open-vault/website/content/docs/configuration/storage/mysql.mdx

---
layout: docs
page_title: MySQL - Storage Backends - Configuration
description: |-
  The MySQL storage backend is used to persist Vault's data in a MySQL server or
  cluster.
---

# MySQL Storage Backend

The MySQL storage backend is used to persist Vault's data in a [MySQL][mysql]
server or cluster.

- **High Availability** – the MySQL storage backend supports high availability.
  Note that due to the way mysql locking functions work they are lost if a connection
  dies. If you would like to not have frequent changes in your elected leader you
  can increase interactive_timeout and wait_timeout MySQL config to much higher than
  default which is set at 8 hours.

- **Community Supported** – the MySQL storage backend is supported by the
  community. While it has undergone review by HashiCorp employees, they may not
  be as knowledgeable about the technology. If you encounter problems with them,
  you may be referred to the original author.

```hcl
storage "mysql" {
  username = "user1234"
  password = "secret123!"
  database = "vault"
}
```

## `mysql` Parameters

- `address` `(string: "127.0.0.1:3306")` – Specifies the address of the MySQL
  host.

- `database` `(string: "vault")` – Specifies the name of the database. If the
  database does not exist, Vault will attempt to create it.

- `table` `(string: "vault")` – Specifies the name of the table. If the table
  does not exist, Vault will attempt to create it.

- `tls_ca_file` `(string: "")` – Specifies the path to the CA certificate to
  connect using TLS.

- `plaintext_credentials_transmission` `(string: "")` - Provides authorization
  to send credentials over plaintext. Failure to provide a value AND a failure
  to provide a TLS CA certificate will warn that the credentials are being sent
  over plain text. In the future, failure to do acknowledge or use TLS will
  result in server start being prevented. This will be done to ensure credentials
  are not leaked accidentally.

- `max_parallel` `(string: "128")` – Specifies the maximum number of concurrent
  requests to MySQL.

- `max_idle_connections` `(string: "0")` – Specifies the maximum number of idle
  connections to the database. A zero uses value defaults to 2 idle connections
  and a negative value disables idle connections. If larger than
  `max_parallel` it will be reduced to be equal.

- `max_connection_lifetime` `(string: "0")` – Specifies the maximum amount of
  time in seconds that a connection may be reused. If <= 0s connections are reused forever.

Additionally, Vault requires the following authentication information.

- `username` `(string: <required>)` – Specifies the MySQL username to connect to
  the database.

- `password` `(string: <required>)` – Specifies the MySQL password to connect to
  the database.

### High Availability Parameters

- `ha_enabled` `(string: "true")` - Specifies if high availability mode is
  enabled. This is a boolean value, but it is specified as a string like "true"
  or "false".

- `lock_table` `(string: "vault_lock")` – Specifies the name of the table to
  use for storing high availability information. By default, this is the name
  of the `table` suffixed with `_lock`. If the table does not exist, Vault will
  attempt to create it.

## `mysql` Examples

### Custom Database and Table

This example shows configuring the MySQL backend to use a custom database and
table name.

```hcl
storage "mysql" {
  database = "my-vault"
  table    = "vault-data"
  username = "user1234"
  password = "pass5678"
}
```

[mysql]: https://dev.mysql.com