PolarDB-X 1.0 supports two account types with different permission levels. Use the console to create standard accounts, adjust database permissions, reset passwords, and delete accounts.
Use the privileged account only for administrative tasks such as managing standard accounts and databases. For application connections, create a standard account with only the permissions required for the application.
Account types and permissions
PolarDB-X 1.0 instances support two account types.
| Account type | Description |
|---|---|
| Privileged account | Created and managed using SQL statements only. One privileged account per instance. Has all permissions on all databases and can disconnect any account. |
| Standard account | Created and managed in the console, via API operations, or using SQL statements. Multiple standard accounts per instance (limit depends on the kernel engine). Permissions must be granted explicitly. Cannot create or manage other accounts, or disconnect other accounts. |
Privileged accounts cannot be created or deleted in the console. Use SQL statements instead. For more information, see Manage accounts and permissions.
The following table shows which SQL operations each account type and permission level supports.
| Account type | Permission | SELECT | INSERT | UPDATE | DELETE | INDEX | ALTER | CREATE | DROP | GRANT |
|---|---|---|---|---|---|---|---|---|---|---|
| Standard account | DDL only | — | — | — | — | ✓ | ✓ | ✓ | ✓ | — |
| DML only | ✓ | ✓ | ✓ | ✓ | — | — | — | — | — | |
| Read-only | ✓ | — | — | — | — | — | — | — | — | |
| Read/Write | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | — | |
| Privileged account | Root | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
DDL (Data Definition Language) covers schema operations: INDEX, ALTER, CREATE, and DROP. DML (Data Manipulation Language) covers data operations: SELECT, INSERT, UPDATE, and DELETE. Read/Write combines both DDL and DML.
Limitations
Account management is only available on instances running version 5.3.6 10460044 or later.
The console supports only DML, DDL, Read-only, and Read/Write permissions for standard accounts. To grant additional permissions, use SQL statements. For more information, see Manage accounts and permissions.
Create an account
Log on to the PolarDB-X 1.0 console.
In the top navigation bar, select the region where the instance is deployed.
Find the target instance and click its ID.
In the left-side navigation pane, click Account Management.
In the upper-right corner, click Create an Account.
You can create only a standard account in the console. If you need to create a privileged account, use SQL statements.
Set the following parameters.
Parameter Description Database Account Enter the account name. The name must be 2–16 characters long, contain only lowercase letters, digits, and special characters, start with a letter, and end with a letter or digit. The name cannot duplicate an existing account name. After the account is created, the full name of the account is composed of the name you entered and the host name. The host name is %by default, which means the account is allowed to log on to the database from all hosts.New Password Enter a password that is 8–32 characters long and contains at least three of the following: uppercase letters, lowercase letters, digits, and special characters ( ! @#$%^&*()_+-=).Confirm New Password Re-enter the password. Authorization Database (Optional) Grant the account access to one or more databases. Select databases from Databases List on the left, then click Authorization > to move them to Authorized Databases on the right. Select the permission level for each database: Read-only (default), Read/Write, DDL Only, or DML Only. To set the same permission for all authorized databases at once, use Set All to Read/Write or the equivalent button in the upper-right corner of the Authorized Databases area. Click OK.
Modify the permissions of a standard account
Log on to the PolarDB-X 1.0 console.
In the top navigation bar, select the region where the instance is deployed.
Find the target instance and click its ID.
In the left-side navigation pane, click Account Management.
In the Actions column for the target account, click Modify Permission.
A privileged account has all the permissions on all databases. You do not need to modify permissions for a privileged account.
Add or remove databases and adjust permissions as needed.
To add databases, select them from Databases List and click Authorization >.
To remove databases, select them from Authorized Databases and click < Remove.
In the Authorized Databases area, select the permission for each database: Read-only, Read/Write, DDL Only, or DML Only. To apply the same permission to all databases at once, use Set All to Read/Write or the equivalent button in the upper-right corner.
Click OK.
Reset the account password
Reset passwords regularly to reduce security risk. Restrict the password reset operation to authorized personnel only.
Log on to the PolarDB-X 1.0 console.
In the top navigation bar, select the region where the instance is deployed.
In the left-side navigation pane, click Instances.
Find the target instance and click its ID.
In the left-side navigation pane, click Account Management.
In the Actions column for the target account, click Reset Password.
Set the following parameters.
Parameter Description New Password Enter a password that is 8–32 characters long and contains at least three of the following: uppercase letters, lowercase letters, digits, and special characters ( ! @#$%^&*()_+-=).Confirm New Password Re-enter the password. Click OK.
Delete an account
You cannot delete a privileged account in the console. Use SQL statements instead.
Log on to the PolarDB-X 1.0 console.
In the top navigation bar, select the region where the instance is deployed.
In the left-side navigation pane, click Instances.
Find the target instance and click its ID.
In the left-side navigation pane, click Account Management.
In the Actions column for the target account, click Delete.
In the dialog box, click OK.