Install MySQL on Amazon Linux 2023: Why "dnf install mysql" Fails, the MariaDB Client That Works With RDS, and the $releasever Fix for MySQL's Repo

On Amazon Linux 2023, sudo dnf install mysql fails with "No match for argument: mysql", because AL2023 doesn't package Oracle's MySQL at all. To get the mysql command, for example to connect to Amazon RDS for MySQL, run sudo dnf install -y mariadb1011: it installs the MariaDB client, whose mysql command connects to MySQL 8.4 and 8.0 servers, including Amazon RDS for MySQL. If you need Oracle's own client or server, add MySQL's el9 repository, and here's the trap that stops most people: the repository file uses $releasever, which on AL2023 is a date-stamped version like 2023.12.20261012, so every dnf command fails with a 404 for repomd.xml until you replace it with 9. This page covers both routes, the TLS options RDS needs, which MariaDB version to pick, the package conflict between the two clients, and running a MySQL-compatible server on the instance itself.

Ethan, a developer, had just moved the database behind his friend Jake's phone repair shop to Amazon RDS. He launched a small Amazon Linux 2023 server to run reports against it, typed sudo dnf install mysql, and got told there was no such thing.

New to these services? Amazon EC2 is a server you rent by the hour, Amazon Linux 2023 is AWS's own Linux for it, and Amazon RDS is a database AWS runs for you. The mysql command is how you talk to that database from the server.

Why "dnf install mysql" fails on Amazon Linux 2023

Here's what Ethan saw:

sudo dnf install -y mysql

No match for argument: mysql
Error: Unable to find a match: mysql

Amazon Linux 2023 doesn't include a package called mysql, or any of Oracle's MySQL packages. What it includes is MariaDB, the community fork of MySQL that many Linux distributions ship instead. MariaDB's client still installs a mysql command, as a link to its own mariadb command, and that client speaks the MySQL protocol. So for connecting to a MySQL server, you don't need Oracle's packages at all. The package just has a different name, and there are several of them:

Each one has a matching -server package if you want to run the database on the instance itself. To see what your server offers today, run dnf list --available "mariadb*".

The quick route: the MariaDB client

For connecting to RDS or any MySQL server, install the 10.11 client:

sudo dnf install -y mariadb1011
mysql --version

mysql  Ver 15.1 Distrib 10.11.19-MariaDB, for Linux (x86_64) using  EditLine wrapper

Then connect with your database's endpoint, the address shown on the database's page in the RDS console:

mysql -h shop-db.c1abcdexample.us-east-1.rds.amazonaws.com -u admin -p

It asks for the password and opens the MySQL prompt. The MariaDB client works with MySQL 8.4's default sign-in method, caching_sha2_password, which RDS for MySQL 8.4 uses by default, as well as with MySQL 8.0. It also comes with mysqldump and mysqladmin, so backups and imports work from the same package.

On the 11.4 and newer packages, the mysql name still works, with a nudge:

mysql: Deprecated program name. It will be removed in a future release, use '/usr/bin/mariadb' instead

The connection works anyway. To silence it, type mariadb instead of mysql; the options are the same.

Jake: "So we asked for MySQL and got MariaDB, and that's fine?"

Ethan: "For talking to the database, yes. It's a different brand of telephone, dialing the same number."

Connecting to RDS over TLS

RDS lets every connection use TLS, and administrators can require it by setting require_secure_transport to ON in the database's parameter group; it's OFF by default. If it's on, the 10.5 client's default, a plain connection, is refused:

ERROR 3159 (HY000): Connections using insecure transport are prohibited while --require_secure_transport=ON.

Adding --ssl fixes it, and so does using mariadb1011, which uses TLS on its own. To also check that you're talking to the real RDS server, download the RDS certificate bundle and pass it to the client:

curl -o global-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
mysql -h shop-db.c1abcdexample.us-east-1.rds.amazonaws.com --ssl-ca=global-bundle.pem --ssl -u admin -p

Watch out for one thing when you copy commands from MySQL's documentation: Oracle's client uses --ssl-mode, and the MariaDB client doesn't know that option:

mysql: unknown variable 'ssl-mode=REQUIRED'

On the MariaDB client, use --ssl with --ssl-ca, as in the command above, and add --ssl-verify-server-cert to also check that the certificate matches the endpoint name. If the connection times out instead of failing with a message, the problem is the network path, usually the database's security group.

Oracle's MySQL client: the $releasever trap

Sometimes you do want Oracle's own mysql, for example to match the server's version exactly, or for tools that expect it. MySQL publishes a repository for Red Hat Enterprise Linux 9 and its relatives, and its packages install and run on AL2023. Install the repository package first:

sudo dnf install -y https://dev.mysql.com/get/mysql84-community-release-el9-4.noarch.rpm

That works. The next command doesn't:

sudo dnf install -y mysql-community-client

Errors during downloading metadata for repository 'mysql-connectors-community':
  - Status code: 404 for https://repo.mysql.com/yum/mysql-connectors-community/el/2023.12.20261012/x86_64/repodata/repomd.xml
Error: Failed to download metadata for repo 'mysql-connectors-community': Cannot download repomd.xml: Cannot download repodata/repomd.xml: All mirrors were tried

Look at the address: el/2023.12.20261012. The repository file builds its addresses from the variable $releasever, which is 9 on Red Hat 9, but on AL2023 it's the release version, here 2023.12.20261012. MySQL's server has no such folder, so every repository it added returns 404, and while they're broken, every other dnf install on the server fails too. The fix is to put the number in yourself:

sudo sed -i 's/\$releasever/9/g' /etc/yum.repos.d/mysql-community*.repo
sudo dnf install -y mysql-community-client
mysql --version

mysql  Ver 9.7.2 for Linux on x86_64 (MySQL Community Server - GPL)

During the install, dnf imports MySQL's signing key from the repository package; answer yes if it asks. If you'd rather back out instead, remove the repository package with sudo dnf remove mysql84-community-release, and dnf works again.

Jake: "So the server was asking for a version of Linux that doesn't exist?"

Ethan: "It asked for the version Amazon Linux reported, and MySQL's site only knows Red Hat's numbering. One word in a config file."

MySQL 9.7 or 8.4: pick the client that matches

Notice the version above: 9.7.2. Despite its name, the current repository package turns on the MySQL 9.7 LTS series by default. A 9.7 client connects to an RDS for MySQL 8.4 server without trouble, but if you want the client to match an 8.4 server, switch series for the install:

sudo dnf install -y --disablerepo=mysql-9.7-lts-community --enablerepo=mysql-8.4-lts-community mysql-community-client
mysql --version

mysql  Ver 8.4.11 for Linux on x86_64 (MySQL Community Server - GPL)

To see which series the repository file has turned on, list the repositories: dnf repolist shows the enabled ones, and dnf repolist --all | grep mysql shows every series it knows about.

The whole Oracle route, in order:

1. Install MySQL's repository package for el9 with sudo dnf install -y and its download address.
2. Replace $releasever with 9 in /etc/yum.repos.d/mysql-community*.repo, before any other dnf command.
3. Decide on the series: 9.7 LTS by default, or 8.4 LTS with --enablerepo=mysql-8.4-lts-community.
4. Remove any MariaDB client first, since the two conflict.
5. Install mysql-community-client and check mysql --version.

One or the other: the client conflict

The MariaDB and Oracle clients both want to own /usr/bin/mysql and its tools, so you can install one or the other, not both. With Oracle's client installed, adding mariadb105 fails:

Error: Transaction test error:
  file /usr/bin/mysql from install of mariadb105-3:10.5.29-1.amzn2023.0.1.x86_64 conflicts with file from package mysql-community-client-9.7.2-1.el9.x86_64

How the two compare:

The same file conflict applies to MariaDB's server packages. To switch, remove one before installing the other, for example sudo dnf remove -y mysql-community-client before sudo dnf install -y mariadb1011. For most people the MariaDB client is the simpler choice: it comes from Amazon Linux's own repository and gets updates with the rest of the system.

Running a MySQL-compatible server on the instance

If you want the database on the EC2 instance itself, for a test server or a small internal tool, AL2023's MariaDB server is the straightforward route:

sudo dnf install -y mariadb1011-server
sudo systemctl enable --now mariadb
sudo mariadb-secure-installation

The first command installs the server, the second starts it now and at every boot, and the third walks you through setting a root password and removing the test database and anonymous accounts. Oracle's MySQL server is also in the el9 repository above, as mysql-community-server, once the $releasever fix is in place.

For anything customers depend on, a managed database such as RDS takes backups, patching and failover off your hands, which is why Ethan moved Jake's database there in the first place.

Connecting from EC2 to RDS: the checklist

When the client is installed but the connection still fails, work through it in this order:

1. Use the endpoint from the RDS console, not the instance name, and port 3306 unless you changed it.
2. Check the database's security group: it must allow port 3306 from the EC2 instance's security group.
3. Check that the instance and the database are in the same VPC, or that the network path between them is set up.
4. If the error mentions insecure transport, add --ssl, or use mariadb1011.
5. If the password is refused, reset the master password from the RDS console, and keep the new one in Secrets Manager rather than in a script.

A connection that hangs and then times out is almost always the network, not the client. Our RDS timeout guide covers that case step by step.

Troubleshooting by symptom

No match for argument: mysql

AL2023 has no mysql package. Install mariadb1011 for the mysql command, or add MySQL's el9 repository.

mysql: command not found

No client is installed yet. Run sudo dnf install -y mariadb1011.

Cannot download repomd.xml, Status code: 404, el/2023...

MySQL's repository file uses $releasever. Replace it with 9 in /etc/yum.repos.d/mysql-community*.repo.

ERROR 3159: Connections using insecure transport are prohibited

The server requires TLS. Add --ssl, or use the mariadb1011 client, which uses TLS by default.

mysql: unknown variable 'ssl-mode=REQUIRED'

That's an Oracle client option. On the MariaDB client, use --ssl and --ssl-ca instead.

file /usr/bin/mysql conflicts with file from package

The MariaDB and Oracle clients can't both be installed. Remove one before installing the other.

mysql: Deprecated program name

A warning from MariaDB 11.4 and newer. Run mariadb instead of mysql, or ignore it.

MySQL on Amazon Linux 2023: frequently asked questions

Ethan installed mariadb1011, downloaded the RDS certificate bundle, and connected on the first try. The reports script now runs every morning from the same server. He did install Oracle's client on a second test server, to see the $releasever problem for himself, and removed it again afterward. Jake's summary: "So the right answer was MariaDB, and the wrong answer was also fixable."

Revision note. Written October 13, 2026, on Amazon Linux 2023 release 2023.12.20261012. "A rose by any other name would smell as sweet," wrote Shakespeare; a mysql command named MariaDB still opens the same database.