All Products
Search

This Product

    PolarDB:Create a database account

    Document Center

    PolarDB:Create a database account

    Last Updated:Oct 19, 2023

    This topic describes how to create PolarDB for MySQL accounts and explains the differences between privileged accounts and standard accounts.

    Background information

    You can create and manage privileged accounts and standard accounts in the PolarDB for MySQL console.

    Note To avoid security risks, PolarDB for MySQL does not provide root accounts.
    Account typeDescription
    Privileged Account
    • You can use only the console to create and manage privileged accounts.
    • You can create only one privileged account for each cluster. A privileged account can manage all the standard accounts and databases in the corresponding cluster.
    • You can create a database and a standard account and authorize the standard account to perform add, delete, modify, and view operations on the database.
    • A privileged account has more permissions than before. This allows you to implement fine-grained control over user permissions based on your business requirements. For example, you can grant different users the permissions to query different tables.
    • A privileged account has the permissions to disconnect all standard accounts on the instance.
    Standard Account
    • You can create and manage standard accounts in the console or by using SQL statements.
    • You can create multiple standard accounts for each cluster. The maximum number of standard accounts that you can create depends on the database engine.
    • A standard account cannot be used to create databases or standard accounts. A standard account can only manage databases on which they have permissions.
    • A standard account does not have permissions to manage or disconnect the other accounts of the RDS instance on which the standard account is created.

    Create a privileged account

    1. Log on to the PolarDB console.
    2. In the upper-left corner of the console, select the region in which the cluster that you want to manage is deployed.
    3. Find the cluster and click the cluster ID.
    4. In the left-side navigation pane, choose Settings and Management > Accounts.
    5. Click Create Account.
    6. In the Create Account panel, specify the following parameters. The following table describes the parameters.
      ParameterDescription
      Account Name

      Enter the username of the account. The username must meet the following requirements:

      • It must start with a lowercase letter and end with a letter or a digit.
      • It can contain lowercase letters, digits, and underscores (_).
      • It must be 2 to 32 characters in length.
      • It cannot be root, admin, or another username that is reserved by the system.
      Account TypeSpecify the type of the account. Select Privileged Account.
      Note If you have already created a privileged account, you cannot select Privileged Account. You can create only one privileged account for each cluster.
      PasswordEnter a password for the account. The password must meet the following requirements:
      • It must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters.
      • It must be 8 to 32 characters in length.
      • It can contain the following special characters:

        !@#$%^&*()_+-=

      Confirm PasswordEnter the logon password again.
      DescriptionThe information that can help you manage the account. It must meet the following requirements:
      • It cannot start with http:// or https://.
      • It must be 2 to 256 characters in length.
    7. Click OK.

    Create a standard account

    1. Log on to the PolarDB console.
    2. In the upper-left corner of the console, select the region in which the cluster that you want to manage is deployed.
    3. Find the cluster and click the cluster ID.
    4. In the left-side navigation pane, choose Settings and Management > Accounts.
    5. Click Create Account.
    6. In the Create Account panel, specify the following parameters.
      ParameterDescription
      Account Name

      Enter the username of the account. The username must meet the following requirements:

      • It must start with a lowercase letter and end with a letter or a digit.
      • It can contain lowercase letters, digits, and underscores (_).
      • It must be 2 to 32 characters in length.
      • It cannot be root, admin, or another username that is reserved by the system.
      Account TypeSpecify the type of the account. Select Standard Account.
      Authorized DatabasesYou can grant permissions on one or more databases to the account. You can leave this parameter empty. You can grant the account the database permissions after the account is created.
      1. Select one or more databases from the Unauthorized Database list and click the icon icon. Then, the selected databases are added to the Authorized Database list.
      2. In the Authorized Database list, specify the permissions on the selected databases. To specify the permissions, select one of the following options: Read/Write, Read-only, DML Only, DDL Only, and Read-only + Index.
      Note If you need to customize the permissions or grant the account specific table permissions, click Customize Permissions below the Unauthorized Database list. On the page that appears, you can use the permission management feature of Database Management Service (DMS) to manage the account permissions. For more information, see Manage user permissions on MySQL databases.
      PasswordEnter a password for the account. The password must meet the following requirements:
      • It must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters.
      • It must be 8 to 32 characters in length.
      • It can contain the following special characters:

        !@#$%^&*()_+-=

      Confirm PasswordEnter the logon password again.
      DescriptionThe information that can help you manage the account. It must meet the following requirements:
      • It cannot start with http:// or https://.
      • It must be 2 to 256 characters in length.
    7. Click OK.

    Reset the permissions of a privileged account

    If the permissions of a privileged account are accidentally revoked or encounter other exceptions, you can reset the permissions to restore the privileged account to the initial state. To reset the permissions of the account, perform the following steps:

    1. Log on to the PolarDB console.
    2. In the upper-left corner of the console, select the region in which the cluster that you want to manage is deployed.
    3. Find the cluster and click the cluster ID.
    4. In the left-side navigation pane, choose Settings and Management > Accounts.
    5. On the page that appears, find the privileged account that you want to manage. In the Actions column for the privileged account, click Reset Permissions
    6. In the dialog box that appears, enter the password of the privileged account. Then, click OK to reset the permissions of the account.

    What to do next

    Manage the endpoints of a cluster

    Related operations

    APIDescription
    CreateAccountCreates an account.
    DescribeAccountsQueries the accounts of a specified cluster.
    ModifyAccountDescriptionModifies the description of a database account for a PolarDB cluster.
    ModifyAccountPasswordChanges the password of a database account.
    GrantAccountPrivilegeGrants a specified standard account the permissions on one or more databases of a specified PolarDB cluster.
    RevokeAccountPrivilegeRevokes the permissions on one or more databases from a specified PolarDB standard account.
    ResetAccountResets the permissions of a privileged account for a specified PolarDB cluster.