ApsaraDB RDS controls access to instances and databases through two account types — privileged and standard — each with a distinct scope of permissions.
Account types
RDS for MySQL supports two account types: one privileged account and multiple standard accounts per instance.
|
Account type |
What it can do |
How to create |
|
Privileged account |
Full permissions on all databases. Can manage all databases and standard accounts on the instance and disconnect any session. |
Console or API only |
|
Standard account |
Operates on specific databases only. Has logon permission by default — all other permissions must be explicitly granted. Cannot create, manage, or disconnect other accounts. |
Console, API, or SQL |
Quotas
|
Account type |
Databases |
Tables |
Users |
|
Privileged account |
Unlimited |
Fewer than 200,000 |
Based on instance kernel parameters |
|
Standard account |
Up to 500 |
Fewer than 200,000 |
Based on instance kernel parameters |
The database count may also be limited by the file system folder limit.
Choosing an account type
Create one privileged account for instance management, then create separate standard accounts for each application or service. Do not embed privileged account credentials in application code — use standard accounts with least-privilege permissions instead.
Account types cannot be changed after creation. To change an account's type, delete the account and create a new one with the same name.
Permission levels for standard accounts
When granting a standard account access to a database, choose one of these permission levels:
|
Permission level |
Operations included |
|
Read/Write (DDL + DML) |
Full read and write access, including schema changes (DDL) and data manipulation (DML) |
|
Read-Only |
SELECT queries only |
|
DDL Only |
Schema changes only (CREATE, ALTER, DROP) |
|
DML Only |
Data manipulation only (INSERT, UPDATE, DELETE, SELECT) |
For the full list of SQL privileges in each permission level, see List of account permissions.
A standard account starts with only logon permission. Grant database-level permissions when creating the account or at any time afterward.
Account naming requirements
These requirements apply to both account types:
-
Length: 2–16 characters for MySQL 5.6; 2–32 characters for MySQL 5.7 and MySQL 8.0
-
Characters: letters, digits, and underscores (
_) -
Format: must start with a letter and end with a letter or digit
-
Uniqueness: cannot duplicate an existing account name
-
Similarity: a standard account name cannot be similar to the privileged account name (for example, if the privileged account is
Test1, you cannot create a standard account namedtest1) -
Reserved keywords: not allowed
Security best practices
Follow the principle of least privilege when assigning permissions:
-
Grant each application or service only the permissions it needs — use Read-Only for reporting workloads, DML Only for applications that do not need schema changes.
-
Create one standard account per application or service rather than sharing a single account across multiple applications.
-
Do not embed privileged account credentials in application code or configuration files.
-
If an account password is compromised or forgotten, reset it from the console at any time.
-
For MySQL 5.7 and MySQL 8.0, configure a custom password policy to enforce stricter password requirements.