Modify permissions for a standard account. Privileged account permissions can only be reset to their initial state.
For custom permission combinations or table-level permissions, use Manage database accounts and permissions in DMS.
Method 1: Console
Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
-
In the left-side navigation pane, click Accounts.
-
Find the account and click Change Permissions in the Actions column.
-
In the Edit Account Permissions panel, adjust permissions.
-
To grant or revoke database permissions, select the database and click > or <.
-
In the Authorized Databases list, set the permission level to Read/Write (DDL + DML), Read-only, DDL Only, or DML Only.
NoteFor finer control, use SQL statements. Account permissions.
-
-
Click OK.
Method 2: DMS
Manage account permissions through DMS. Manage database accounts and permissions.
Method 3: SQL statements
Prerequisites
You must use a privileged account to grant permissions.
-
Connect to an ApsaraDB RDS for MySQL instance by using the CLI or a client.
-
Run GRANT to assign permissions to the account.
Note-
GRANT statement details: MySQL GRANT documentation.
-
Grantable permissions: Account permissions.
-
FAQ
Q: Why can't I create a database by using a standard account? The following error is returned: ERROR 1044 (42000): Access denied for user 'xxxx'@'%' to database 'xxxx'.
A:
Standard accounts only have logon permission by default. Use a privileged account to grant CREATE:
GRANT CREATE ON *.* TO '<standard-account-name>'@'%';Q: How can I prevent users from accessing a database?
A: Remove all IP address whitelist entries except 127.0.0.1, then restart the instance to block all external access.
Q: Can I lock an account?
A: A privileged account can run ALTER USER 'username' ACCOUNT LOCK; for itself or a standard account. Restart the instance afterward to terminate existing connections. To unlock a privileged account and restore its permissions, reset the permissions of the privileged account.
ApsaraDB RDS for MySQL instances running MySQL 5.6 do not support the ALTER USER 'username' ACCOUNT LOCK; statement.
Q: How do I grant permissions to view binary logs (local logs)?
A: Viewing binary logs requires REPLICATION SLAVE and REPLICATION CLIENT. Standard accounts and privileged accounts created in the console have these by default. If access fails, use a privileged account or grant them manually with SQL.