Secure Sockets Layer (SSL) and Transport Layer Security (TLS) encryption between clients and servers. SSL/TLS encryption secures client-server communication and protects data in transit. SSL connections encrypt all data that travel across the network, including passwords, queries, and returned data. You can configure MySQL server to use SSL/TLS by specifying the paths to the SSL certificate, key, and CA certificate in the MySQL server configuration file my.cnf.81
MySQL InnoDB storage engine provides data-at-rest encryption and ensures that data stored on disk is encrypted and protected from unauthorized access. You can encrypt individual tables or tablespaces to make sure that data stored in the encrypted tables is protected. MySQL leverages keyring plugins to manage encryption keys securely. These keyring plugins store encryption keys local to the database server but outside the database to enhance security.82
MySQL uses TCP/IP as the default communication protocol for client-server connections. The MySQL server listens for incoming TCP/IP connections on a specified port (default is 3306) and IP address.83 The /etc/mysql/mysql.conf.d/mysqld.cnf file contains TCP/IP-related settings, including the listening address, port number, and socket.
A best practice is to deploy a firewall on the MySQL database VM. Linux distributions offer built-in firewalls such as ufw, firewalld, and iptables. A firewall enables you to set rules that govern allowed inbound and outbound traffic. You can define these rules based on parameters such as the local port (default is 3306 for MySQL), protocol (IPv6 or TCP), and source address (often a list of subnets or specific addresses). Strictly controlling external access to the server is crucial for maintaining the security of your database.
Users can utilize network segmentation to separate MySQL servers from other network traffic and restrict access to authorized users and applications. Within Azure, you can leverage Azure Virtual Network to create a private network specifically for your MySQL server and associated applications.
There are several options for backing up your MySQL VM on Azure. You can back it up at Azure level or use MySQL utilities to back up the database natively.
When setting up an Azure VM for backup, a background backup process initiates based on your backup schedule.84 To perform application or file system backups, you need to install a backup extension within the VM. The backup process starts by taking a snapshot of your VM and then transferring it to the vault. The first backup is a full backup, meaning Azure transfers all data blocks to the vault. In subsequent backups, Azure backs up only changed blocks.
Azure also supports encrypted VM backups using Storage Service Encryption (SSE) or Azure Disk Encryption. With SSE, Azure Storage automatically encrypts data at rest before storing it. Azure decrypts data during restore. Azure Disk Encryption encrypts both OS and data disks using either BitLocker encryption keys (BEKs) or Azure Key Vault key encryption (KEKs). Azure securely backs up both BEKs and KEKs and encrypts them within a key vault.85
MySQL supports both physical and logical backups.
For physical backups, users can make raw copies of the database directories and files, using tools such as xtrabackup, mysqlbackup or Linux filesystem commands (tar, rsync, cp, etc.). Physical backups can be done when MySQL server is shut down. If the server is running, it is necessary to lock the server so that the database contents don’t change during the backup (though third-party tools such as Percona Xtrabackup mitigate this challenge). Physical backups are typically faster than logical backups because they involve only copying files without conversion. To restore, you can copy file copies at the file system level back to their original locations with the same filesystem commands (tar, rsync and cp).86
To perform logical backups, you query the MySQL server for information about the database structure and content. Logical backups do not include log or configuration files or other related files if they are not part of the databases. You can perform logical backups using mysqldump while the MySQL server is running. To restore logical backups, you can use mysql client to process SQL-format files, or use the ‘LOAD DATA’ statement to process delimited-text files.87
MySQL supports both full and incremental backups. A full backup is a copy of all database contents at a given point in time. You can take full backups using either physical or logical backup methods as we describe above. An incremental backup consists of changes made to the database during a given period. To do incremental backups, you must enable the server’s binary log, which records all the changes the server made to the database.88
Full and incremental (a.k.a. point-in-time) recovery
A full recovery restores the database instance to the state when the backup occurred. An incremental recovery restores all the changes after the full backup took place. MySQL supports point-in-time recovery by replaying the binary logs since a full backup.89
You should ensure that your backup method of choice secures the data contained within it by way of encryption to protect against unauthorized access.
MySQL Enterprise Backup (mysqlbackup) supports encryption for backups. It uses a symmetric encryption algorithm, Advanced Encryption Standard (AES) 256, to encrypt user data with a key string provided by the user. You can manually create the key string or randomly generate it using tools such as OpenSSL.90
For example, to generate a random string using openssl:
Openssl rand -hex 32
To encrypt a backup using mysqlbackup and the random key:
mysqlbackup --backup-file=/path/to/backup-file \--encrypt=AES-256 \--encrypt-key=your_encryption_key \
To restore an encrypted backup, you must provide the same key string to mysqlbackup:
mysqlbackup --backup-file=/path/to/backup-file \--decrypt=AES-256 \--decrypt-key=your_encryption_key \restore
Monitoring any application is a key component of your organization’s planning and strategy. In the context of deploying MySQL to Microsoft Azure, you can use a variety of monitoring tools and techniques across cloud, OS, and database layers to optimize your configuration.
Azure Monitor is a cloud monitoring solution offered by Microsoft that collects telemetry data from multiple types of resources and gives the user the ability to analyze, extract, and use the data in various ways, including alerting.
According to Microsoft, “Azure Monitor can monitor these types of resources in Azure, other clouds, or on-premises:
Azure Monitor uses a variety of techniques to collect data, including logs and metrics collection, agent-based collection, and third-party sources.
Azure Virtual Machines offers telemetry for CPU utilization, logical disk IOPS, and available memory when you enable Azure Virtual Machine Insights. For additional metrics, you can install the Microsoft Azure Monitor agent. For more details on agent installation, see https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-cli#install.
MySQL provides several built-in monitoring tools that allow you to monitor performance, resource utilization, query execution, and server health. Here are some of the built-in monitoring tools in MySQL:
In addition to MySQL built-in tools and plugins, you can leverage Linux utilities such as top, mpstat, iostat, nmon, etc., to monitor various aspects like CPU usage, memory utilization, disk I/O, and network traffic on your MySQL server VMs.
Percona MySQL is a distribution of the MySQL database.94 It is based on the open-source MySQL database and includes additional features, optimizations, and tools to enhance performance, scalability, and manageability for MySQL deployments. Percona MySQL includes tools such as the following:
For a complete list of features and tools Percona offers, please visit https://docs.percona.com/percona-for-mysql.
Charmed MySQL is an enterprise-grade solution to secure and automate the deployment, maintenance, and upgrades of your MySQL databases. You can deploy it on Azure VMs and AKS.
Charmed MySQL automation is based on a curated list of open-source components including:
Canonical also offers managed MySQL services and consulting for tailored solutions, including deployment, optimization, support, and training. For more information, please visit Canonical’s MySQL page.104
Choosing the right deployment model for MySQL on Azure depends on your organization’s specific needs for control, flexibility, and management. Azure Database for MySQL – Flexible Server offers a fully managed PaaS platform that can simplify operations. The PaaS solutions could be ideal for applications requiring rapid deployment and scaling, minimal administrative overhead, and seamless scalability. Conversely, deploying MySQL on Azure IaaS provides greater control over the infrastructure. This approach offers flexibility to configure the operating system, storage, and networking according to customer needs and could be ideal for legacy applications, complex regulatory environments, or scenarios requiring higher customization. This guide presented how to use both Azure approaches as well as several recommendations on AMD EPYC™ CPU-based infrastructure to consider. Whether you want the simplicity of PaaS or maximum control with IaaS, Azure provides the tools and means to deploy MySQL databases effectively in the cloud.
To view the formatted sample ARM template, download the PDF at the bottom of this page.
{ "$schema": "https://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "apiVersion": { "type": "string", "defaultValue": "2021-05-01" }, "administratorLogin": { "type": "string" }, "administratorLoginPassword": { "type": "securestring" }, "location": { "type": "string" }, "serverName": { "type": "string" }, "serverEdition": { "type": "string" }, "vCores": { "type": "int", "defaultValue": 4 }, "storageSizeGB": { "type": "int" }, "haEnabled": { "type": "string", "defaultValue": "Disabled" }, "availabilityZone": { "type": "string", "defaultValue": "" }, "standbyAvailabilityZone": { "type": "string" }, "version": { "type": "string" }, "tags": { "type": "object", "defaultValue": {} }, "firewallRules": { "type": "object", "defaultValue": {} }, "backupRetentionDays": { "type": "int" }, "geoRedundantBackup": { "type": "string" }, "vmName": { "type": "string", "defaultValue": "Standard_B1ms" },
"storageIops": { "type": "int" }, "storageAutogrow": { "type": "string", "defaultValue": "Enabled" }, "autoIoScaling": { "type": "string", "defaultValue": "Disabled" }, "identityData": { "type": "object", "defaultValue": {} }, "dataEncryptionData": { "type": "object", "defaultValue": {} }, "serverParameters": { "type": "array", "defaultValue": [] }, "aadEnabled": { "type": "bool", "defaultValue": false }, "aadData": { "type": "object", "defaultValue": {} }, "guid": { "type": "string", "defaultValue": "[newGuid()]" }, "network": { "type": "object", "defaultValue": {} }, "firewallRulesAPIVersion": { "type": "string", "defaultValue": "2022-01-01" }, "acceleratedLogs": { "type": "string", "defaultValue": "Disabled" } }, "variables": { "api": "[parameters('apiVersion')]", "firewallRules": "[parameters('firewallRules').rules]", "serverParameters": "[parameters('serverParameters')]" }, "resources": [ { "apiVersion": "[variables('api')]", "location": "[parameters('location')]", "name": "[parameters('serverName')]", "identity": "[if(empty(parameters('identityData')), json('null'), parameters('identityData'))]", "properties": { "createMode": "Default", "version": "[parameters('version')]", "administratorLogin": "[parameters('administratorLogin')]", "administratorLoginPassword": "[parameters('administratorLoginPassword')]", "Network": "[if(empty(parameters('network')), json('null'), parameters('network'))]", "Storage": { "StorageSizeGB": "[parameters('storageSizeGB')]", "Iops": "[parameters('storageIops')]", "Autogrow": "[parameters('storageAutogrow')]", "AutoIoScaling": "[parameters('autoIoScaling')]", "LogOnDisk": "[parameters('acceleratedLogs')]"
}, "Backup": { "backupRetentionDays": "[parameters('backupRetentionDays')]", "geoRedundantBackup": "[parameters('geoRedundantBackup')]" }, "availabilityZone": "[parameters('availabilityZone')]", "highAvailability": { "mode": "[parameters('haEnabled')]", "standbyAvailabilityZone": "[parameters('standbyAvailabilityZone')]" }, "dataencryption": "[if(empty(parameters('dataEncryptionData')), json('null'), parameters('dataEncryptionData'))]" }, "sku": { "name": "[parameters('vmName')]", "tier": "[parameters('serverEdition')]", "capacity": "[parameters('vCores')]" }, "tags": "[parameters('tags')]", "type": "Microsoft.DBforMySQL/flexibleServers" }, { "condition": "[greater(length(variables('firewallRules')), 0)]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('firewallRules-', parameters('guid'), '-', copyIndex())]", "copy": { "count": "[if(greater(length(variables('firewallRules')), 0), length(variables('firewallRules')), 1)]", "mode": "Serial", "name": "firewallRulesIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/firewallRules", "name": "[concat(parameters('serverName'),'/',variables('firewallRules')[copyIndex()].name)]", "apiVersion": "[parameters('firewallRulesAPIVersion')]", "properties": { "StartIpAddress": "[variables('firewallRules')[copyIndex()].startIPAddress]", "EndIpAddress": "[variables('firewallRules')[copyIndex()].endIPAddress]" } } ] } } }, { "condition": "[parameters('aadEnabled')]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "name": "[concat('addAdmins-', parameters('guid'))]", "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]" ], "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0",
"resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/administrators", "name": "[concat(parameters('serverName'),'/ActiveDirectory')]", "apiVersion": "[variables('api')]", "properties": { "administratorType": "[parameters('aadData').administratorType]", "identityResourceId": "[parameters('aadData').identityResourceId]", "login": "[parameters('aadData').login]", "sid": "[parameters('aadData').sid]", "tenantId": "[parameters('aadData').tenantId]" } } ] } } }, { "condition": "[and(greater(length(variables('serverParameters')), 0), parameters('aadEnabled'))]", "type": "Microsoft.Resources/deployments", "apiVersion": "2019-08-01", "copy": { "count": "[if(greater(length(variables('serverParameters')), 0), length(variables('serverParameters')), 1)]", "mode": "serial", "name": "serverParametersIterator" }, "dependsOn": [ "[concat('Microsoft.DBforMySQL/flexibleServers/', parameters('serverName'))]", "[concat('Microsoft.Resources/deployments/addAdmins-', parameters('guid'))]" ], "name": "[concat('serverParameters-', copyIndex(), '-', parameters('guid'))]", "properties": { "mode": "Incremental", "template": { "$schema": "https://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "resources": [ { "type": "Microsoft.DBforMySQL/flexibleServers/configurations", "name": "[concat(parameters('serverName'),'/',variables('serverParameters')[copyIndex()].name)]", "apiVersion": "[variables('api')]", "properties": { "value": "[variables('serverParameters')[copyIndex()].value]", "source": "[variables('serverParameters')[copyIndex()].source]" } } ] } } } ]}
{ "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#", "contentVersion": "1.0.0.0", "parameters": { "serverName": { "value": "pt-admysql-sample-deployment" }, "location": { "value": "eastus" }, "serverEdition": { "value": "GeneralPurpose" }, "vCores": { "value": 16 }, "storageSizeGB": { "value": 64 }, "haEnabled": { "value": "ZoneRedundant" }, "firewallRules": { "value": { "rules": [ { "name": "AllowAllAzureServicesAndResourcesWithinAzureIps_2024-10-8_12-45-23", "endIPAddress": "0.0.0.0", "startIPAddress": "0.0.0.0" }, { "name": "office-access", "startIPAddress": "48.96.71.70", "endIPAddress": "48.96.71.70" } ] } }, "backupRetentionDays": { "value": 14 }, "geoRedundantBackup": { "value": "Enabled" }, "availabilityZone": { "value": "" }, "vmName": { "value": "Standard_D16ads_v5" }, "storageIops": { "value": 0 }, "storageAutogrow": { "value": "Enabled" }, "acceleratedLogs": { "value": "Disabled" }, "standbyAvailabilityZone": { "value": "" }, "autoIoScaling": { "value": "Enabled" }, "guid": { "value": "1a0469e4b2af466e9825660da4b45b7c" }, "serverParameters": { "value": []
}, "apiVersion": { "value": "2023-06-01-preview" }, "network": { "value": { "publicNetworkAccess": "Enabled" } }, "tags": { "value": {} }, "administratorLogin": { "value": "ptadmin" }, "administratorLoginPassword": { "value": null }, "version": { "value": "8.0.21" } }}
This project was commissioned by Microsoft and AMD.
November 2024
Principled Technologies is a registered trademark of Principled Technologies, Inc.
All other product names are the trademarks of their respective owners.
Principled Technologies is a registered trademark of Principled Technologies, Inc.
All other product names are the trademarks of their respective owners.
DISCLAIMER OF WARRANTIES; LIMITATION OF LIABILITY:
Principled Technologies, Inc. has made reasonable efforts to ensure the accuracy and validity of its testing, however, Principled Technologies, Inc. specifically disclaims any warranty, expressed or implied, relating to the test results and analysis, their accuracy, completeness or quality, including any implied warranty of fitness for any particular purpose. All persons or entities relying on the results of any testing do so at their own risk, and agree that Principled Technologies, Inc., its employees and its subcontractors shall have no liability whatsoever from any claim of loss or damage on account of any alleged error or defect in any testing procedure or result.
In no event shall Principled Technologies, Inc. be liable for indirect, special, incidental, or consequential damages in connection with its testing, even if advised of the possibility of such damages. In no event shall Principled Technologies, Inc.’s liability, including for direct damages, exceed the amounts paid in connection with Principled Technologies, Inc.’s testing. Customer’s sole and exclusive remedies are as set forth herein.