How to create and manage database accounts - PolarDB - Alibaba Cloud Documentation Center

PolarDB-X instances support privileged and standard accounts. By default, a new instance has no accounts. This topic describes how to create and manage accounts for your instance.

Account types

PolarDB-X instances support the following two types of database accounts:

Account type	Description
privileged account	Can only be created and managed in the console or by using API operations. Each instance can have only one privileged account. This account can manage all standard accounts and databases. Has advanced permissions for fine-grained access control, such as granting query permissions on specific tables to different users. Has full permissions on all databases within the instance and can terminate any active connection.
standard account	Can be created and managed in the console, by using API operations, or by running SQL statements. An instance can have multiple standard accounts. The maximum number of standard accounts depends on the instance kernel. You must manually grant permissions on specific databases to a standard account. A standard account cannot create or manage other accounts, nor can it terminate connections from other accounts.

Note

You cannot change the account type after you create an account. To change the account type, you must delete the account and then create a new one with the same name but a different type.
To create a RAM user for an Alibaba Cloud account and authorize the RAM user to manage instances, see Create a RAM user.

You can perform the following actions on accounts in the console:

Create an account
Reset a password
Modify permissions of a standard account
Delete an account

Usage notes

Each PolarDB-X instance can have only one privileged account.
Once created, a privileged account cannot be deleted.
When you create a database account in the console, its HOST is set to %. This allows access from any IP address in the whitelist. To restrict access by host, log on to the instance using the privileged account and run the CREATE USER statement to create the account.
```
-- Replace the host part as required.
CREATE USER <username>@<host> IDENTIFIED BY '<password>';
```

Create an account

Log on to the PolarDB Distributed Edition console.
In the top navigation bar, select the region where the instance is deployed.
On the Instances page, click the PolarDB-X 2.0 tab.
Find the instance and click Instance ID to go to the instance details page.
In the navigation pane on the left, click Configuration and Management > Accounts.

Click Create Account. In the dialog box that appears, configure the following parameters.

Parameter	Description
Account Name	Enter the name of the account. Note The account name must meet the following requirements: Be 2 to 16 characters long and contain only lowercase letters, digits, and underscores (_). Start with a letter and end with a letter or digit. Be unique within the instance.
Account Type	Select Privileged Account or Standard Account.
Authorization Database	Grant permissions on one or more databases to the account. Select one or more databases and click the icon to move them from the Unauthorized Databases list on the left to the Authorized Databases list on the right. In the Authorized Databases list on the right, select permissions for the target database. Note This parameter is available only when you create a Standard Account. This parameter is optional. You can also grant permissions after you create the account. The supported permissions are Read and write, Read-only, DML Only, and DDL Only. To grant the same permissions to multiple databases at once, click the corresponding button in the upper-right corner of the Authorized Databases list, such as All Read and Write.
Password	Set the password for the account. Note The password must meet the following requirements: Be 8 to 20 characters long. Contain characters from at least three of the following categories: uppercase letters, lowercase letters, digits, and special characters. Special characters: @#$%^&+=
Confirm Password	Re-enter the password.
Description	Optional. Add a description for the account for easier management. The description can be up to 256 characters long.

Click OK.

Reset a password

Log on to the PolarDB Distributed Edition console.
In the top navigation bar, select the region where the instance is deployed.
On the Instances page, click the PolarDB-X 2.0 tab.
Find the instance and click Instance ID to go to the instance details page.
In the navigation pane on the left, click Configuration and Management > Accounts.
On the Accounts page, find the target account and click Change password in the Operation column.
In the dialog box that appears, enter and confirm the new password, and then click OK.
Note
The password must meet the following requirements:
- Be 8 to 20 characters long.
- Contain characters from at least three of the following categories: uppercase letters, lowercase letters, digits, and special characters.
- Special characters: @#$%^&+=

Modify permissions of a standard account

Log on to the PolarDB Distributed Edition console.
In the top navigation bar, select the region where the instance is deployed.
On the Instances page, click the PolarDB-X 2.0 tab.
Find the instance and click Instance ID to go to the instance details page.
In the navigation pane on the left, click Configuration and Management > Accounts.
On the Accounts page, find the target account and click Modify Permissions in the Operation column.

Note
The Modify Permissions action is not applicable to privileged accounts because they have full permissions on all databases.
In the dialog box that appears, select one or more databases and click the icon to move them from the Unauthorized Databases list on the left to the Authorized Databases list on the right.
In the Authorized Databases list on the right, select permissions for the target database.
Note
- The supported permissions are Read and write, Read-only, DML Only, and DDL Only.
- To grant the same permissions to multiple databases at once, click the corresponding button in the upper-right corner of the Authorized Databases list, such as All DDL Only.
Click OK.

Delete an account

Warning

Deleting an account prevents clients from connecting. Proceed with caution.

Log on to the PolarDB Distributed Edition console.
In the top navigation bar, select the region where the instance is deployed.
On the Instances page, click the PolarDB-X 2.0 tab.
Find the instance and click Instance ID to go to the instance details page.
In the navigation pane on the left, click Configuration and Management > Accounts.
On the Accounts page, find the target account and click Delete in the Operation column.
In the dialog box that appears, click OK.