Azure Database MySQL Flexible Server

azurerm_mysql_flexible_server (Terraform)

The MySQL Flexible Server in Database can be configured in Terraform with the resource name azurerm_mysql_flexible_server. The following sections describe how to use the resource and its parameters.

Example Usage from GitHub

An example could not be found in GitHub.

Parameters

The following arguments are supported:

• name - (Required) The name which should be used for this MySQL Flexible Server. Changing this forces a new MySQL Flexible Server to be created.

• resource_group_name - (Required) The name of the Resource Group where the MySQL Flexible Server should exist. Changing this forces a new MySQL Flexible Server to be created.

• location - (Required) The Azure Region where the MySQL Flexible Server should exist. Changing this forces a new MySQL Flexible Server to be created.

• administrator_login - (Optional) The Administrator Login for the MySQL Flexible Server. Required when create_mode is Default. Changing this forces a new MySQL Flexible Server to be created.

• administrator_password - (Optional) The Password associated with the administrator_login for the MySQL Flexible Server. Required when create_mode is Default.

• backup_retention_days - (Optional) The backup retention days for the MySQL Flexible Server. Possible values are between 7 and 35 days. Defaults to 7.

• create_mode - (Optional)The creation mode which can be used to restore or replicate existing servers. Possible values are Default, PointInTimeRestore, GeoRestore, and Replica. Changing this forces a new MySQL Flexible Server to be created.

NOTE: Creating a GeoRestore server requires the source server with geo_redundant_backup_enabled enabled.

NOTE: The best practise is that it has to wait greater than 10 minutes to create the GeoRestore server once the source server is created.

• delegated_subnet_id - (Optional) The ID of the virtual network subnet to create the MySQL Flexible Server. Changing this forces a new MySQL Flexible Server to be created.

• geo_redundant_backup_enabled - (Optional) Should geo redundant backup enabled? Defaults to false. Changing this forces a new MySQL Flexible Server to be created.

• high_availability - (Optional) A high_availability block as defined below.

• maintenance_window - (Optional) A maintenance_window block as defined below.

• point_in_time_restore_time_in_utc - (Optional) The point in time to restore from creation_source_server_id when create_mode is PointInTimeRestore. Changing this forces a new MySQL Flexible Server to be created.

• private_dns_zone_id - (Optional) The ID of the private dns zone to create the MySQL Flexible Server. Changing this forces a new MySQL Flexible Server to be created.

NOTE: The private_dns_zone_id is required when setting a delegated_subnet_id. The azurerm_private_dns_zone should end with suffix .mysql.database.azure.com.

• replication_role - The replication role. Possible value is None.

NOTE: The replication_role cannot be set while creating and only can be updated from Replica to None.

• sku_name - (Optional) The SKU Name for the MySQL Flexible Server.

• source_server_id - (Optional)The resource ID of the source MySQL Flexible Server to be restored. Required when create_mode is PointInTimeRestore, GeoRestore, and Replica. Changing this forces a new MySQL Flexible Server to be created.

• storage - (Optional) A storage block as defined below.

• version - (Optional) The version of the MySQL Flexible Server to use. Possible values are 5.7, and 8.0.21. Changing this forces a new MySQL Flexible Server to be created.

• zone - (Optional) The availability zone information of the MySQL Flexible Server. Possible values are 1, 2 and 3.

• tags - (Optional) A mapping of tags which should be assigned to the MySQL Flexible Server.

A high_availability block supports the following:

• mode - (Required) The high availability mode for the MySQL Flexible Server. Possibles values are SameZone and ZoneRedundant.

NOTE: storage.0.auto_grow_enabled must be enabled when high_availability is enabled. To change the high_availability for a MySQL Flexible Server created with high_availability disabled during creation, the resource has to be recreated.

• standby_availability_zone - (Optional) The availability zone of the standby Flexible Server. Possible values are 1, 2 and 3.

NOTE: The standby_availability_zone will be omitted when mode is SameZone, for the standby_availability_zone will be the same as zone.

A maintenance_window block supports the following:

• day_of_week - (Optional) The day of week for maintenance window. Defaults to 0.

• start_hour - (Optional) The day of week for maintenance window. Defaults to 0.

• start_minute - (Optional) The start minute for maintenance window. Defaults to 0.

A storage block supports the following:

• auto_grow_enabled - (Optional) Should Storage Auto Grow be enabled? Defaults to true.

• iops - (Optional) The storage IOPS for the MySQL Flexible Server. Possible values are between 360 and 20000.

• size_gb - (Optional) The max storage allowed for the MySQL Flexible Server. Possible values are between 20 and 16384.

In addition to the Arguments listed above - the following Attributes are exported:

• id - The ID of the MySQL Flexible Server.

• fqdn - The fully qualified domain name of the MySQL Flexible Server.

• public_network_access_enabled - Is the public network access enabled?

• replica_capacity - The maximum number of replicas that a primary MySQL Flexible Server can have.

Explanation in Terraform Registry

Manages a MySQL Flexible Server.

Tips: Best Practices for The Other Azure Database Resources

In addition to the azurerm_mariadb_firewall_rule, Azure Database has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

azurerm_mariadb_firewall_rule

Ensure database firewalls do not permit public access

It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.

azurerm_mariadb_server

Ensure that access to Azure SQL Database is restricted

It is better to disable public access to the database to avoid unwilling communications with unknown services if not required.

azurerm_mssql_database_extended_auditing_policy

Ensure to configure retention periods of database auditing to enough duration

It is better to configure retention periods of database auditing to enough duration. It would be better to set greater than at least 90 days.

azurerm_mssql_server

Ensure to enable auditing on Azure SQL databases

It is better to enable auditing on Azure SQL databases. It helps you maintain regulatory compliance, monitor the activities indicating unexpected incidents or suspected security violations.

azurerm_mssql_server_security_alert_policy

Ensure to configure at least one email address for threat alerts

It is better to configure at least one email address for threat alerts. SQL Server is able to send alerts for threat detection via emails and it could support us to notice the incident on time.

azurerm_mysql_firewall_rule

Ensure database firewalls do not permit public access

It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.

azurerm_mysql_server

Ensure to disable public access to database

It is better to disable public access to the database to avoid unwilling communications with unknown services if not required.

azurerm_postgresql_firewall_rule

Ensure database firewalls do not permit public access

It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.

azurerm_postgresql_server

Ensure to disable public access to database

It is better to disable public access to the database to avoid unwilling communications with unknown services if not required.

azurerm_sql_firewall_rule

Ensure database firewalls do not permit public access

It is better to restrict IP address ranges that can access the database by firewall rules. If both start_ip_address and end_ip_address are set to 0.0.0.0, it blocks connections from the Internet and accepts connections from all Azure datacenter IP addresses.

azurerm_sql_server

Ensure to enable auditing on Azure SQL databases

It is better to enable auditing on Azure SQL databases. It helps you maintain regulatory compliance, monitor the activities indicating unexpected incidents or suspected security violations.