MySQL Enterprise Firewall •As of MySQL 8.0.23, the firewall supports group profiles that can have multiple accounts as members, with the profile allowlist applying equally to all members. Group profiles enable easier administration and greater flexibility for deployments that require applying a given set of allowlist rules to multiple accounts. •Register one or more profiles with the firewall. •Train the firewall by establishing the allowlist for each profile; that is, the types of statements the profile permits clients to execute. •Place the trained profiles in protecting mode to harden MySQL against unauthorized statement execution: •MySQL associates each client session with a specific user name and host name combination. This combination is the  session account . •For each client connection, the firewall uses the session account to determine which profiles apply to handling incoming statements from the client. •To apply an allowlist to multiple accounts using account profiles, it is necessary to register one profile per account and duplicate the allowlist across each profile. This entails training each account profile individually because each one must be trained using the single account to which it applies. •An account profile allowlist applies only to a single account. A group profile allowlist applies when the session account matches any account that is a member of the group. •Account profile names are based on specific user name and host name combinations that depend on which clients connect to the MySQL server. Group profile names are chosen by the firewall administrator with no constraints other than that their length must be from 1 to 288 characters. •If an application has unique protection requirements, configure it to use an account not used for any other purpose and set up a group profile or account profile for that account. Initially, no profiles exist, so by default, the firewall accepts all statements and has no effect on which statements MySQL accounts can execute. To apply firewall protective capabilities, explicit action is required: The firewall accepts only statements permitted by the applicable profile allowlists. Most firewall principles apply identically to group profiles and account profiles. The two types of profiles differ in these respects: A group profile allowlist applies to multiple accounts, with no need to duplicate it for each account. A group profile can be trained using any or all of the group member accounts, or training can be limited to any single member. Either way, the allowlist applies to all members. Due to the advantages of group profiles over account profiles, and because a group profile with a single member account is logically equivalent to an account profile for that account, it is recommended that all new firewall profiles be created as group profiles. Account profiles are deprecated as of MySQL 8.0.26 and subject to removal in a future MySQL version. For assistance converting existing account profiles, see Migrating Account Profiles to Group Profiles. The profile-based protection afforded by the firewall enables implementation of strategies such as these: 1552 Note