> ## Documentation Index
> Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Scaleway MySQL

> Scaleway Managed Database MySQL instance with configurable node type, storage, backups, and network ACL

Qovery creates it in the Scaleway project of the environment's cluster, as a [Blueprint](https://www.qovery.com/docs/configuration/blueprints.md) service in one of your environments.

| | |
| - | - |
| Catalog name | `scaleway-mysql` |
| Category | Databases & Caches |
| Provider | SCW |
| Engine | terraform |
| Major versions (latest release) | `8` (1.5.2) |
| Source | [SCW/mysql/8](https://github.com/Qovery/service-catalog/tree/SCW/mysql/8/1.5.2/SCW/mysql/8) |

> [!TIP]
>
> **New to this?** You don't need to know Kubernetes or Terraform. Qovery sets up Scaleway MySQL in your cloud account and manages it for you: you fill in a form, or paste the prompt below into your coding agent. The values it publishes, listed under Outputs, reach your other services as environment variables. Qovery tells you when a newer version of the Blueprint is available. Check the requirements in the Reference section before you start, and try it first in a development environment.

## Create it

> [tab] Console
>
> 1. Open the environment, then **New service** › **Blueprint**.
> 2. Find **Scaleway MySQL** in the catalog and pick the major version.
> 3. Fill in the variables. Required ones are marked; the others use their defaults.
> 4. Create the service, and deploy it now or later.

> [tab] CLI and API
>
> List the catalog to get the latest tag, then create the service from it. `qovery api` signs the requests with your CLI session.
>
> ```bash theme={null}
> ORG_ID="REPLACE_WITH_ORGANIZATION_ID"
> ENV_ID="REPLACE_WITH_ENVIRONMENT_ID"
>
> qovery api "organization/$ORG_ID/blueprint/catalog" | jq '.. | objects | select(.name? == "scaleway-mysql")'
>
> cat > blueprint.json <<'EOF'
> {
>   "name": "scaleway-mysql",
>   "tag": "SCW/mysql/8/1.5.2",
>   "icon": "app://qovery-console/mysql",
>   "variables": [
>     {
>       "name": "instance_name",
>       "value": "REPLACE_WITH_INSTANCE_NAME"
>     },
>     {
>       "name": "db_name",
>       "value": "REPLACE_WITH_DB_NAME"
>     },
>     {
>       "name": "node_type",
>       "value": "REPLACE_WITH_NODE_TYPE"
>     },
>     {
>       "name": "volume_size_gb",
>       "value": "REPLACE_WITH_VOLUME_SIZE_GB"
>     }
>   ],
>   "spec_overrides": {
>     "engine_version": "1.9.7"
>   }
> }
> EOF
> BLUEPRINT_ID=$(qovery api "environment/$ENV_ID/blueprint" --method POST --input - < blueprint.json | jq -r .id)
> rm blueprint.json   # it can hold secret values
> qovery api "blueprint/$BLUEPRINT_ID/deploy" --method POST
> qovery api "blueprint/$BLUEPRINT_ID"   # status of the latest deployment
> ```
>
> Replace each `REPLACE_WITH_` value. Add optional variables to `variables` the same way.

> [tab] Coding agent
>
> Paste this into Claude Code, Cursor, Codex or another coding agent with the [Qovery agent skills](https://www.qovery.com/docs/getting-started/quickstart/agent-skills.md) installed (`curl -fsSL https://skill.qovery.com/install.sh | bash`).
>
> ```text Prompt wrap theme={null}
> Add the Qovery Blueprint Scaleway MySQL (scaleway-mysql) to one of my Qovery environments and deploy it. Ask me for instance_name, db_name, node_type and volume_size_gb.
> Ask me before deploying to a production environment.
> Docs: https://www.qovery.com/docs/configuration/blueprints/scaleway-mysql.md
> ```

You don't add any file to your repository. Qovery creates the Blueprint from the Console or the API.

## Variables and outputs

Generated from `qbm.yml` at `SCW/mysql/8/1.5.2`, the manifest the Console form is built from.

> [accordion] All 13 variables
>
> | Name | Type | Required | Default | Secret | Description |
> | - | - | - | - | - | - |
> | `instance_name` | string | Yes | | | Letters, digits, hyphens, underscores; must start with a letter or digit; max 100 chars. |
> | `db_name` | string | Yes | | | Letters, digits, underscores; must start with a letter; max 64 chars. No hyphens. |
> | `db_username` | string | | | | Leave empty to use qoveryadmin. Letters, digits, underscores, starting with a letter, max 32; not rdb\_admin or mysql. |
> | `db_password` | string | | | Yes | Leave empty and Qovery generates a 32-character password. To set your own: 8–128 chars, must not contain /, @, ", or spaces. |
> | `engine_version` | string | | `MySQL-8` | | MySQL engine version |
> | `node_type` | string | Yes | `DB-DEV-S` | | Scaleway node type |
> | `volume_type` | string | | `lssd` | | Volume backend type (lssd = local SSD; sbs\_5k/sbs\_15k = block SSD at 5k/15k IOPS) |
> | `volume_size_gb` | number | Yes | `5` | | GB, 5–10000 |
> | `is_ha_cluster` | bool | | `false` | | Enable high availability cluster mode |
> | `activate_backups` | bool | | `true` | | Enable automated backups |
> | `slow_query_log` | bool | | `true` | | Enable MySQL slow query log via the instance settings |
> | `publicly_accessible` | bool | | `false` | | Expose a public endpoint open to acl\_allowed\_cidr. Turning it off later keeps the endpoint: delete it in the Scaleway console. |
> | `acl_allowed_cidr` | string | | `0.0.0.0/0` | | Single CIDR, only used when publicly\_accessible is true, and then not 0.0.0.0/0. Use the Scaleway console for multi-CIDR allowlists. |

Outputs become environment variables that other services in the environment can use. By default Qovery also creates an alias for each output, prefixed with the Blueprint's name; see [Aliases Qovery creates for outputs](https://www.qovery.com/docs/configuration/environment-variables.md#aliases-qovery-creates-for-outputs) for the naming rules and the cases where no alias is created.

> [accordion] All 9 outputs
>
> | Name | Secret | Description |
> | - | - | - |
> | `endpoint_ip` | | Public endpoint IP when publicly\_accessible, else the private network one |
> | `endpoint_port` | | Public endpoint port when publicly\_accessible, else the private network one |
> | `private_endpoint_ip` | | Database IP on the cluster's private network |
> | `private_endpoint_port` | | Database port on the cluster's private network |
> | `db_name` | | Database name |
> | `db_username` | | Database username |
> | `db_password` | Yes | Database user password (generated when the input was left empty) |
> | `instance_id` | | Scaleway RDB instance ID |
> | `certificate` | Yes | TLS CA certificate served by the database (PEM). Use for verify-full SSL. |

> [!WARNING]
>
> Secret variables and outputs are encrypted and masked in Qovery, but Terraform can also keep their values, and values derived from them, in its state. With the Qovery-managed state backend (the default), Qovery stores the state. If you use your own backend, protect it and keep state files out of version control.

## Reference

From the Blueprint's [README](https://github.com/Qovery/service-catalog/blob/SCW/mysql/8/1.5.2/SCW/mysql/8/README.md).

Creates a Scaleway Managed Database for MySQL with a database and admin user. Supports configurable node type, storage, backups, slow query logging, HA cluster mode, and an optional network ACL.

The Scaleway instance name is composed as `{cluster_name}-{instance_name}`.

### Migration from 1.0.x

`1.1.0` drops the standalone `scaleway_rdb_user.this` resource — the admin user is now created via `user_name`/`password` on `scaleway_rdb_instance` (the canonical Scaleway provider pattern). For existing deployments at `1.0.x`, run once before upgrading:

```sh theme={null}
terraform state rm scaleway_rdb_user.this
```

This removes the resource from state without touching the user in Scaleway; the instance then takes ownership on the next apply.

### Networking

The instance is always attached to the private network of the Qovery cluster, read from the
Kapsule cluster `qovery-<cluster short id>`. Applications in the cluster reach it there. With
`publicly_accessible`, a public endpoint filtered by `acl_allowed_cidr` is added. Public access
needs a narrower CIDR than the `0.0.0.0/0` default, which validation rejects in public mode.

### Upgrading to 1.5.0

Before 1.5.0, `publicly_accessible = false` did not make the instance private: Scaleway created
a public endpoint anyway, with its default ACL open to `0.0.0.0/0`. Upgrading an existing
instance attaches it to the private network and points `endpoint_ip` / `endpoint_port` at the
private endpoint, but the old public endpoint stays, because the provider never removes it once
the `load_balancer` block is gone. Delete that endpoint in the Scaleway console once the
applications use the private one.

### Variables

#### Required

| Name | Type | Sensitive | Description |
| - | - | - | - |
| `instance_name` | string | | Instance name suffix. Letters, digits, hyphens, underscores; must start with a letter or digit; max 100 chars. |
| `db_name` | string | | MySQL database name. Letters, digits, underscores only; must start with a letter; max 64 chars. Hyphens are not allowed. |
| `node_type` | string | | Scaleway node type (e.g. `DB-DEV-S`, `DB-GP-XS`). Default suggestion: `DB-DEV-S`. |
| `volume_size_gb` | number | | Volume size in GB (min 5, max 10000). Default suggestion: `5`. |

#### Credentials

Both are optional — omit them and Qovery supplies the values, the way native managed
databases did. In the console, leaving the field blank omits it. Through the API or
Terraform, omit the variable rather than sending an empty string: the platform rejects an
empty variable value.

| Name | Type | Sensitive | Default | Description |
| - | - | - | - | - |
| `db_username` | string | | `qoveryadmin` | Leave empty to use qoveryadmin, the login used by native managed databases. To set your own: letters, digits, underscores; must start with a letter; max 32 chars (MySQL limit). Reserved names not allowed: rdb\_admin, mysql. |
| `db_password` | string | yes | *generated* | Omit and Qovery generates a 32-character password. To set your own: 8–128 chars, must not contain /, @, ", or spaces. |

#### Engine & sizing

| Name | Type | Default | Description |
| - | - | - | - |
| `engine_version` | string | `MySQL-8` | Engine version. |
| `volume_type` | string | `lssd` | Volume backend: `lssd` (local SSD) or `bssd` (block SSD). |
| `is_ha_cluster` | bool | `false` | Enable HA cluster mode (multi-node, automatic failover). |

#### Backups, logging & ACL

| Name | Type | Default | Description |
| - | - | - | - |
| `activate_backups` | bool | `true` | Enable automated backups. |
| `slow_query_log` | bool | `true` | Enable MySQL slow query log via the instance settings. |
| `publicly_accessible` | bool | `false` | Open the database to traffic from `acl_allowed_cidr` through a public endpoint. When false, a new database has no public endpoint and is reachable only from the cluster's private network. Turning it off on an existing database keeps its public endpoint: delete it in the Scaleway console (see [Upgrading to 1.5.0](#upgrading-to-150)). |
| `acl_allowed_cidr` | string | `0.0.0.0/0` | Single CIDR allowed to reach the instance. Only used when `publicly_accessible` is true; must not be 0.0.0.0/0 when public. Use the console for multi-CIDR allowlists. |

### Outputs

| Name | Sensitive | Description |
| - | - | - |
| `endpoint_ip` | | Database endpoint IP: the public endpoint when `publicly_accessible`, else the private network endpoint |
| `endpoint_port` | | Database endpoint port: the public endpoint when `publicly_accessible`, else the private network endpoint |
| `private_endpoint_ip` | | Database IP on the cluster's private network |
| `private_endpoint_port` | | Database port on the cluster's private network |
| `db_name` | | Database name |
| `db_username` | | Database username |
| `db_password` | yes | Database user password (generated when the input was left empty) |
| `instance_id` | | Scaleway RDB instance ID |
| `certificate` | yes | TLS CA certificate served by the database (PEM, verify-full SSL) |

### Required Scaleway IAM permissions

Scaleway IAM permissions are granted via **permission sets** on a policy attached to the application/user whose API key is used.

Attach a policy with the following permission sets, scoped to the target Project:

| Permission set | Why |
| - | - |
| `RelationalDatabasesFullAccess` | Create / read / update / delete RDB instance, database, user, ACL. |
| `PrivateNetworksFullAccess` | Attach the instance to the cluster's private network. |
| `KubernetesReadOnly` | Read the cluster's private network id. |
| `ProjectReadOnly` | Resolve the project context for the API call. |

The minimum scope is the Project where Qovery deploys this blueprint.


## Related topics

- [Blueprints](https://www.qovery.com/docs/configuration/blueprints.md)
- [Databases](https://www.qovery.com/docs/configuration/database.md)
- [Scaleway IAM Permissions Reference](https://www.qovery.com/docs/getting-started/security-and-compliance/scaleway-iam-permissions.md)
- [Amazon RDS for MySQL](https://www.qovery.com/docs/configuration/blueprints/aws-rds-mysql.md)
- [Scaleway Container Registry](https://www.qovery.com/docs/configuration/integrations/container-registries/scaleway-cr.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.