PolarDB:Account management

Precautions

• Account management is available only for instances of V5.3.6 10460044 or later.

• In the console, you can grant only DML only, DDL only, read-only, and read/write permissions to standard accounts. To grant more fine-grained permissions, you must use SQL statements. For more information, see Account and permission system.

Account types and permissions

• PolarDB-X 1.0 instances support the following two types of database accounts:

  Account type	Description
  privileged account	You can create and manage privileged accounts only by using SQL statements. You can create only one privileged account for an instance. This account can manage all standard accounts and databases on the instance. A privileged account has elevated permissions to meet custom and fine-grained permission management requirements, such as granting query permissions on different tables to different users. A privileged account has all permissions on all databases within the instance and can terminate the connection of any account.
  standard account	You can create and manage standard accounts in the console, by calling an API, or by using SQL statements. You can create multiple standard accounts for an instance. The maximum number of accounts that you can create depends on the instance kernel. You must manually grant permissions to a standard account for specific databases. A standard account cannot create or manage other accounts, or terminate the connection of other accounts.

• The following table lists the supported SQL operations for each account and permission type.

  Account type	Permission	SELECT	INSERT	UPDATE	DELETE	INDEX	ALTER	CREATE	DROP	GRANT
  standard account	DDL only	Not supported	Not supported	Not supported	Not supported	Supported	Supported	Supported	Supported	Not supported
  	DML only	Supported	Supported	Supported	Supported	Not supported	Not supported	Not supported	Not supported	Not supported
  	read-only	Supported	Not supported	Not supported	Not supported	Not supported	Not supported	Not supported	Not supported	Not supported
  	read/write	Supported	Supported	Supported	Supported	Supported	Supported	Supported	Supported	Not supported
  privileged account	Root	Supported	Supported	Supported	Supported	Supported	Supported	Supported	Supported	Supported

Create an account

1. Log on to the PolarDB-X 1.0 console.

2. In the top navigation bar, select the region where the instance is deployed.

3. Find the target instance and click its instance ID.

4. In the left-side navigation pane, click Accounts.

5. In the upper-right corner of the page, click Create Account.

   Note

   You can create only standard accounts in the console. To create a privileged account, you must use SQL statements.

6. In the dialog box that appears, set the following parameters:

   Parameter	Description
   database account	Enter an account name. Note The account name must meet the following requirements: It must be 2 to 16 characters in length and consist of lowercase letters, digits, or special characters. It must start with a letter and end with a letter or a digit. The account name must be unique within the instance. After the account is created, the full account name consists of the name you entered and a host. By default, the host is %, which allows the account to log on to the database from any host.
   new password	Set a password for the account. Note The password must meet the following requirements: It must be 8 to 32 characters in length. It must contain characters from at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. Allowed special characters: !@#$%^&*()_+-=
   confirm new password	Enter the password again.
   authorized database	Grant the account permissions on one or more databases. Select one or more databases and click Authorize > to move them from the Databases on the left to the Authorized Databases list on the right. In the Authorized Databases list on the right, select permissions for the target databases. Note The default permission is Read-only. You can also change the permission to Read and write, DDL Only, or DML Only. To grant the same permissions to multiple databases at a time, click a button in the upper-right corner of the Authorized Databases box, such as Set all to read/write.

7. Click OK.

Modify standard account permissions

1. Log on to the PolarDB-X 1.0 console.

2. In the top navigation bar, select the region where the instance is deployed.

3. Find the target instance and click its instance ID.

4. In the left-side navigation pane, click Accounts.

5. Find the target account and click Modify Permissions in the Operation column.

   Note

   A privileged account has all permissions on all databases. Therefore, you do not need to use the Modify Permissions option for it.

6. In the dialog box that appears, modify the account permissions:

   Parameter

   Description

   authorized database

   Modify the permissions of the account on one or more databases. Select one or more databases and click Authorize > or < Remove to add the databases to or remove them from the target account. In the Authorized Databases list on the right, select permissions for the target databases. Note You can change the permission to Read-only, Read and write, DDL Only, or DML Only. To grant the same permissions to multiple databases at a time, click a button in the upper-right corner of the Authorized Databases box, such as Set all to read/write.

7. Click OK.

Reset an account password

1. Log on to the PolarDB-X 1.0 console.

2. In the top navigation bar, select the region where the instance is deployed.

3. In the left-side navigation pane, click Instances.

4. Find the target instance and click its instance ID.

5. In the left-side navigation pane, click Accounts.

6. Find the target account and click Reset Password in the Operation column.

7. In the dialog box that appears, set the following parameters:

   Parameter	Description
   new password	Set a new password for the account. Note The password must meet the following requirements: It must be 8 to 32 characters in length. It must contain characters from at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. Allowed special characters: !@#$%^&*()_+-=
   confirm new password	Enter the new password again.

8. Click OK.

Delete an account

1. Log on to the PolarDB-X 1.0 console.

2. In the top navigation bar, select the region where the instance is deployed.

3. In the left-side navigation pane, click Instances.

4. Find the target instance and click its instance ID.

5. In the left-side navigation pane, click Accounts.

6. Find the target account and click Delete in the Operation column.

   Note

   You cannot delete a Privileged Account in the console. However, you can delete a privileged account by using SQL statements.

7. In the dialog box that appears, click OK.