PolarDB:Create and manage a database account

Create a privileged account

1. Log on to the PolarDB console. In the left-side navigation pane, click Clusters. In the upper-left corner of the page, select the region in which the cluster resides and click the ID of the cluster to go to the Basic Information page.

2. In the left-side navigation pane, choose Settings and Management > Accounts.

3. Click Create Account.

4. In the Create Account panel, configure the parameters. The following table describes the parameters.

   Parameter	Description
   Account Name	The username of the account. The account name must meet the following requirements: It must start with a lowercase letter and end with a letter or a digit. It can contain lowercase letters, digits, and underscores (_). It must be 2 to 32 characters in length. It cannot be root, admin, or another username that is reserved by the system.
   Account Type	The type of the account. Select Privileged Account. Note If you have already created a privileged account, you cannot select Privileged Account. You can create only one privileged account for each cluster.
   Password	The password of the account. The password must meet the following requirements: It must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. It must be 8 to 32 characters in length, It can contain the following special characters: !@#$%^&*()_+-=~
   Confirm Password	Enter the password again.
   Description	The information that can help you manage the account. The information must meet the following requirements: It cannot start with http:// or https://. It must be 2 to 256 characters in length.

5. Click OK.

Create a standard account

1. Log on to the PolarDB console. In the left-side navigation pane, click Clusters. In the upper-left corner of the page, select the region in which the cluster resides and click the ID of the cluster to go to the Basic Information page.

2. In the left-side navigation pane, choose Settings and Management > Accounts.

3. Click Create Account.

4. In the Create Account panel, configure the parameters that are described in the following table.

   Parameter	Description
   Account Name	The username of the account. The account name must meet the following requirements: It must start with a lowercase letter and end with a letter or a digit. It can contain lowercase letters, digits, and underscores (_). It must be 2 to 32 characters in length. It cannot be root, admin, or another username that is reserved by the system.
   Account Type	The type of the account. Select Standard Account.
   Authorized Databases	You can grant permissions on one or more databases to the account. You can leave this parameter empty. You can grant the account the database permissions after the account is created. Select one or more databases from the Unauthorized Database list and click the icon to add the selected databases to the Authorized Database list. In the Authorized Database list, specify the permissions on the selected databases. Valid values for the permissions: Read/Write, Read-only, DML Only, DDL Only, and Read-only + Index. Note If you need to customize the permissions or grant the account specific table permissions, click Customize Permissions below the Unauthorized Database list. On the page that appears, you can use the permission management feature of Database Management Service (DMS) to manage the account permissions. For more information, see Manage user permissions on MySQL databases. If you are managing a large number of databases, grant permissions to the account in batches. In each batch, select up to 80 databases.
   Password	The password of the account. The password must meet the following requirements: It must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. It must be 8 to 32 characters in length, It can contain the following special characters: !@#$%^&*()_+-=~
   Confirm Password	Enter the password again.
   Description	The information that can help you manage the account. The information must meet the following requirements: It cannot start with http:// or https://. It must be 2 to 256 characters in length.

5. Click OK.

Create a global read-only account

1. Log on to the PolarDB console. In the left-side navigation pane, click Clusters. In the upper-left corner of the page, select the region in which the cluster resides and click the ID of the cluster to go to the Basic Information page.

2. In the left-side navigation pane, choose Settings and Management > Accounts.

3. Click Create Account.

4. In the Create Account panel, configure the parameters that are described in the following table.

   Parameter	Description
   Account Name	The username of the account. The account name must meet the following requirements: It must start with a lowercase letter and end with a letter or a digit. It can contain lowercase letters, digits, and underscores (_). It must be 2 to 32 characters in length. It cannot be root, admin, or another username that is reserved by the system.
   Account Type	The type of the account. Select Global Read-only Account.
   Authorized Databases	By default, global read-only accounts have the read-only permissions on all data.
   Password	The password of the account. The password must meet the following requirements: It must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. It must be 8 to 32 characters in length, It can contain the following special characters: !@#$%^&*()_+-=~
   Confirm Password	Enter the password again.
   Description	The information that can help you manage the account. The information must meet the following requirements: It cannot start with http:// or https://. It must be 2 to 256 characters in length.

Reset the permissions of a privileged account

If the permissions of a privileged account are accidentally revoked or encounter exceptions, you can reset the permissions to restore the privileged account to the initial state. To reset the permissions of the account, perform the following steps:

1. Log on to the PolarDB console. In the left-side navigation pane, click Clusters. In the upper-left corner of the page, select the region in which the cluster resides and click the ID of the cluster to go to the Basic Information page.

2. In the left-side navigation pane, choose Settings and Management > Accounts.

3. Find the privileged account that you want to manage and click Reset Permissions in the Actions column of the account.

4. In the dialog box that appears, enter the password of the privileged account and click OK.

Modify the permissions of a standard account

1. Log on to the PolarDB console. In the left-side navigation pane, click Clusters. In the upper-left corner of the page, select the region in which the cluster resides and click the ID of the cluster to go to the Basic Information page.

2. In the left-side navigation pane, choose Settings and Management > Accounts.

3. Find the account that you want to manage and click Modify Permissions in the Actions column.

4. In the Modify Permissions dialog box, modify the permissions of authorized databases and unauthorized databases, and click OK.

Modify the permissions of a global read-only account

1. Log on to the PolarDB console. In the left-side navigation pane, click Clusters. In the upper-left corner of the page, select the region in which the cluster resides and click the ID of the cluster to go to the Basic Information page.

2. In the left-side navigation pane, choose Settings and Management > Accounts.

3. Find the account that you want to manage and click Modify Permissions in the Actions column.

4. In the Modify Permissions dialog box, modify the permissions of authorized databases and unauthorized databases, and click OK.

   Note

   • Authorizing the read and write permissions on a specific database to the global read-only account does not affect its read-only permissions on other databases.

   • After the permission changes, the account is still a global read-only account, but shows granted permissions in the Database column.

Modify the permissions of an account by running commands

You can log on to the cluster with the privileged account and run the following command to modify the permissions of an account:

GRANT privileges ON databasename.tablename TO 'username'@'host' WITH GRANT OPTION;

Delete an account

1. Log on to the PolarDB console. In the left-side navigation pane, click Clusters. In the upper-left corner of the page, select the region in which the cluster resides and click the ID of the cluster to go to the Basic Information page.

2. In the left-side navigation pane, choose Settings and Management > Accounts.

3. Find the account that you want to delete and click Delete in the Actions column.

4. In the Delete Account dialog box, click OK.

Related API operations