MySQL Migration in Federal Government¶

Azure MySQL in Government regions, FedRAMP authorization, IL compliance, data residency requirements, encryption mandates, private connectivity in Azure Government, and CSA-in-a-Box integration for federal analytics.

MySQL is widely deployed across federal agencies for web applications, content management systems, custom line-of-business applications, and supporting databases for larger enterprise systems. While MySQL does not carry the same licensing audit exposure as Oracle Database, federal organizations running self-hosted MySQL face significant operational compliance burdens -- patching timelines mandated by BOD 22-01, continuous monitoring requirements, and authorization boundaries that must be documented and maintained. Azure Database for MySQL Flexible Server in Azure Government regions inherits FedRAMP High authorization, simplifying compliance while eliminating operational overhead.

1. Federal MySQL footprint¶

1.1 MySQL across federal agencies¶

1.2 Common federal MySQL patterns¶

2. Compliance and authorization¶

2.1 Azure database services in Government regions¶

2.2 Government region availability¶

Azure Government operates in physically isolated data centers:

2.3 FedRAMP inheritance¶

When you deploy Azure Database for MySQL Flexible Server in an Azure Government region, you inherit Azure's FedRAMP High authorization. This means:

3. Data residency requirements¶

3.1 Data residency by classification¶

3.2 Data residency configuration¶

# Create MySQL Flexible Server in Government region
az mysql flexible-server create \
  --resource-group rg-mysql-federal \
  --name federal-mysql-server \
  --location usgovvirginia \
  --sku-name Standard_D8ds_v4 \
  --tier GeneralPurpose \
  --storage-size 512 \
  --version 8.0-lts \
  --admin-user federaladmin \
  --admin-password 'FederalSecure$2026!' \
  --high-availability ZoneRedundant \
  --geo-redundant-backup Enabled \
  --yes

# Verify region
az mysql flexible-server show \
  --resource-group rg-mysql-federal \
  --name federal-mysql-server \
  --query location
# Expected: usgovvirginia

4. Encryption requirements¶

4.1 FIPS 140-2 compliance¶

Azure Government regions use FIPS 140-2 validated cryptographic modules for all encryption operations:

4.2 Customer-managed keys for federal workloads¶

Federal agencies often require customer-managed encryption keys (CMK) for data sovereignty:

# Create Key Vault in Government region
az keyvault create \
  --name federal-mysql-kv \
  --resource-group rg-mysql-federal \
  --location usgovvirginia \
  --sku premium \
  --enable-purge-protection true \
  --retention-days 90

# Create RSA key for MySQL encryption
az keyvault key create \
  --vault-name federal-mysql-kv \
  --name mysql-cmk \
  --kty RSA \
  --size 2048

# Create managed identity for MySQL server
az identity create \
  --resource-group rg-mysql-federal \
  --name mysql-identity \
  --location usgovvirginia

# Grant Key Vault access
az keyvault set-policy \
  --name federal-mysql-kv \
  --object-id <identity-principal-id> \
  --key-permissions get unwrapKey wrapKey

# Configure CMK on MySQL server
az mysql flexible-server update \
  --resource-group rg-mysql-federal \
  --name federal-mysql-server \
  --key <key-resource-id> \
  --identity mysql-identity

4.3 For IL5 / classified adjacent workloads¶

5. Private connectivity in Government¶

5.1 Network architecture for federal MySQL¶

flowchart TB
    subgraph OnPrem["Agency On-Premises"]
        APP_SRC[Application Servers]
        MYSQL_SRC[MySQL Source Servers]
    end

    subgraph AzGov["Azure Government Region"]
        subgraph VNet["Virtual Network"]
            subgraph AppSubnet["Application Subnet"]
                APP_AZ[Application VMs / AKS]
            end
            subgraph DBSubnet["Database Subnet (Delegated)"]
                MYSQL_AZ[Azure MySQL Flexible Server]
            end
            subgraph PESubnet["Private Endpoint Subnet"]
                PE[Private Endpoints]
            end
        end
        KV[Azure Key Vault]
        MON[Azure Monitor / Log Analytics]
    end

    subgraph CSA["CSA-in-a-Box"]
        FAB[Microsoft Fabric]
        PURV[Microsoft Purview]
    end

    APP_SRC -->|ExpressRoute / VPN| APP_AZ
    MYSQL_SRC -->|DMS via ExpressRoute| MYSQL_AZ
    APP_AZ --> MYSQL_AZ
    MYSQL_AZ --> KV
    MYSQL_AZ --> MON
    MYSQL_AZ -->|Fabric Mirroring| FAB
    FAB --> PURV

5.2 ExpressRoute for migration¶

For federal agencies migrating from on-premises MySQL, ExpressRoute provides a dedicated, private connection to Azure Government:

# Configure ExpressRoute circuit (example)
az network express-route create \
  --resource-group rg-mysql-federal \
  --name federal-expressroute \
  --location usgovvirginia \
  --bandwidth 1000 \
  --peering-location "Washington DC" \
  --provider "Equinix" \
  --sku-family MeteredData \
  --sku-tier Standard

# Peer VNet to ExpressRoute
az network vnet-gateway create \
  --resource-group rg-mysql-federal \
  --name federal-vnet-gw \
  --vnet federal-vnet \
  --gateway-type ExpressRoute \
  --sku Standard

5.3 Zero-trust networking¶

# Deploy MySQL in a delegated subnet (no public access)
az mysql flexible-server create \
  --resource-group rg-mysql-federal \
  --name federal-mysql-server \
  --location usgovvirginia \
  --vnet federal-vnet \
  --subnet mysql-subnet \
  --private-dns-zone federal-mysql-dns.private.mysql.database.azure.com \
  --public-access Disabled

# Verify no public access
az mysql flexible-server show \
  --resource-group rg-mysql-federal \
  --name federal-mysql-server \
  --query "network.publicNetworkAccess"
# Expected: Disabled

6. Continuous monitoring and BOD compliance¶

6.1 BOD 22-01 (vulnerability patching)¶

CISA Binding Operational Directive 22-01 requires federal agencies to remediate known exploited vulnerabilities within specified timeframes. Azure MySQL Flexible Server addresses this through automated patching:

6.2 Continuous diagnostics and mitigation (CDM)¶

# Configure diagnostic settings for CDM compliance
az monitor diagnostic-settings create \
  --resource /subscriptions/<sub>/resourceGroups/rg-mysql-federal/providers/Microsoft.DBforMySQL/flexibleServers/federal-mysql-server \
  --name MySQLDiagnostics \
  --workspace <log-analytics-workspace-id> \
  --logs '[
    {"category": "MySqlAuditLogs", "enabled": true, "retentionPolicy": {"enabled": true, "days": 365}},
    {"category": "MySqlSlowLogs", "enabled": true, "retentionPolicy": {"enabled": true, "days": 90}}
  ]' \
  --metrics '[
    {"category": "AllMetrics", "enabled": true, "retentionPolicy": {"enabled": true, "days": 90}}
  ]'

6.3 Azure Policy for compliance enforcement¶

# Assign policy: MySQL should use private link
az policy assignment create \
  --name "mysql-private-link" \
  --scope "/subscriptions/<sub>/resourceGroups/rg-mysql-federal" \
  --policy "d9844e8a-1437-4aeb-a32c-0c992f056095"

# Assign policy: MySQL should use CMK encryption
az policy assignment create \
  --name "mysql-cmk-encryption" \
  --scope "/subscriptions/<sub>/resourceGroups/rg-mysql-federal" \
  --policy "83cef61d-dbd1-4b20-a4fc-5fbc7da10833"

7. Federal migration checklist¶

• Verify target Azure Government region supports required IL level
• Confirm FedRAMP High authorization inheritance for Azure MySQL Flexible Server
• Document SSP (System Security Plan) changes for ATO update
• Configure customer-managed encryption keys in Azure Key Vault
• Deploy MySQL in delegated VNet subnet (no public access)
• Configure ExpressRoute or VPN for on-premises connectivity
• Enable audit logging with 365-day retention
• Configure Azure Defender for MySQL
• Set up diagnostic settings for CDM compliance
• Apply Azure Policy for compliance enforcement
• Migrate users to Entra ID authentication (phase out MySQL passwords)
• Configure FIPS 140-2 validated encryption (automatic in Gov regions)
• Test DR procedures (point-in-time restore, geo-restore)
• Update ATO documentation with new system boundary
• Brief ISSM/ISSO on architecture changes

8. CSA-in-a-Box integration in Government¶

CSA-in-a-Box deployment in Azure Government regions provides the same analytics, governance, and AI capabilities as commercial Azure, within the FedRAMP High boundary:

Next: Benchmarks | Best Practices | Security Migration

Maintainers: csa-inabox core team Last updated: 2026-04-30