You’ve probably already read the pitch on MySQL HeatWave — transactions, real-time analytics, ML, all in one place. Fine. But none of that matters until you can actually get one running. So that’s what this is: a walkthrough from a bare OCI tenancy to a working database you can query.
I’ll be upfront — there are a few steps here that trip people up the first time, and I’ll flag them as we go.
What You’re Actually Provisioning
MySQL HeatWave is OCI’s managed MySQL service (officially “MDS”) with an in-memory accelerator attached to it. That’s the short version. The longer version is that instead of running OLTP on MySQL and shipping data somewhere else for analytics, both happen on the same engine, same data, no copy step.
What you get out of the box: managed operations, enterprise security, automated backup and recovery, real-time analytics, ML that lives inside the database instead of some external notebook, automated tuning, and OCI integration that doesn’t feel bolted on. It’s a long list. Most of it you won’t appreciate until the third time you’re not paged at 2am for a failed backup job.
The Pieces, Before You Touch the Console
Worth knowing what’s underneath before you start clicking.
Oracle provisions dedicated compute for the MySQL Enterprise Server. It runs on Oracle Linux — not a stripped-down image, an actual enterprise-supported OS. And it’s Enterprise Edition, not Community, which a lot of competing “managed MySQL” offerings quietly aren’t. That distinction matters more than it sounds; Enterprise Edition is where the real security tooling lives. The system connects through a VNIC into your VCN, and everything — data files, redo logs, backups, temp space — sits on block storage tuned for database I/O.
Before You Provision Anything
Skip this part and your deployment will fail halfway through, usually with an error message that doesn’t tell you it’s a permissions problem.
You need an OCI account, a tenancy, console access — obvious stuff. Less obvious: create a dedicated compartment for your database workloads before you start. It costs you two minutes now and saves you a mess later when billing or access control gets tangled with everything else in your tenancy. Your admin also needs to grant the right IAM policies ahead of time. I’ve seen deployments stall for an hour because nobody checked this until step five.
You’ll also need a VCN already built — public subnet, private subnet, security lists, route tables, an Internet Gateway. None of it is exotic. All of it has to exist first.
Network Design — This Is the Part to Slow Down For
Most security mistakes in cloud database deployments aren’t exotic attacks. They’re someone putting the database in the wrong subnet because they were moving fast.
Public subnet: bastion servers, general compute, admin access points. These can have public IPs because they’re meant to be reached.
The MySQL HeatWave system itself never goes there. Private subnet, full stop. Smaller attack surface, better compliance story, no direct path from the internet to your data. You reach it through a jump host instead — a small extra hop that buys a lot of protection.
Creating the Database System
Groundwork’s done. Now the actual provisioning.
Step 1 — Find the right menu. OCI Console → Databases → MySQL → Database Systems → Create Database System. Nothing clever here, just don’t get lost in the console (easy to do on your first few visits).
Step 2 — Pick your deployment type. Testing or dev work? Choose Development or Testing. Anything that’s going to carry real traffic? Pick the production configuration. Don’t shortcut this one just because the test option is the first thing you see.
Step 3 — Basic info. Compartment, display name, description. The name’s just for you — OCI tracks everything by OCID behind the scenes regardless of what you call it, so don’t agonize over naming conventions here.
Step 4 — The step people actually miss. Select Standalone Database System, then enable Configure MySQL HeatWave. This is the checkbox that turns on acceleration. Miss it, and you’ve just deployed regular MySQL with extra steps.
Step 5 — Admin credentials. Set a username and a strong password. Skip mysql.sys, root, mysql.session — some of these OCI will reject outright, others it won’t, but neither is worth the headache.
Networking
Pick the VCN from earlier. Pick the private subnet — and actually check this one, because it’s surprisingly easy to grab the public subnet by habit if you’ve been clicking through quickly.
Leave Availability Domain selected, leave Fault Domain disabled. Oracle’s placement logic is better than guessing, so let it do its job.
Hardware
Compute shape sets your CPU and memory ceiling. For learning or proof-of-concept work, the default shapes are fine — you’re not going to bottleneck a Sakila test query. Storage covers data files, logs, temp space, backups, and you can grow it later, so don’t overthink the initial number.
Backups
This is the one part of “managed service” that’s genuinely worth being grateful for.
Turn on scheduled backups. There’s no scenario where leaving this off is the right call. Retention options run 7, 14, or 30 days — 7 is enough for most environments, and you can bump it up later if your compliance requirements demand more. Set the backup window for a low-traffic period; backups competing with production load is a self-inflicted problem.
The Bastion Host
Your database’s in a private subnet, which means you need a front door. That’s the bastion.
Compute → Instances → Create Instance. Oracle Linux image, same VCN as your HeatWave system, public IP enabled. Upload an existing SSH key or generate a new pair — either works. Once it’s up, this box is your only way in. Everything routes through it.
Security Rules
Open the path from bastion to database:
| Setting | Value |
|---|---|
| Source Type | CIDR |
| Protocol | TCP |
| Destination Port | 3306 |
| Source CIDR | Public Subnet Range |
3306 is standard MySQL. Add 33060 too if you want X Protocol access — useful if you’re planning to do anything JSON/document-style down the line.
Connecting
Two routes in, depending on what you’re comfortable with.
Command line: SSH to the bastion (ssh opc@public-ip), install MySQL Shell, connect with mysqlsh admin@mysql-private-endpoint. Worth learning even if you’re a Workbench person normally — Shell handles SQL, JS, and Python, and that flexibility comes in handy more often than you’d expect.
GUI: MySQL Workbench, configured for Standard TCP/IP over SSH. You’ll need the bastion’s public IP, opc as the SSH user, your private key, the HeatWave endpoint as the MySQL host, port 3306, and your credentials. Hit Test Connection before you do anything else — if it fails, you’ll want to know now, not after you’ve started writing queries.
Testing It With Sakila
Oracle’s standard test database, Sakila, is the obvious first thing to load. It’s got tables, views, stored procedures, triggers, sample business data modeled on a DVD rental shop — old-school, but it works fine for confirming queries run, analytics behave, and your connection actually holds up under a real workload instead of a single SELECT 1.
A Short List of Things Not to Skip
Private subnet, always. Automated backups, always — manual ones get forgotten, every time. Least-privilege access for every user and service account; “just in case” permissions are how breaches happen six months later. Actually look at OCI’s monitoring data instead of waiting for users to complain. And SSH keys over passwords for anything administrative — it’s a small habit, but it closes off a surprising number of easy attack paths.
Final Thoughts
None of this is hard, exactly. It’s just unforgiving if you skip the groundwork — get the network and IAM pieces wrong, and everything downstream breaks in ways that are annoying to debug. Get them right, and you end up with a single platform handling transactions, analytics, and ML, without three separate systems duct-taped together behind it.
Whether this is your first cloud-native build, a legacy modernization project, or just you kicking the tires on real-time analytics for a weekend — this gets you a working environment, end to end.
