[Yandex Cloud documentation](../../../index.md) > [Yandex Managed Service for MySQL®](../../index.md) > [Step-by-step guides](../index.md) > [Connection](index.md) > Connecting from applications

# Connecting to a MySQL® cluster from applications

This section provides settings for connection to Managed Service for MySQL® cluster hosts with the help of [command line tools](#command-line-tools), [graphical IDEs](#connection-ide), [Yandex WebSQL](#websql), or a [Docker container](#connection-docker). To learn how to connect from your application code, see [Code examples](code-examples.md).

## Command line tools {#command-line-tools}

To see code examples with the host FQDN filled in, open the cluster page in the [management console](https://console.yandex.cloud) and click **Connect**.

### Linux (Bash)/macOS (Zsh) {#bash-zsh}

Before connecting, install the `mysql` utility:

```bash
sudo apt update && sudo apt install --yes mysql-client
```

{% list tabs group=connection %}

- Connecting with SSL {#with-ssl}

  ```bash
  mysql --host=<MySQL®_host_name>.mdb.yandexcloud.net \
        --port=3306 \
        --ssl-ca=~/.mysql/root.crt \
        --ssl-mode=VERIFY_IDENTITY \
        --user=<username> \
        --password \
        <DB_name>
  ```

- Connecting without SSL {#without-ssl}

  ```bash
  mysql --host=<FQDN_of_any_MySQL®_host> \
        --port=3306 \
        --ssl-mode=DISABLED \
        --user=<username> \
        --password \
        <DB_name>
  ```

{% endlist %}

To learn how to get a host's FQDN, see [this guide](fqdn.md).

When running any command, enter the database user password.

Once connected to the DBMS, run the `SELECT version();` command.

If your cluster connection and test query are successful, you will see the MySQL® version.

### Windows (PowerShell) {#powershell}

Before connecting, [download](https://dev.mysql.com/downloads/shell/) and install `MySQL Shell`.

{% list tabs group=connection %}

- Connecting with SSL {#with-ssl}

  ```PowerShell
  mysqlsh --host=<FQDN_of_any_MySQL®_host> `
          --port=3306 `
          --ssl-ca=<absolute_path_to_certificate_file> `
          --ssl-mode=VERIFY_IDENTITY `
          --user=<username> `
          --password `
          --database=<DB_name> `
          --sql
  ```

- Connecting without SSL {#without-ssl}

  ```PowerShell
  mysqlsh --host=<FQDN_of_any_MySQL®_host> `
          --port=3306 `
          --ssl-mode=DISABLED `
          --user=<username> `
          --password `
          --database=<DB_name>
  ```

{% endlist %}

To learn how to get a host's FQDN, see [this guide](fqdn.md).

When running any command, enter the database user password.

Once connected to the DBMS, run the `SELECT version();` command.

If your cluster connection and test query are successful, you will see the MySQL® version.


### Connecting with IAM authentication {#iam}

You can connect to a Managed Service for MySQL® database via the [Yandex Cloud CLI](../../../cli/quickstart.md#install) using IAM authentication. This method is available to [Yandex accounts](../../../iam/concepts/users/accounts.md#passport), [federated accounts](../../../iam/concepts/users/accounts.md#saml-federation), and [local users](../../../iam/concepts/users/accounts.md#local). When connecting with IAM authentication, you do not need to obtain an SSL certificate or specify the cluster hosts’ FQDNs.

Before connecting:

1. If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. Install the MySQL® client:

    ```bash
    sudo apt update && sudo apt install --yes mysql-client
    ```

Set up your Managed Service for MySQL® cluster for connection:

{% list tabs group=instructions %}

- Management console {#console}

  1. Navigate to **Managed Service for&nbsp;MySQL**.
  1. Click the cluster name.
  1. Enable public access for the cluster hosts:
     1. Select the **Hosts** tab.
     1. Click ![image](../../../_assets/console-icons/ellipsis.svg) in the first host's row and select **Edit**.
     1. Enable **Public access**.
     1. Repeat the same for the remaining hosts in the cluster.
  1. Assign the `managed-mysql.clusters.connector` role to the user account that will connect to the database:
     1. Select the **Access bindings** tab and click **Assign roles**.
     1. Enter the user account’s email.
     1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the `managed-mysql.clusters.connector` role.
     1. Click **Save**.
  1. Create a user named MySQL®:
     1. Select the **Users** tab.
     1. Click **Create user**.
     1. Select **IAM** as the authentication method.
     1. Select the account with the `managed-mysql.clusters.connector` role.
     1. Click **Add database** and select the database from the drop-down list.
     1. Click ![image](../../../_assets/console-icons/plus.svg) in the **Roles** column and select privileges from the drop-down list.
     1. Click **Create**.

{% endlist %}

To connect to the Managed Service for MySQL® database, run this command:

```bash
yc managed-mysql connect <cluster_name_or_ID> --db <DB_name>
```

You can get the cluster name and ID with the [list of clusters in the folder](../cluster-list.md#list-clusters).


## Connecting from graphical IDEs {#connection-ide}

**Connections were tested in the following environment:**

* Ubuntu 20.04, DBeaver: `22.2.4`
* MacOS Monterey 12.7:
   * JetBrains DataGrip: `2023.3.4`
   * DBeaver Community: `24.0.0`


From graphical IDEs, you can only connect to public cluster hosts using an SSL certificate.


To avoid connection errors, [save the certificate](https://storage.yandexcloud.net/cloud-certs/RootCA.pem) to a local folder that does not require administrator rights to access.

{% list tabs group=ide %}

- DataGrip {#datagrip}

  1. Create a data source:
     1. Select **File** → **New** → **Data Source** → **MySQL®**.
     1. On the **General** tab:
        1. Configure the connection as follows:
           * **Host**: [FQDN of any MySQL® host](fqdn.md) or a [special FQDN](fqdn.md#fqdn-master).
           * **Port**: `3306`.
           * **User**, **Password**: Database user name and password.
           * **Database**: Name of the database to connect to.
        1. Click **Download** to download the connection driver.
     1. On the **SSH/SSL** tab:
         1. Enable **Use SSL**.
         1. In the **CA file** field, specify the path to the [SSL certificate file for your connection](fqdn.md#get-ssl-cert).
  1. Click **Test Connection**. If the connection is successful, you will see the connection status, DBMS information, and driver details.
  1. Click **OK** to save the data source.

- DBeaver {#dbeaver}

  1. Create a new DB connection:
     1. In the **Database** menu, select **New connection**.
     1. Select **MySQL®** from the DB list.
     1. Click **Next**.
     1. Specify the connection settings on the **Main** tab:
        * **Server host**: [FQDN of any MySQL® host](fqdn.md#fqdn) or a [special FQDN](fqdn.md#fqdn-master).
        * **Port**: `3306`.
        * **Database**: Target database name.
        * **Username**, **Password**: Database user name and password.
     1. On the **SSL** tab:
         1. Enable **Use SSL**.
         1. In the **CA certificate** field, specify the path to the [SSL certificate](index.md#get-ssl-cert) file you previously saved.
         1. Under **Advanced**:
            1. Enable **Require SSL**.
            1. Enable **Verify server certificate**.
  1. Click **Test Connection ...**. If the connection is successful, you will see the connection status, DBMS information, and driver details.
  1. Click **Done** to save the database connection settings.

{% endlist %}

### Connecting with IAM authentication {#ide-iam}

To connect to a Managed Service for MySQL® database from graphical IDEs with [Yandex Identity and Access Management authentication](../../../iam/index.md), run the [Yandex Cloud CLI](../../../cli/index.md) in listening proxy server mode.

This type of connection is available to [Yandex accounts](../../../iam/concepts/users/accounts.md#passport), [federated accounts](../../../iam/concepts/users/accounts.md#saml-federation), and [local users](../../../iam/concepts/users/accounts.md#local). When connecting this way, you do not need to get an SSL certificate or specify the cluster hosts' FQDNs.

You can only use graphical IDEs to connect to publicly accessible cluster hosts.

To connect to a Managed Service for MySQL® database:

1. Assign the `managed-mysql.clusters.connector` role to the user account that will connect to the database:

    1. Navigate to **Managed Service for&nbsp;MySQL**.
    1. Click the cluster name.
    1. Select the **Access bindings** tab and click **Assign roles**.
    1. Enter the user account’s email.
    1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the `managed-mysql.clusters.connector` role.
    1. Click **Save**.

1. Create a user named MySQL®:

    1. Select the **Users** tab.
    1. Click **Create user**.
    1. Select **IAM** as the authentication method.
    1. Select the account with the `managed-mysql.clusters.connector` role.
    1. Click **Add database** and select the database from the drop-down list.
    1. Click ![image](../../../_assets/console-icons/plus.svg) in the **Roles** column and select privileges from the drop-down list.
    1. Click **Create**.

1. Start the Yandex Cloud CLI in proxy server mode:

    1. If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

        The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    1. Run this command:

        ```bash
        yc managed-mysql connect <cluster_name_or_ID> --db <DB_name> --daemon
        ```

        This will start a proxy server on port `3306`. To select a different port, specify `--port <port_number>` in the command.

        You can get the cluster name and ID with the [list of clusters in the folder](../cluster-list.md#list-clusters).

1. Connect to the Managed Service for MySQL® cluster:

    {% list tabs group=ide %}

    - DBeaver {#dbeaver}

        1. Create a new DB connection:
            1. In the **Database** menu, select **New connection**.
            1. Select **MySQL®** from the DB list.
            1. Click **Next**.
            1. Specify the connection settings on the **Main** tab:
                * **Server**: `localhost`.
                * **Port**: `3306` or any other port you specified when starting the proxy server.
                * **Database**: DB to connect to.
                * **Username**: Your account's login or email address.
                * **Password**: Leave this field empty.
        1. Click **Test Connection ...**. If the connection is successful, you will see the connection status, DBMS information, and driver details.
        1. Click **Done** to save the database connection settings.

    - MySQL® Workbench {#mysql-workbench}

        1. Create a new database connection:
            1. In the **Database** menu, select **Manage connections...**.
            1. Click **New**.
            1. Specify the following connection settings on the **Connection** tab:
                * **Hostname**: `127.0.0.1`.
                * **Port**: `3306` or any other port you specified when starting the proxy server.
                * **Username**: Your account's login or email address.
                * **Default schema**: Name of the database to connect to.
                * **SSL** → **Use SSL**: `No`.
        1. Click **Test Connection**. If the connection is successful, you will see its details.

    {% endlist %}


## Connecting from Yandex WebSQL {#websql}

You can use [Yandex WebSQL](../../../websql/index.md) to send SQL queries to Managed Service for MySQL® cluster databases.

WebSQL is a Yandex Cloud service that allows you to connect to managed database clusters, work with databases, tables, and schemas, and run queries. This service runs in the browser, requires no extra login, and simplifies work by providing hints for SQL commands.

To connect to a cluster from WebSQL, you must enable the **WebSQL access** option in the cluster settings. You can enable it when [creating](../cluster-create.md) or [updating](../update.md#change-additional-settings) a cluster.

The Managed Service for MySQL® cluster automatically creates a [Connection Manager](../../../metadata-hub/concepts/connection-manager.md) connection for each database user, enabling database access from WebSQL. You can also [create a new connection](../../../websql/operations/create-connection.md#connect-cluster) if needed.

To connect to the database from WebSQL:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder containing your cluster.
  1. Navigate to **Managed Service for&nbsp;MySQL**.
  1. Click the cluster name and navigate to the **WebSQL** tab.
  1. Select the required connection.

      The connection will open in WebSQL. To open the query editor, select the required database.

      Check [this MySQL®](https://dev.mysql.com/doc/refman/9.0/en/sql-statements.html) reference for supported queries.
    
{% endlist %}

For more information on WebSQL, see [this guide](../../../websql/operations/index.md).



## Before you connect from a Docker container {#connection-docker}

To connect to a Managed Service for MySQL® cluster from a Docker container, add the following lines to the Dockerfile:

{% list tabs group=connection %}


- Connecting without SSL {#without-ssl}

  ```bash
  RUN apt-get update && \
      apt-get install mysql-client --yes
  ```


- Connecting with SSL {#with-ssl}

  ```bash
  RUN apt-get update && \
      apt-get install wget mysql-client --yes && \
      mkdir --parents ~/.mysql && \
      wget "https://storage.yandexcloud.net/cloud-certs/CA.pem" \
           --output-document ~/.mysql/root.crt && \
      chmod 0600 ~/.mysql/root.crt
  ```

{% endlist %}