PolarDB:Create and manage database accounts

Create a privileged account

1. Log on to the PolarDB console. Select the region where the destination cluster is located. On the Clusters page, click the ID of the destination cluster to navigate to the product page.

2. In the navigation pane on the left, choose Settings and Management > Accounts.

3. Click Create Account.

4. In the Create Account panel, you can set the following parameters:

   Parameter	Description
   Account Name	Enter a name for the account. The account name must meet the following requirements: Must start with a lowercase letter and end with a letter or a digit. Can contain lowercase letters, digits, and underscores (_). Must be 2 to 32 characters in length. Cannot be a reserved username, such as root or admin.
   Account Type	Select Privileged Account. Note If a privileged account already exists, you cannot select Privileged Account again because each cluster can have only one privileged account. For more information about the permissions of a privileged account, see Privileged account.
   Password	Set a password for the account. The password must meet the following requirements: Must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. Must be 8 to 32 characters in length. Special characters are: !@#$%^&*()_+-=~
   Confirm Password	Enter the password again.
   Description	Enter a description for the account to help with future account management. The description must meet the following requirements: Cannot start with http:// or https://. Must be 2 to 256 characters in length.

5. Click OK.

Create a standard account

1. Log on to the PolarDB console. Select the region where the destination cluster is located. On the Clusters page, click the ID of the destination cluster.

2. In the navigation pane on the left, choose Settings and Management > Accounts.

3. Click Create Account.

4. In the Create Account dialog box, set the following parameters:

   Parameter	Description
   Account Name	Enter a name for the account. The account name must meet the following requirements: Must start with a lowercase letter and end with a letter or a digit. Can contain lowercase letters, digits, and underscores (_). Must be 2 to 32 characters in length. Cannot be a reserved username, such as root or admin.
   Account Type	Select Standard Account.
   Authorized Databases	Grant permissions on one or more databases to the account. You can also leave this parameter empty and grant permissions after the account is created. From the Unauthorized Database list, select one or more databases and click the icon to add them to the Authorized Database list. In the Authorized Database list, set the permission for the destination database to Read/Write, Read-only, DML Only, DDL Only, or Read-only + Index. Note To customize permission combinations or grant table-level permissions, click Customize Permissions below the Unauthorized Database list. You can use the permission management feature of Data Management (DMS) for flexible control. For more information, see Manage database accounts and permissions. To manage many databases, grant permissions in batches. Each batch should not exceed 80 databases.
   Password	Set a password for the account. The password must meet the following requirements: Must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. Must be 8 to 32 characters in length. Special characters are: !@#$%^&*()_+-=~
   Confirm Password	Enter the password again.
   Description	Enter a description for the account to help with future account management. The description must meet the following requirements: Cannot start with http:// or https://. Must be 2 to 256 characters in length.

5. Click OK.

Create a global read-only account

1. Log on to the PolarDB console and select the region where the cluster is located. On the Clusters page, click the ID of the destination cluster to open the product page.

2. In the navigation pane on the left, choose Settings and Management > Accounts.

3. Click Create Account.

4. In the Create Account dialog box, set the following parameters:

   Parameter	Description
   Account Name	Enter a name for the account. The account name must meet the following requirements: Must start with a lowercase letter and end with a letter or a digit. Can contain lowercase letters, digits, and underscores (_). Must be 2 to 32 characters in length. Cannot be a reserved username, such as root or admin.
   Account Type	Select Global Read-only Account.
   Authorized Databases	By default, the account has read-only permissions on all data.
   Password	Set a password for the account. The password must meet the following requirements: Must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. Must be 8 to 32 characters in length. Special characters are: !@#$%^&*()_+-=~
   Confirm Password	Enter the password again.
   Description	Enter a description for the account to help with future account management. The description must meet the following requirements: Cannot start with http:// or https://. Must be 2 to 256 characters in length.

Reset permissions for a privileged account

If a privileged account has issues, such as its permissions being accidentally revoked, you can reset the permissions to restore the account to its initial state.

1. Log on to the PolarDB console. Select the region where the destination cluster is located. On the Clusters page, click the destination cluster ID to navigate to the product page.

2. In the navigation pane on the left, choose Settings and Management > Accounts.

3. In the Actions column for the destination account, click Reset Permissions.

4. In the dialog box, enter the privileged account password and click OK to reset the permissions.

Modify permissions for a standard account

1. Log on to the PolarDB console. Select the region where the cluster is located. On the Clusters page, click the ID of the destination cluster to navigate to the product page.

2. In the navigation pane on the left, choose Settings and Management > Accounts.

3. Find the destination account and in the Actions column, click Modify Permissions.

4. In the Modify Permissions dialog box, modify the authorized databases and their permissions, and then click OK.

Modify permissions for a global read-only account

1. Log on to the PolarDB console and select the region where the destination cluster is located. On the Clusters page, click the ID of the destination cluster to open its product page.

2. In the navigation pane on the left, choose Settings and Management > Accounts.

3. Find the destination account and in the Actions column, click Modify Permissions.

4. In the Modify Permissions dialog box, modify the permissions for the authorized databases and click OK.

   Note

   • Granting read and write permissions to specific databases does not affect the global read-only permission of the account.

   • After permissions are granted to a specific database, the Type column still displays Global Read-only Account, but the Authorized Databases column displays the permissions for that specific database.

Modify account permissions from the command line

You can use a privileged account to modify permissions by running the following command:

GRANT privileges ON databasename.tablename TO 'username'@'host' WITH GRANT OPTION;

Delete an account

1. Log on to the PolarDB console. Select the region where the destination cluster is located. On the Clusters page, click the ID of the destination cluster to open the product page.

2. In the navigation pane on the left, choose Settings and Management > Accounts.

3. Find the destination account and click Delete in the Actions column.

4. In the Delete Account dialog box, click OK.

Related APIs