Description

Manage AWS MySQL privileged accounts. The plug-in will authenticate to an AWS MySQL Instance via ODBC.

Vendor

This platform is designed for remote account management for the following target:

Vendor	Amazon
Product	MySQL
Product Category	Database
Product Versions	8.0.28

CyberArk

This platform works with the following CyberArk versions:

CyberArk Solution	Privileged Credentials Management
CyberArk Product	Central Policy Manager (CPM)
CyberArk Versions	9.x, 10.x, 11.x, 12.x
Artifact Version	1.0
Out of the Box	NO
Out of the Box in versions

Support & Certification

Support Level	STANDARD
Developed by	CyberArk
Certification Level	CERTIFIED
Connection Methods	HTTP/HTTPS

Actions

The following table lists the supported management actions for this platform:

Action	Supported	Permissions
Verify	YES
Change	YES
Reconcile	YES
Delete	NO

Linked Accounts

The following linked accounts are in use by the plugin.

Logon Account

Supported	NO
Required	NO
Platforms
Permissions

Reconcile Account

Supported	YES
Required	NO
Platforms
Permissions

Prerequisites

The following prerequisites are required on the machine that runs this plugin:

MySQL 32-bit ODBC Driver (v3.51) installed on the CPM machine. The ODBC driver can be found within the marketplace. Verify that the firewall rules \ ports are opened to the AWS MySQL instace by testing the ODBC Driver on the CPM machine:

Installation

Import Platform

See Import a platform package topic within CyberArk Docs online.

Configuration

Platform Settings

Specify the following parameters at the platform level:

Parameter Name	Description	Acceptable Values	Default Value
Port	The port used to connect to the AWS MySQL instance	Integer	3306
ConnectionCommand	The ODBC connection string which will include the ODBC Driver and connection details	Yes, No	Driver={MySQL ODBC 8.0 Unicode Driver};SERVER=%ADDRESS%;PORT=%PORT%;DATABASE=%DATABASE%;UID=%USER%;PWD=%LOGONPASSWORD%;
ChangeCommand	The legal SQL statement template that will be used to change the password on the required database.	SQL Statement	alter user %USER% identified by '%NEWPASSWORD%';
ReconcileCommand	The legal SQL statement template that will be used to reconcile the password on the required database.	SQL Statement	alter user %USER% identified by '%NEWPASSWORD%';
Debug	To enable debug logs	Yes, No	No

Note: The change command has changed in the latest version of MySQL (8.x). MySQL's documentation specifically points out that it's preference is that the command uses alter user rather than set password. Documentation can be referenced here - https://dev.mysql.com/doc/refman/8.0/en/set-password.html

Account Settings

Account Mandatory Parameters

Specify the following parameters on the account:

Parameter Name	Description
Username	Username of the target account
Address	Address of the AWS Redshift cluster
Database	The name of the AWS Redshift cluster's Database

AWS MySQL