Create an account for an ApsaraDB RDS for PostgreSQL instance

Account types

ApsaraDB RDS for PostgreSQL instances support two types of database accounts: privileged accounts and standard accounts. The following table describes these account types.

Precautions

• Databases within the same instance share all of the resources that belong to the instance. You can create databases, privileged accounts, and standard accounts for an ApsaraDB RDS for PostgreSQL instance. You can create as many databases as you want. You can also manage standard accounts and databases by using SQL statements.
• To migrate data from an on-premises database to an ApsaraDB for RDS instance, you must create a database and an account in the RDS instance. Ensure that the database has the same properties as the on-premises database, and the account of the database has the same permissions as the account of the on-premises database.
• Use service roles to create accounts and follow the principle of least privilege to assign appropriate read-only and read/write permissions to the accounts. When necessary, you can create multiple database accounts and allow each of them to access only data relevant to their own business tasks. If an account does not need to write data to a database, assign the read-only permissions to the account.
• To ensure database security, set strong account passwords and change the passwords on a regular basis.

Create an account for an RDS instance with standard or enhanced SSDs

1. Log on to the ApsaraDB for RDS console.
2. In the left-side navigation pane, click Instances. In the top navigation bar, select the region where your RDS instance resides.
   
3. Find your RDS instance and click its ID.
4. In the left-side navigation pane, click Accounts.
5. Click Create Account.
   
6. Configure the following parameters.

   Parameter	Description
   Database Account:	The username of the account must be 2 to 16 characters in length. The username of the account can contain lowercase letters, digits, and underscores (_). The username of the account must start with a lowercase letter and end with a lowercase letter or digit. The username of the account cannot be the same as the username of an existing account.
   Account Type:	Specify the type of the account. Two types of accounts are supported: privileged accounts and standard accounts. A privileged account has all operation permissions on all databases. A standard account has all operation permissions only on its authorized databases. Note The operation permissions include SELECT, INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, and TRIGGER.
   Password:	The password of the account must be 8 to 32 characters in length. The password of the account must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. Special characters include ! @ # $ % ^ & * ( ) _ + - =
   Confirm Password:	Enter the password of the account again.
   Description:	Enter the description of the database.

7. Click OK.

Create an account for an RDS instance with local SSDs

1. Log on to the ApsaraDB for RDS console.
2. In the left-side navigation pane, click Instances. In the top navigation bar, select the region where your RDS instance resides.
   
3. Find your RDS instance and click its ID.
4. In the left-side navigation pane, click Accounts.
5. Click Create Privileged Account.
6. Configure the following parameters.
   

   Parameter	Description
   Database Account:	The username of the account must be 2 to 16 characters in length. The username of the account can contain lowercase letters, digits, and underscores (_). The username of the account must start with a lowercase letter and end with a lowercase letter or digit. The username of the account cannot be the same as the username of an existing account.
   Password:	The password of the account must be 8 to 32 characters in length. The password of the account must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. Special characters include ! @ # $ % ^ & * ( ) _ + - =
   Confirm Password:	Enter the password of the account again.

7. Click Create.
   Note After you complete the preceding steps, a privileged account is created. For more information about how to create a standard account, see the following steps.
8. In the upper-right corner of the page, click Log On to DB to go to the RDS Database Logon page.
9. Configure the following parameters.
   

   Parameter	Description
   Endpoint:Port	Enter the endpoint and port number that are used to connect to the RDS instance. For more information, see View and change the internal and public endpoints and port numbers of an ApsaraDB RDS for PostgreSQL instance.
   Databases Username	Enter the username of the account that is authorized to log on to the database for which you want to create an authorized account.
   Password	The password of the preceding account.

10. Click Log On.
    Note If the system prompts you to add the Classless Inter-Domain Routing (CIDR) block of the DMS server to an IP address whitelist of the RDS instance, click Configure Whitelist.
11. After you log on to the RDS instance, choose SQL Operations > SQL Window in the top navigation bar.
12. In the SQL window, execute the following statement to create a standard account:

    CREATE USER name [ [ WITH ] option [ ... ] ]
    where option can be:
       SUPERUSER | NOSUPERUSER
     | CREATEDB | NOCREATEDB
     | CREATEROLE | NOCREATEROLE
     | CREATEUSER | NOCREATEUSER
     | INHERIT | NOINHERIT
     | LOGIN | NOLOGIN
     | REPLICATION | NOREPLICATION
     | CONNECTION LIMIT connlimit
     | [ ENCRYPTED | UNENCRYPTED ] PASSWORD 'password'
     | VALID UNTIL 'timestamp'
     | IN ROLE role_name [, ...]
     | IN GROUP role_name [, ...]
     | ROLE role_name [, ...]
     | ADMIN role_name [, ...]
     | USER role_name [, ...]
     | SYSID uid

    For example, if you want to create an account named test2 with the password 123456, execute the following statement:

    create user test2 password '123456';

Related operations