MySQL¶

Overview¶

Horizon Catalog ingests MySQL metadata via a direct database connection using a dedicated read-only service account. Query logs (used for lineage and popularity) are optional and, for instances on Amazon RDS, come from Amazon CloudWatch via a cross-account IAM role that Horizon Catalog assumes.

Prerequisites¶

• Administrative access to the MySQL instance so you can CREATE USER and GRANT.
• Only if you’ll use the cloudwatch log source: an AWS user with permission to modify RDS parameter groups, the RDS instance, and IAM.
• Open the Horizon Catalog connector in another browser tab. To reach it, sign in to Snowflake, open Catalog > Connections, then pick MySQL from the list.

1. Create a MySQL user for Horizon Catalog¶

Connect as an administrative user and create a dedicated service account. Replace <username> and <password> with real values.

CREATE USER '<username>' IDENTIFIED BY '<password>';
GRANT SELECT ON *.* TO '<username>';
GRANT SHOW VIEW ON *.* TO '<username>';
FLUSH PRIVILEGES;

SELECT lets Horizon Catalog run DESCRIBE, SHOW CREATE TABLE, and INFORMATION_SCHEMA queries to read table structure; SHOW VIEW is required to read view definitions.

2. Ensure network connectivity¶

Horizon Catalog connects to your MySQL instance over the public internet. The instance must be publicly reachable — either set Publicly accessible = Yes on the RDS instance, or place it behind an internet-facing load balancer or proxy you control. Allow inbound TCP on the MySQL port (default 3306).

3. Choose a query-log source¶

• none: Metadata only. Lineage and popularity are disabled; metadata sync still works.
• cloudwatch: The general query log exported to CloudWatch Logs. Follow Query Logs before you finish in the UI.

4. Finish in the Horizon Catalog UI¶

Back in the connector wizard, fill in the Add data source step:

In the Connect query log step, pick None or CloudWatch Logs. For CloudWatch, paste the AWS Region, Role ARN, and Log Group Name Prefix from Query Logs.

In the Select databases step, choose the databases you want Horizon Catalog to crawl.

Initial metadata typically appears within a few minutes; for the cloudwatch source, lineage and popularity fill in as query log history accumulates.

Connection security¶

Horizon Catalog uses a TLS-capable MySQL client. If your instance is configured to accept TLS connections, the connection is encrypted automatically. However, if TLS isn’t available on the server, the connection proceeds unencrypted.

For more details on the shared-responsibility model for Horizon Catalog connectors, see Security and data protection.

Troubleshooting¶