MySQL

Connect AnomalyArmor to any MySQL-compatible database. This guide covers self-hosted MySQL as well as managed services like Amazon RDS, Aurora MySQL, PlanetScale, and DigitalOcean.

Supported Versions & Platforms

Platform	Minimum Version	Notes
MySQL	5.7+	Self-hosted or any cloud
Amazon RDS	5.7+	All instance classes
Amazon Aurora MySQL	5.7+	Cluster and serverless
PlanetScale	Any	Serverless MySQL
DigitalOcean	8.0+	Managed databases
Google Cloud SQL	5.7+	Public or private IP
Azure Database	5.7+	Single server or flexible
MariaDB	10.3+	MySQL-compatible fork

Connection Settings

Field	Description	Example
Connection Name	Friendly identifier	`Production MySQL`
Host	Hostname or IP address	`db.example.com`
Port	Database port	`3306`
Database	Database name	`myapp_production`
Username	Database user	`anomalyarmor`
Password	User password	`••••••••`
SSL Mode	SSL configuration	`require`

SSL Mode Options

Mode	Description	When to Use
`disable`	No SSL	Local development only
`require`	SSL required, no verification	Recommended for most cloud providers
`verify-ca`	Verify server certificate	High security requirements
`verify-full`	Verify certificate and hostname	Maximum security

Never use disable for production databases. Most cloud providers (RDS, Aurora, PlanetScale) require SSL.

Creating a Read-Only User

Create a dedicated user with minimal permissions:

-- Create the user
CREATE USER 'anomalyarmor'@'%' IDENTIFIED BY 'your-secure-password';

-- Grant read access to your database
GRANT SELECT ON your_database.* TO 'anomalyarmor'@'%';

-- Access to information_schema is implicit with SELECT
-- Flush privileges to apply changes
FLUSH PRIVILEGES;

For Multiple Databases

If you want to monitor multiple databases:

-- Grant access to specific databases
GRANT SELECT ON database1.* TO 'anomalyarmor'@'%';
GRANT SELECT ON database2.* TO 'anomalyarmor'@'%';
GRANT SELECT ON analytics.* TO 'anomalyarmor'@'%';

FLUSH PRIVILEGES;

Verifying Permissions

Test that the user can access metadata:

-- Should return tables
SELECT TABLE_NAME FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_SCHEMA = 'your_database' LIMIT 5;

-- Should return columns
SELECT COLUMN_NAME, DATA_TYPE FROM INFORMATION_SCHEMA.COLUMNS
WHERE TABLE_SCHEMA = 'your_database' LIMIT 5;

Provider-Specific Instructions

Amazon RDS MySQL

Connection Details:

Host: Your RDS endpoint (e.g., mydb.abc123.us-east-1.rds.amazonaws.com)
Port: 3306 (default)
SSL Mode: require

Security Group Configuration:

Go to AWS Console → RDS → Your Instance → Security Groups
Edit inbound rules
Add rule:
- Type: MySQL/Aurora
- Port: 3306
- Source: AnomalyArmor IPs (see Settings → Security)

Parameter Group (if using verify-ca or verify-full):

Ensure require_secure_transport = ON
Download RDS CA certificate bundle

RDS instances in private subnets require NAT Gateway or VPC peering for AnomalyArmor access. Contact us for Enterprise VPC peering options.

Amazon Aurora MySQL

Connection Details:

Host: Cluster endpoint (reader or writer)
Port: 3306 (default)
SSL Mode: require

Choosing the Right Endpoint:

Endpoint	Use Case
Cluster (writer)	If you need real-time schema changes
Reader	Recommended - no impact on production writes

Aurora cluster writer and reader endpoints

Aurora Serverless v2:

Use the cluster endpoint
Ensure minimum ACU allows connections during discovery
Consider scheduling discovery during active hours

PlanetScale

Connection Details:

Host: Your branch endpoint (e.g., aws.connect.psdb.cloud)
Port: 3306
SSL Mode: require (mandatory)

Getting Credentials:

Go to PlanetScale Dashboard → Your Database → Settings → Passwords
Create a new password with Read-only access
Copy the connection details

Important Notes:

PlanetScale requires SSL - disable mode will fail
Use the main branch for production monitoring
Create separate credentials for AnomalyArmor

PlanetScale uses Vitess which may show slightly different table metadata than standard MySQL. All core functionality works correctly.

Self-Hosted MySQL

Connection Details:

Host: Your server’s hostname or IP
Port: 3306 (or custom port)
SSL Mode: Depends on your setup

Firewall Configuration:Allow inbound connections from AnomalyArmor IPs:

# iptables example
iptables -A INPUT -p tcp --dport 3306 -s 34.xxx.xxx.xxx -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -s 34.xxx.xxx.xxx -j ACCEPT

MySQL Configuration (my.cnf):Allow remote connections:

[mysqld]
bind-address = 0.0.0.0

SSL Setup (if not already configured):

# Generate certificates
mysql_ssl_rsa_setup --uid=mysql

# Enable in my.cnf
[mysqld]
ssl-ca=/var/lib/mysql/ca.pem
ssl-cert=/var/lib/mysql/server-cert.pem
ssl-key=/var/lib/mysql/server-key.pem
require_secure_transport=ON

User Host Configuration:Ensure user is created for remote access:

-- Allow from any host
CREATE USER 'anomalyarmor'@'%' IDENTIFIED BY 'password';

-- Or allow from specific IPs only
CREATE USER 'anomalyarmor'@'34.xxx.xxx.xxx' IDENTIFIED BY 'password';

Google Cloud SQL for MySQL

Connection Methods:

Method	Description
Public IP	Add AnomalyArmor IPs to authorized networks
Cloud SQL Proxy	For private IP instances (self-managed)

Public IP Setup:

Go to Cloud Console → SQL → Your Instance → Connections
Under Authorized Networks, click Add Network
Add each AnomalyArmor IP

Connection Details:

Host: Public IP from instance overview
Port: 3306
SSL Mode: require

Cloud SQL requires SSL by default. If you need verify-ca, download the server certificate from the instance details.

DigitalOcean Managed MySQL

Connection Details:

Host: Your database cluster hostname
Port: 25060 (DigitalOcean uses non-standard port)
SSL Mode: require (mandatory)

Getting Credentials:

Go to DigitalOcean → Databases → Your Cluster
Click Connection Details
Select Direct Connection or Connection Pool

Trusted Sources:

Go to Settings → Trusted Sources
Add AnomalyArmor IP addresses

DigitalOcean requires SSL and uses port 25060 by default.

What We Query

AnomalyArmor runs these types of queries:

-- Tables and views
SELECT TABLE_SCHEMA, TABLE_NAME, TABLE_TYPE
FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_SCHEMA NOT IN ('mysql', 'information_schema', 'performance_schema', 'sys');

-- Columns
SELECT COLUMN_NAME, DATA_TYPE, IS_NULLABLE, COLUMN_DEFAULT
FROM INFORMATION_SCHEMA.COLUMNS
WHERE TABLE_SCHEMA = 'your_database';

-- Freshness (for timestamp columns)
SELECT MAX(your_timestamp_column) FROM your_table;

Impact: Minimal. These are lightweight metadata queries.

Excluded Schemas

AnomalyArmor automatically excludes MySQL system schemas:

mysql
information_schema
performance_schema
sys

Only user-created databases and tables are monitored.

Troubleshooting

Can't connect to MySQL server

Causes:

Firewall blocking the connection
Wrong hostname or port
Database not running

Solutions:

Verify AnomalyArmor IPs are allowlisted
Check security group rules (for RDS/Aurora)
Test connectivity: nc -zv hostname 3306
Verify MySQL is running: systemctl status mysql

Access denied for user

Causes:

Wrong password
User doesn’t exist for connecting host
User lacks privileges

Solutions:

Verify password (copy-paste to avoid typos)
Confirm user exists: SELECT User, Host FROM mysql.user;
Check user is created for % or specific IP
Verify grants: SHOW GRANTS FOR 'anomalyarmor'@'%';

SSL connection error

Causes:

Database requires SSL but connection uses disable
SSL certificate issues

Solutions:

Set SSL Mode to require
For RDS/Aurora/PlanetScale: SSL is required
For self-hosted: Enable SSL or allow non-SSL (not recommended)

Unknown database

Causes:

Database name is incorrect
Database names are case-sensitive on Linux

Solutions:

Verify database name: SHOW DATABASES;
Use exact case for database name
Check you have access: SHOW DATABASES; (shows only accessible DBs)

No tables found in discovery

Causes:

User can’t see tables in information_schema
Schema filter excluding all schemas

Solutions:

Test as the user: SELECT * FROM INFORMATION_SCHEMA.TABLES LIMIT 5;
Check schema filter settings in AnomalyArmor
Verify tables exist in the database

Common Questions

Which MySQL versions and managed services does AnomalyArmor support?

MySQL 5.7 and 8.0+, Amazon RDS for MySQL, Aurora MySQL, Google Cloud SQL for MySQL, Azure Database for MySQL, and PlanetScale. MariaDB is MySQL-compatible for most monitoring use cases but not officially supported - test before relying on it in production.

Does MySQL 5.7 have any monitoring limitations compared to 8.0?

Minor. MySQL 5.7 doesn’t expose some column-statistics views that 8.0 has, so a few metric baselines are coarser. Schema drift and freshness work identically on both versions - no migration urgency for observability alone.

Can AnomalyArmor monitor PlanetScale branches?

Yes. Each connection points at one PlanetScale branch. Monitor main for production; add separate data sources per branch if you want pre-merge schema checks. PlanetScale’s schema migration flow surfaces in AnomalyArmor as schema drift on the target branch.

How should I configure SSL for RDS MySQL?

Set SSL Mode to require (RDS MySQL’s default). Upload Amazon’s RDS CA bundle in connection settings if your compliance program requires verify-ca or verify-full.

Does AnomalyArmor read MySQL binlogs?

No. AnomalyArmor queries information_schema and runs bounded aggregates on a schedule. Binlog access is not required - if you’ve granted REPLICATION CLIENT to the AnomalyArmor user, you can safely revoke it.

Getting Started

Core Concepts

Data Sources

Detect Schema Changes

Monitor Data Health

Coverage Tiers

Get Notified

Understand Your Data

Organize & Tag

Guides

Account & Settings

Security

Help

Downloads

Supported Versions & Platforms

Connection Settings

SSL Mode Options

Creating a Read-Only User

For Multiple Databases

Verifying Permissions

Provider-Specific Instructions

Amazon RDS MySQL

Amazon Aurora MySQL

PlanetScale

Self-Hosted MySQL

Google Cloud SQL for MySQL

DigitalOcean Managed MySQL

What We Query

Excluded Schemas

Troubleshooting

Common Questions

Which MySQL versions and managed services does AnomalyArmor support?

Does MySQL 5.7 have any monitoring limitations compared to 8.0?

Can AnomalyArmor monitor PlanetScale branches?

How should I configure SSL for RDS MySQL?

Does AnomalyArmor read MySQL binlogs?

Next Steps

Run Discovery

Set Up Alerts

Getting Started

Core Concepts

Data Sources

Detect Schema Changes

Monitor Data Health

Coverage Tiers

Get Notified

Understand Your Data

Organize & Tag

Guides

Account & Settings

Security

Help

Downloads

Documentation Index

​Supported Versions & Platforms

​Connection Settings

​SSL Mode Options

​Creating a Read-Only User

​For Multiple Databases

​Verifying Permissions

​Provider-Specific Instructions

​Amazon RDS MySQL

​Amazon Aurora MySQL

​PlanetScale

​Self-Hosted MySQL

​Google Cloud SQL for MySQL

​DigitalOcean Managed MySQL

​What We Query

​Excluded Schemas

​Troubleshooting

​Common Questions

​Which MySQL versions and managed services does AnomalyArmor support?

​Does MySQL 5.7 have any monitoring limitations compared to 8.0?

​Can AnomalyArmor monitor PlanetScale branches?

​How should I configure SSL for RDS MySQL?

​Does AnomalyArmor read MySQL binlogs?

​Next Steps

Run Discovery

Set Up Alerts

Supported Versions & Platforms

Connection Settings

SSL Mode Options

Creating a Read-Only User

For Multiple Databases

Verifying Permissions

Provider-Specific Instructions

Amazon RDS MySQL

Amazon Aurora MySQL

PlanetScale

Self-Hosted MySQL

Google Cloud SQL for MySQL

DigitalOcean Managed MySQL

What We Query

Excluded Schemas

Troubleshooting

Common Questions

Which MySQL versions and managed services does AnomalyArmor support?

Does MySQL 5.7 have any monitoring limitations compared to 8.0?

Can AnomalyArmor monitor PlanetScale branches?

How should I configure SSL for RDS MySQL?

Does AnomalyArmor read MySQL binlogs?

Next Steps