Pulumi Blog: Mysql

How to Deploy a Django Application to AWS

Vova Ivanov — Fri, 28 Aug 2020 00:00:00 +0000

In this blog post, we will finish swapping out the frontend and backend of our Python AWS application. Although Flask and Redis are different from Django and MySQL in many ways, the underlying infrastructure behind their deployment is nonetheless very similar, and can be effortlessly updated as we transition from one to the other.

We will be paying additional attention to security, and will be making use of Pulumi’s secret management tools to protect our passwords and private keys.

The first step is to create a new directory and initialize a Pulumi project with pulumi new aws-python.

$ mkdir aws-py-django-voting-app && cd aws-py-django-voting-app
$ pulumi new aws-python

Next, let’s create a folder to hold our application and start a Django project in it.

$ mkdir frontend && cd frontend
$ django-admin startproject mysite
$ cd mysite

This tutorial was written for the aws-py-django-voting-app example but will work with any other Django application. The most important file is ./mysite/settings.py, which we will modify to accept secrets and configuration parameters in the form of environment variables. A common mistake that programmers make is to submit files with important data to source code repositories. Even if it is a private repository, it is still not recommended to leave passwords and private keys in your files.

SECRET_KEY = os.environ['SECRET_KEY']

DATABASES = {
 'default': {
 'ENGINE': 'django.db.backends.mysql',
 'NAME': os.environ['DATABASE_NAME'],
 'USER': os.environ['USER_NAME'],
 'PASSWORD': os.environ['USER_PASSWORD'],
 'HOST': os.environ['DATABASE_ADDRESS'],
 'PORT': os.environ['DATABASE_PORT'],
 }
}

To perform database migrations as part of the deployment, we will create a setupDatabase.sh script inside the aws-py-django-voting-app/frontend/mysite folder. As a bonus, the script will create an admin account that we can use to log into our website. Make sure the file has exec permissions.

#!/bin/bash
set -exu
python3 /mysite/manage.py makemigrations
python3 /mysite/manage.py migrate
export DJANGO_SUPERUSER_PASSWORD=$DJANGO_PASSWORD
python3 /mysite/manage.py createsuperuser \
 --no-input \
 --username=$DJANGO_NAME \
 --email=$DJANGO_NAME@example.com

The next step is to go back into the aws-py-django-voting-app/frontend folder and containerize our application with Docker. First, we will list the libraries our application uses by creating a requirements.txt file with the following lines.

django==3.1
mysqlclient==1.4.0

And lastly, we can create the Dockerfile.

FROM ubuntu:18.04

WORKDIR /

EXPOSE 80

RUN apt-get update && \
 apt install -y gcc python3-dev python3-pip mysql-client-core-5.7 libmysqlclient-dev

ADD requirements.txt /

RUN pip3 install -r requirements.txt

ADD mysite /mysite

CMD [ "python3", "/mysite/manage.py", "runserver", "0.0.0.0:80" ]

Now that our Django application and Dockerfile are ready, we can return to the main aws-py-django-voting-app folder. The Pulumi project requires several configuration variables, which we set using pulumi config set. They are used to configure the MySQL admin account, a user account for initializing the table, and the Django website admin account. The private key that Django uses will also be passed in the same way.

$ pulumi config set sql-admin-name <NAME>
$ pulumi config set sql-admin-password <PASSWORD> --secret
$ pulumi config set sql-user-name <NAME>
$ pulumi config set sql-user-password <PASSWORD> --secret
$ pulumi config set django-admin-name <NAME>
$ pulumi config set django-admin-password <PASSWORD> --secret
$ pulumi config set django_secret_key = <VALUE> --secret

The requirements.txt file lists the libraries used by the project. We will need to add the following:

pulumi-docker>=2.0.0,<3.0.0
pulumi-mysql>=2.0.0,<3.0.0
mysql-connector-python>=1.0.0,<10.0.0

The first few lines of our __main__.py file indicate the libraries to import and describe the application’s configuration options.

import json
import base64
import pulumi
import pulumi_aws as aws
import pulumi_docker as docker
import pulumi_mysql as mysql

config = pulumi.Config()
sql_admin_name = config.require("sql-admin-name")
sql_admin_password = config.require_secret("sql-admin-password")
sql_user_name = config.require("sql-user-name")
sql_user_password = config.require_secret("sql-user-password")
availability_zone = pulumi.Config("aws").get("region")

django_admin_name = config.require("django-admin-name")
django_admin_password = config.require_secret("django-admin-password")

django_secret_key = config.require_secret("django-secret-key")

After setting up the imports and configurations, we create an ECS Cluster, VPC, Subnet, RDS instance, and several other items. All the components are identical to the ones in the first and second blog posts, and the full code can be seen in this example’s github repository.

app_cluster = aws.ecs.Cluster(...)

app_vpc = aws.ec2.Vpc(...)
app_vpc_subnet = aws.ec2.Subnet(...)

app_gateway = aws.ec2.InternetGateway(...)
app_routetable = aws.ec2.RouteTable(...)
app_security_group = aws.ec2.SecurityGroup(...)

app_exec_role = aws.iam.Role(...)
exec_policy_attachment = aws.iam.RolePolicyAttachment(...)
app_task_role = aws.iam.Role(...)
task_policy_attachment = aws.iam.RolePolicyAttachment(...)
task_policy_attachment = aws.iam.RolePolicyAttachment(...)

app_ecr_repo = aws.ecr.Repository(...)
app_lifecycle_policy = aws.ecr.LifecyclePolicy(...)

extra_rds_subnet = aws.ec2.Subnet(...)
app_database_subnetgroup = aws.rds.SubnetGroup(...)
mysql_rds_server = aws.rds.Instance(...)
mysql_provider = mysql.Provider(...)
mysql_database = mysql.Database(...)
mysql_user = mysql.User(...)
mysql_access_grant = mysql.Grant(...)

With the basic infrastructure and MySQL backend in place, all that’s left is to create the Django frontend.

A target group, balancer, and listener are created for the frontend.

django_targetgroup = aws.lb.TargetGroup("django-targetgroup",
 port=80,
 protocol="TCP",
 target_type="ip",
 stickiness= {
 "enabled": False,
 "type": "lb_cookie",
 },
 vpc_id=app_vpc.id)

django_balancer = aws.lb.LoadBalancer("django-balancer",
 load_balancer_type="network",
 internal=False,
 security_groups=[],
 subnets=[app_vpc_subnet.id])

django_listener = aws.lb.Listener("django-listener",
 load_balancer_arn=django_balancer.arn,
 port=80,
 protocol="TCP",
 default_actions=[{
 "type": "forward",
 "target_group_arn": django_targetgroup.arn
 }])

The application is built into a Docker image and pushed to our ECR repository we created earlier.

def get_registry_info(rid):
 creds = aws.ecr.get_credentials(registry_id=rid)
 decoded = base64.b64decode(creds.authorization_token).decode()
 parts = decoded.split(':')
 if len(parts) != 2:
 raise Exception("Invalid credentials")
 return docker.ImageRegistry(creds.proxy_endpoint, parts[0], parts[1])

app_registry = app_ecr_repo.registry_id.apply(get_registry_info)

django_image = docker.Image("django-dockerimage",
 image_name=app_ecr_repo.repository_url,
 build="./frontend",
 skip_push=False,
 registry=app_registry
)

To help with debugging our application, we will create a Cloudwatch instance to store all logs.

django_log_group = aws.cloudwatch.LogGroup("django-log-group",
 retention_in_days=1,
 name="django-log-group"
)

Our project is special because it uses two independent ECS services—one that sets up the MySQL database, and one that continuously runs and handles the website.

While it is possible to have a single ECS service set up both the database and the server, doing so presents the risk of exposing important information to the internet. To set up the database, the ECS service would need to know our MySQL admin credentials. However, since the service would also handle the website, it would mean that a successful attack on our Django website could allow the attacker to access the credentials for our backend.

First, let’s create the task definition that runs once and sets up the database.

django_database_task_definition = aws.ecs.TaskDefinition("django-database-task-definition",
 family="django_database_task_definition-family",
 cpu="256",
 memory="512",
 network_mode="awsvpc",
 requires_compatibilities=["FARGATE"],
 execution_role_arn=app_exec_role.arn,
 task_role_arn=app_task_role.arn,
 container_definitions=pulumi.Output.all(
 # We must do Output.all() to access Pulumi secrets
 django_image.image_name,
 django_secret_key,
 mysql_database.name,
 sql_admin_name,
 sql_admin_password,
 django_admin_name,
 django_admin_password,
 mysql_rds_server.address,
 mysql_rds_server.port).apply(lambda args: json.dumps([{
 "name": "django-container",
 "image": args[0],
 "memory": 512,
 "essential": True,
 "portMappings": [{
 "containerPort": 80,
 "hostPort": 80,
 "protocol": "tcp"
 }],
 "environment": [
 { "name": "SECRET_KEY", "value": args[1] },
 { "name": "DATABASE_NAME", "value": args[2] },
 { "name": "USER_NAME", "value": args[3] },
 { "name": "USER_PASSWORD", "value": args[4] },
 { "name": "DJANGO_NAME", "value": args[5] },
 { "name": "DJANGO_PASSWORD", "value": args[6] },
 { "name": "DATABASE_ADDRESS", "value": args[7] },
 { "name": "DATABASE_PORT", "value": str(int(args[8])) },
 ],
 "logConfiguration": {
 "logDriver": "awslogs",
 "options": {
 "awslogs-group": "django-log-group",
 "awslogs-region": "us-west-2",
 "awslogs-stream-prefix": "djangoApp-database",
 },
 },
 # We override the command in the Dockerfile with a new one
 "command": ["/mysite/setupDatabase.sh"]
 }])))

We can now launch our first service on Fargate.

django_database_service = aws.ecs.Service("django-database-service",
 cluster=app_cluster.arn,
 desired_count=1,
 launch_type="FARGATE",
 task_definition=django_database_task_definition.arn,
 wait_for_steady_state=False,
 network_configuration={
 "assign_public_ip": "true",
 "subnets": [app_vpc_subnet.id],
 "security_groups": [app_security_group.id]
 },
 load_balancers=[{
 "target_group_arn": django_targetgroup.arn,
 "container_name": "django-container",
 "container_port": 80,
 }],
 opts=pulumi.ResourceOptions(depends_on=[django_listener]),
)

Finally, let’s create the second task definition to run the website.

django_site_task_definition = aws.ecs.TaskDefinition("django-site-task-definition",
 family="django-site-task-definition-family",
 cpu="256",
 memory="512",
 network_mode="awsvpc",
 requires_compatibilities=["FARGATE"],
 execution_role_arn=app_exec_role.arn,
 task_role_arn=app_task_role.arn,
 container_definitions=pulumi.Output.all(
 django_image.image_name,
 django_secret_key,
 mysql_database.name,
 sql_user_name,
 sql_user_password,
 mysql_rds_server.address,
 mysql_rds_server.port).apply(lambda args: json.dumps([{
 "name": "django-container",
 "image": args[0],
 "memory": 512,
 "essential": True,
 "portMappings": [{
 "containerPort": 80,
 "hostPort": 80,
 "protocol": "tcp"
 }],
 "environment": [
 { "name": "SECRET_KEY", "value": args[1] },
 { "name": "DATABASE_NAME", "value": args[2] },
 { "name": "USER_NAME", "value": args[3] },
 { "name": "USER_PASSWORD", "value": args[4] },
 { "name": "DATABASE_ADDRESS", "value": args[5] },
 { "name": "DATABASE_PORT", "value": str(int(args[6])) },
 ],
 "logConfiguration": {
 "logDriver": "awslogs",
 "options": {
 "awslogs-group": "django-log-group",
 "awslogs-region": "us-west-2",
 "awslogs-stream-prefix": "djangoApp-site",
 },
 },
 }])))

Similarly, we will launch our second task definition on Fargate.

django_site_service = aws.ecs.Service("django-site-service",
 cluster=app_cluster.arn,
 desired_count=1,
 launch_type="FARGATE",
 task_definition=django_site_task_definition.arn,
 wait_for_steady_state=False,
 network_configuration={
 "assign_public_ip": "true",
 "subnets": [app_vpc_subnet.id],
 "security_groups": [app_security_group.id]
 },
 load_balancers=[{
 "target_group_arn": django_targetgroup.arn,
 "container_name": "django-container",
 "container_port": 80,
 }],
 opts=pulumi.ResourceOptions(depends_on=[django_listener]),

To connect to our application, we export the DNS name of the Django balancer and open it in a browser window.

pulumi.export("app-url", django_balancer.dns_name)

To add questions to the database, add “/admin/” to the end of the URL, and log in using your Django admin credentials.

The Administration panel allows you to manage the state of your application. Groups, users, choices, and questions can all be added easily.

Comparison between Flask and Django:

In this example, I described how to set up a basic Django voting application and deploy it to AWS. Although our Django and Flask applications use very different AWS services, we seamlessly replaced the previous infrastructure with what was needed.

Next week, we’ll explore PostgreSQL, Express, React, and Node.js, and use them to create a simple application.

The blog post’s full code and an in-depth explanation for each component are on Github.

Deploying a MySQL schema using Dynamic Providers

Vova Ivanov — Tue, 18 Aug 2020 00:00:00 +0000

In our previous post, we created a Python voting application using Flask and Redis. This blog post will explore creating a MySQL database and initializing it with a schema and data. What seems to be a simple step is much more interesting than it appears, because Pulumi’s MySQL provider does not support creating and populating tables. To do it, we will extend it with a Dynamic Provider.

The existing Pulumi MySQL provider allows us to create the MySQL server, database, and different users. However, it would be great to create the tables as part of the deployment, too, since database schema can be considered a type of infrastructure. Because creating tables requires admin credentials, deploying them along with the other infrastructure allows us to limit the sharing of admin credentials, and run the application under restricted permissions at all times.

A great advantage of Pulumi is its extensible and modular design. If support for something isn’t implemented, you can write it yourself easily. We will be writing a Dynamic Provider that connects to a MySQL server, initializes a table, and creates some starting data all during pulumi up.

The first step is to create a new directory and initialize a Pulumi project with pulumi new aws-python.

$ mkdir aws-py-dynamicresource && cd aws-py-dynamicresource
$ pulumi new aws-python

This project requires several configuration variables, which we set using pulumi config set. They are used to configure the MySQL admin account during deployment, and a user account for initializing the table.

$ pulumi config set sql-admin-name <NAME>
$ pulumi config set sql-admin-password <PASSWORD> --secret
$ pulumi config set sql-user-name <NAME>
$ pulumi config set sql-user-password <PASSWORD> --secret

The requirements.txt file lists the libraries used in the project. We will need to add the following:

pulumi-mysql>=1.0.0,<3.0.0
mysql-connector-python>=1.0.0,<10.0.0

We will write the code for our Dynamic Provider in a separate file to reduce clutter, for example, MySqlDynamicProvider.py. The first few lines of the file will indicate which libraries to import.

import mysql.connector as connector
from mysql.connector import errorcode
from pulumi import Input, Output, ResourceOptions
from pulumi.dynamic import *
from typing import Any, Optional
import binascii
import os

After setting up the imports, the next step is to write the code. The Dynamic Provider’s first component is a class with the arguments that the dynamic provider requires when created. These arguments are given a type Input[str] and automatically converted to regular str before being passed to the provider’s functions.

class SchemaInputs(object):
 creator_name: Input[str]
 creator_password: Input[str]
 server_address: Input[str]
 database_name: Input[str]
 creation_script: Input[str]
 deletion_script: Input[str]
 def __init__(self, creator_name, creator_password, server_address, database_name, creation_script, deletion_script):
 self.creator_name = creator_name
 self.creator_password = creator_password
 self.server_address = server_address
 self.database_name = database_name
 self.creation_script = creation_script
 self.deletion_script = deletion_script

The second step is to write the Dynamic Provider. The provider handles the create, read, update, and delete operations the resource needs. The create function instantiates a new resource and assigns it a unique ID. The delete function deletes an existing resource. The diff function determines if we can update the resource without entirely replacing it, and the update function performs the update.

class SchemaProvider(ResourceProvider):
 def create(self, args):
 connection = connector.connect(user=args["creator_name"],
 password=args["creator_password"],
 host=args["server_address"],
 database=args["database_name"])
 cursor = connection.cursor()
 cursor.execute(args["creation_script"])
 return CreateResult("schema-"+binascii.b2a_hex(os.urandom(16)).decode("utf-8"), outs=args)

 def delete(self, id, args):
 connection = connector.connect(user=args["creator_name"],
 password=args["creator_password"],
 host=args["server_address"],
 database=args["database_name"])
 cursor = connection.cursor()
 cursor.execute(args["deletion_script"])

 def diff(self, id, oldInputs, newInputs):
 replaces = []
 if (oldInputs["server_address"] != newInputs["server_address"]): replaces.append("server_address")
 if (oldInputs["database_name"] != newInputs["database_name"]): replaces.append("database_name")
 if (oldInputs["creation_script"] != newInputs["creation_script"]): replaces.append("creation_script")

 return DiffResult(
 changes=oldInputs != newInputs,
 replaces=replaces,
 stables=None,
 delete_before_replace=True)

 def update(self, id, oldInputs, newInputs):
 return UpdateResult(outs={**newInputs})

And lastly, we add the main Schema resource that we instantiate in our infrastructure code. We make all the inputs to our provider available as outputs, so that they can be accessed and exported.

class Schema(Resource):
 creator_name: Output[str]
 creator_password: Output[str]
 server_address: Output[str]
 database_name: Output[str]
 creation_script: Output[str]
 deletion_script: Output[str]
 def __init__(self, name: str, args: SchemaInputs, opts = None):
 super().__init__(SchemaProvider(), name, vars(args), opts)

With the dynamic provider finished, all that is left is to create it in our infrastructure. Like the previous post, the project uses a __main__.py file; the first few lines indicate the libraries to import and describe the application’s configuration options.

import json
import base64
import pulumi
import pulumi_aws as aws
import pulumi_mysql as mysql
from MySqlDynamicProvider import *

config = pulumi.Config()
admin_name = config.require("sql-admin-name")
admin_password = config.require_secret("sql-admin-password")
user_name = config.require("sql-user-name")
user_password = config.require_secret("sql-user-password")
availability_zone = pulumi.Config("aws").get("region")

To allow different tasks within our project to communicate, we create a Virtual Private Cloud and an associated subnet. Two subnets are required for the project, so the availability zone suffix is set to “a”.

app_vpc = aws.ec2.Vpc("app-vpc",
 cidr_block="172.31.0.0/16",
 enable_dns_hostnames=True)

app_vpc_subnet = aws.ec2.Subnet("app-vpc-subnet",
 cidr_block="172.31.0.0/20",
 availability_zone=availability_zone + "a",
 vpc_id=app_vpc)

A gateway and routing table are needed to allow the VPC to communicate with the Internet. Once created, we associate the routing table with our VPC.

app_gateway = aws.ec2.InternetGateway("app-gateway",
 vpc_id=app_vpc.id)

app_routetable = aws.ec2.RouteTable("app-routetable",
 routes=[
 {
 "cidr_block": "0.0.0.0/0",
 "gateway_id": app_gateway.id,
 }
 ],
 vpc_id=app_vpc.id)

app_routetable_association = aws.ec2.MainRouteTableAssociation("app_routetable_association",
 route_table_id=app_routetable.id,
 vpc_id=app_vpc)

To control traffic flow between applications running inside our VPC, we create a security group.

app_security_group = aws.ec2.SecurityGroup("security-group",
 vpc_id=app_vpc.id,
 description="Enables HTTP access",
 ingress=[{
 'protocol': 'tcp',
 'from_port': 0,
 'to_port': 65535,
 'cidr_blocks': ['0.0.0.0/0'],
 }],
 egress=[{
 'protocol': '-1',
 'from_port': 0,
 'to_port': 0,
 'cidr_blocks': ['0.0.0.0/0'],
 }])

Our MySQL database is created with an RDS instance. To create the instance, Amazon requires that it be given two subnets in different availability zones.

extra_rds_subnet = aws.ec2.Subnet("extra-rds-subnet",
 cidr_block="172.31.128.0/20",
 availability_zone=availability_zone + "b",
 vpc_id=app_vpc)

Both subnets are assigned to a SubnetGroup and belong to the RDS instance.

app_database_subnetgroup = aws.rds.SubnetGroup("app-database-subnetgroup",
 subnet_ids=[app_vpc_subnet.id, extra_rds_subnet.id])

mysql_rds_server = aws.rds.Instance("mysql-server",
 engine="mysql",
 username=admin_name,
 password=admin_password,
 instance_class="db.t2.micro",
 allocated_storage=20,
 skip_final_snapshot=True,
 publicly_accessible=True,
 db_subnet_group_name=app_database_subnetgroup.id,
 vpc_security_group_ids=[app_security_group.id])

Pulumi offers some additional tools to make handling MySQL easier.

mysql_provider = mysql.Provider("mysql-provider",
 endpoint=mysql_rds_server.endpoint,
 username=admin_name,
 password=admin_password)

We initialize the example database and create a user to manage it.

mysql_database = mysql.Database("mysql-database",
 name="votes-database",
 opts=pulumi.ResourceOptions(provider=mysql_provider))

mysql_user = mysql.User("mysql-standard-user",
 user=user_name,
 host="example.com",
 plaintext_password=user_password,
 opts=pulumi.ResourceOptions(provider=mysql_provider))

The user only needs the SELECT and UPDATE permissions to function.

mysql_access_grant = mysql.Grant("mysql-access-grant",
 user=mysql_user.user,
 host=mysql_user.host,
 database=mysql_database.name,
 privileges= ["SELECT", "UPDATE"],
 opts=pulumi.ResourceOptions(provider=mysql_provider))

Now, we use our Dynamic Provider. The provider takes creation_script as a parameter, connects to our MySQL server, and runs it during deployment.

creation_script = """
 CREATE TABLE votesTable (
 choice_id int(10) NOT NULL AUTO_INCREMENT,
 vote_count int(10) NOT NULL,
 PRIMARY KEY (choice_id)
 ) ENGINE=InnoDB;
 INSERT INTO votesTable(choice_id, vote_count) VALUES (0,0);
 INSERT INTO votesTable(choice_id, vote_count) VALUES (1,0);
 """

The deletion_script parameter drops the table and deletes stored data.

deletion_script = "DROP TABLE votesTable CASCADE"

When we create our resource, it behaves the same way as any other Pulumi resource but takes its arguments as a SchemaInputs object.

mysql_votes_table = Schema(name="mysql_votes_table",
 args=SchemaInputs(admin_name, admin_password, mysql_rds_server.address, mysql_database.name, creation_script, deletion_script))

We can export the ID of our new resource, and view it when deployed.

pulumi.export("dynamic-resource-id",mysql_votes_table.id)

In this example, I showed how straightforward it is to expand functionality with Pulumi by writing additional code. Dynamic Providers enable excellent flexibility in cloud architecture design and help break down barriers that would otherwise be challenging to overcome.

Next week, I’ll change the frontend from Flask to Django, and will show how to integrate it with our new MySQL server.

The blog post’s full code and an in-depth explanation for each component can be found on Github.

Managing your MySQL databases with Pulumi

Linio Engineering — Tue, 28 May 2019 00:00:00 +0000

One of the most critical components of an application’s infrastructure is its database, and one of the most popular databases in use in the cloud today is MySQL.

Pulumi can already be used to create managed MySQL instances in a wide variety of clouds, including AWS, Azure and GCP. In addition to this, Pulumi recently added support for managing the MySQL instances themselves to manage permissions, create databases, and other common tasks.

In this post, we’ll walk through a quick tutorial of how to use this new Pulumi MySQL provider to manage existing and new MySQL databases.

Setup

Create a new Pulumi program:

$ pulumi new aws-typescript

Install the MySQL provider SDK:

$ npm add @pulumi/mysql

Create the database in index.ts as shown in either of the two examples below.

Examples

Example 1: Using an existing MySQL server

In this scenario, the following configuration is required:

Note: please use your own endpoint, username and password.

$ pulumi config set mysql:endpoint localhost:3306
$ pulumi config set mysql:username root
$ pulumi config set --secret mysql:password foo
$ pulumi config set --secret jdoePassword hunter2

In this example, we will create a database in the previously configured MySQL server, add a user (jdoe) with the given password and grant this user SELECT and UPDATE access to it.

import * as mysql from '@pulumi/mysql';
import * as pulumi from '@pulumi/pulumi';

const config = new pulumi.Config();
const jdoePassword = config.requireSecret(‘jdoePassword’);

const database = new mysql.Database('sample', {
 name: 'sample',
});

const user = new mysql.User('jdoe', {
 user: 'jdoe',
 // Since the password is a Pulumi Secret, it will be encrypted and not stored in plaintext
 plaintextPassword: jdoePassword,
});

new mysql.Grant('jdoe', {
 user: user.user,
 host: user.host,
 database: database.name,
 privileges: ['SELECT', 'UPDATE'],
});

Now deploy the infrastructure to provision the database and user:

$ pulumi up

Example 2: Using a RDS instance

In this scenario, the following configuration is required:

$ pulumi config set mysqlUsername rootUser
$ pulumi config set --secret mysqlPassword rootPassword

In this example, we will create an AWS RDS Instance to be our MySQL server, create a “first-class” provider to manage the MySQL database, and add a user (jdoe) with the given password and grant this user SELECT and UPDATE access to it:

Note: This requires the default VPC security group to allow access from where the Pulumi deployment is being executed.

import * as mysql from '@pulumi/mysql';
import * as aws from '@pulumi/aws';
import * as pulumi from '@pulumi/pulumi';

const config = new pulumi.Config();
const mysqlUser = config.require('mysqlUser');
const mysqlPassword = config.requireSecret('mysqlPassword');

const rds = new aws.rds.Instance('sample', {
 engine: 'mysql',
 username: mysqlUser,
 password: mysqlPassword,
 availabilityZone: 'us-east-1b',
 instanceClass: 'db.t2.micro',
 allocatedStorage: 20,
 deletionProtection: true,

 // For a VPC cluster, you will also need the following:
 // dbSubnetGroupName: 'sg-db01-replication-1',
 // vpcSecurityGroupIds: ['sg-c1c63aba'],
});

const mysqlProvider = new mysql.Provider('mysql', {
 endpoint: rds.endpoint,
 username: rds.username,
 password: rds.password,
});

const database = new mysql.Database('sample', {
 name: 'sample',
}, {
 provider: mysqlProvider
});

const user = new mysql.User('jdoe', {
 user: "jdoe",
 host: "example.com",
 plaintextPassword: "password",
}, {
 provider: mysqlProvider
});

new mysql.Grant('jdoe', {
 user: user.user,
 host: user.host,
 database: database.name,
 privileges: ["SELECT", "UPDATE"],
}, {
 provider: mysqlProvider
});

Now deploy the infrastructure:

$ pulumi up

Wrapping Up Pulumi allows you to manage your MySQL cloud instances in AWS, Azure, and GCP, as well as manage MySQL databases, users and more. Together, this enables end-to-end provisioning of your application’s database infrastructure. Read more about the Pulumi MySQL provider.

We’ve only shown a little bit of what Pulumi can do. If you need any help, feel free to create an issue on GitHub or join the Pulumi Community Slack channel.