Background information
You can create and manage privileged accounts and standard accounts in the PolarDB console.
Note
To ensure data security, you cannot create nor use a root account in PolarDB.
Account type | Description |
Privileged Account | Privileged accounts can be created and managed only in the console. Only one privileged account can be created for each cluster. The privileged account can manage all the standard accounts and databases in the corresponding cluster. A privileged account can be used to create databases and standard accounts and authorize a standard account to perform add, delete, modify, and view operations on a database. A privileged account has the permissions to implement fine-grained control over user permissions based on your business requirements. For example, you can use a privileged account to grant different users the permissions to query different tables. A privileged account has the permissions to disconnect all standard accounts on the cluster.
|
Standard Account | Standard accounts can be created and managed in the console or by using SQL statements. Multiple standard accounts can be created for each cluster. The maximum number of standard accounts that you can create depends on the database engine. A standard account cannot be used to create databases or standard accounts. A standard account can only manage databases on which they have permissions. A standard account does not have permissions to manage or disconnect other accounts of the cluster on which the standard account is created.
|
Create a privileged account
Log on to the PolarDB console.
In the upper-left corner, select the region in which the cluster is deployed.
Find the cluster and click its ID.
In the left-side navigation pane, choose .
Click Create Account.
In the Create Account panel, configure the parameters that are described in the following table.
Parameter | Description |
Account Name | The username of the account. The username must meet the following requirements: It must start with a lowercase letter and end with a letter or a digit. It can contain lowercase letters, digits, and underscores (_). It must be 2 to 32 characters in length. It cannot be root, admin, or another username that is reserved by the system.
|
Account Type | The type of the account. Select Privileged Account. Note If you have already created a privileged account, you cannot select Privileged Account. You can create only one privileged account for each cluster. |
Password | The password of the account. The password must meet the following requirements: It must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. It must be 8 to 32 characters in length. It can contain the following special characters: !@#$%^&*()_+-=~
|
Confirm Password | Enter the logon password again. |
Description | The information that can help you manage the account. It must meet the following requirements: |
Click OK.
Create a standard account
Log on to the PolarDB console.
In the upper-left corner, select the region in which the cluster is deployed.
Find the cluster and click its ID.
In the left-side navigation pane, choose .
Click Create Account.
In the Create Account panel, configure the parameters that are described in the following table.
Parameter | Description |
Account Name | The name of the account. The username must meet the following requirements: It must start with a lowercase letter and end with a letter or a digit. It can contain lowercase letters, digits, and underscores (_). It must be 2 to 32 characters in length. It cannot be root, admin, or another username that is reserved by the system.
|
Account Type | The type of the account. Select Standard Account. |
Authorized Databases | You can grant permissions on one or more databases to the account. You can leave this parameter empty. You can grant the account the database permissions after the account is created. Select one or more databases from the Unauthorized Database list and click the icon to add the selected databases to the Authorized Database list. In the Authorized Database list, specify the permissions on the selected databases. Valid values for the permissions: Read/Write, Read-only, DML Only, DDL Only, and Read-only + Index.
Note If you need to customize the permissions or grant the account specific table permissions, click Customize Permissions below the Unauthorized Database list. On the page that appears, you can use the permission management feature of Database Management Service (DMS) to manage the account permissions. For more information, see Manage user permissions on MySQL databases. |
Password | The password of the account. The password must meet the following requirements: It must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. It must be 8 to 32 characters in length. It can contain the following special characters: !@#$%^&*()_+-=~
|
Confirm Password | Enter the logon password again. |
Description | The information that can help you manage the account. It must meet the following requirements: |
Click OK.
Reset the permissions of a privileged account
If the permissions of a privileged account are accidentally revoked or encounter exceptions, you can reset the permissions to restore the privileged account to the initial state. To reset the permissions of the account, perform the following steps:
Log on to the PolarDB console.
In the upper-left corner, select the region in which the cluster is deployed.
Find the cluster and click its ID.
In the left-side navigation pane, choose .
Find the privileged account that you want to manage and click Reset Permissions in the Actions column of the account.
In the dialog box that appears, enter the password of the privileged account and click OK.
Modify the permissions of a standard account
Log on to the PolarDB console.
In the upper-left corner, select the region in which the cluster is deployed.
Find the cluster and click its ID.
In the left-side navigation pane, choose .
Find the account that you want to manage and click Modify Permissions in the Actions column.
In the Modify Permissions dialog box, modify the permissions of authorized databases and unauthorized databases, and click OK.
Modify the permissions of an account by running commands
You can log on to the cluster with the privileged account and run the following command to modify the permissions of an account:
GRANT privileges ON databasename.tablename TO 'username'@'host' WITH GRANT OPTION;
Parameter | Description |
privileges | The operation permissions to be granted to the account, such as SELECT, INSERT, and UPDATE. To grant all permissions to the account, set this parameter to ALL. |
databasename | The name of the database. To grant the operation permissions of all databases to the account, set this parameter to an asterisk (*). |
tablename | The name of the table. To grant the operation permissions of all tables to the account, set this parameter to an asterisk (*). |
username | The account to be authorized. |
host | The host from which the account can be used to log on to the database. If you set this parameter to a percent sign (%), the account can be used to log on to the database from all hosts. |
WITH GRANT OPTION | Grants the account the permission to run the GRANT command. This parameter is optional. |
Delete an account
Log on to the PolarDB console.
In the upper-left corner, select the region in which the cluster is deployed.
Find the cluster and click its ID.
In the left-side navigation pane, choose .
Find the account that you want to delete and click Delete in the Actions column.
In the Delete Account dialog box, click OK.
Related API operations
API | Description |
CreateAccount | Creates an account. |
DescribeAccounts | Queries the accounts of the specified cluster. |
ModifyAccountDescription | Modifies the description of a database account for the specified PolarDB cluster. |
ModifyAccountPassword | Changes the password of a database account for the specified PolarDB cluster. |
GrantAccountPrivilege | Grants a specified standard account the permissions on one or more databases of the specified PolarDB cluster. |
RevokeAccountPrivilege | Revokes the permissions on one or more databases from the specified PolarDB standard account. |
ResetAccount | Resets the permissions of a privileged account for the specified PolarDB cluster. |