Configure MySQL Community 8.4 LTS (Hardened)

Configuration files

/etc/my.cnf and /etc/my.cnf.d/zz-hardening.cnf (bind-address 127.0.0.1; mysqlx off/loopback — duplicated in both files deliberately)

Credential rotation

Not applicable to root (socket auth). For app users you create: ALTER USER ... IDENTIFIED BY with your own secret.

Monitoring & logging

• Logs: /var/log/mysqld.log; `journalctl -u mysqld -f`
• Health: sudo mysql -e 'SELECT 1' (first boot completes when /var/lib/mysql-firstboot.done exists) — wire this into your cloud's monitoring agent or an external probe.
• Cloud-native agents (CloudWatch agent, Google Cloud Ops Agent) install normally on this image if you want metrics/log shipping — none is pre-installed or phoning home by default.

Upgrades

Prefer replacing the instance with the newest image version (monthly + event-driven CVE rebuilds). In place: `sudo dnf update mysql-community-server` between refreshes. Major-version upgrades follow MySQL's documented path — take a backup first.

Backup & restore

mysqldump --all-databases via `sudo mysql`, or stop mysqld and snapshot the volume. Restore: standard mysql import into a fresh instance.