Manage MySQL users & grants with Puppet

Puppet manages users and privileges through the official puppetlabs-mysql module, which provides the mysql::db defined type and mysql_user / mysql_grant resources. It can manage much more than users, so read the docs for every option.

Create a user with SELECT and UPDATE privileges

mysql::db { 'mydb':
  user     => 'myuser',
  password => 'mypass',
  host     => 'localhost',
  grant    => ['SELECT', 'UPDATE'],
}

Use a pre-hashed password

Avoid committing plaintext by supplying an already-hashed password:

mysql::db { 'mydb':
  user     => 'myuser',
  password => '*6C8989366EAF75BB670AD8EA7A7FC1176A95CEF4',
  host     => 'localhost',
  grant    => ['SELECT', 'UPDATE'],
}

Why Puppet for MySQL users & grants?

Puppet is a declarative configuration-management tool: you describe the desired state and Puppet's agent continuously enforces it. Key benefits for managing database access include:

Centralized control — all nodes managed from one source of truth, keeping access consistent.
Idempotence — manifests converge to the declared users and grants without duplication.
Automation — removes manual, error-prone GRANT statements run by hand.
Auditability — every access change is version-controlled and reviewable.
Scale — the same manifests apply cleanly across large fleets.

Store secrets with Hiera + eyaml rather than in plain manifests.

Generate the raw SQL instead →