All Products
Search

This Product

    ApsaraDB RDS:Create standard, privileged, and global read-only accounts

    Document Center

    ApsaraDB RDS:Create standard, privileged, and global read-only accounts

    Last Updated:Jun 21, 2026

    You can create standard, privileged, and global read-only accounts for an ApsaraDB RDS for SQL Server instance in the ApsaraDB RDS console or by calling an API operation.

    Prerequisites

    • The first account that you create for an instance must be a privileged account or a superuser account (SA permissions).

    • You can create privileged accounts and standard accounts for instances of all instance families. You can create global read-only accounts for instances that meet the following requirements:

      • Database engine version: SQL Server 2016 or later.

      • Instance family: general-purpose or dedicated.

    • Account limits:

      • Standard accounts: No limit.

      • Privileged accounts: A maximum of one privileged account per instance.

      • Global read-only accounts: A maximum of two global read-only accounts per instance.

    Account permission rules

    Privileged account

    Scenario

    Permission behavior

    Create a privileged account

    When you create a privileged account, the system automatically grants it the db_owner role for all existing databases. Manual authorization is not required.

    Add a database

    Delete a privileged account

    • This operation permanently removes the account and its permissions on all databases.

    • The account can no longer be used to log on or perform any database operations.

    Recreate a privileged account

    • If you create a privileged account again, regardless of whether you use the original account name, the system automatically grants the new account the db_owner role for all existing databases in the current instance.

    • For databases created later, you still need to manually modify permissions to grant the account the db_owner role.

    Standard account

    Scenario

    Permission behavior

    Create a standard account

    • When you create the account, you must manually specify the authorized databases and the corresponding permissions (Read/write, read-only, or Owner).

    • If you do not select any databases, the account is created but does not have permissions to access any database.

    • Permissions for this account must be manually granted.

    Add a database

    Delete a standard account

    • Deleting an account permanently removes all its database access permissions.

    • The account can no longer be used to log on or perform any database operations.

    • Connections from associated applications will fail. You must promptly update the account and password information.

    Recreate a standard account with the same name

    Global read-only account

    Scenario

    Permission behavior

    Create a global read-only account

    • After the account is created, it is automatically granted read-only permissions on all existing databases in the instance. You do not need to grant permissions for each database.

    • The account does not have access permissions on the master and rdscore (if it exists) system databases.

    Add a database

    The account automatically gains read-only access to new databases.

    Delete a global read-only account

    • This operation permanently removes the account and its read-only permissions.

    • The account can no longer be used to log on or perform any database operations.

    Recreate a global read-only account

    • If you create a global read-only account again, regardless of whether you use the original account name, the system automatically grants the account read-only permissions on all existing databases in the current instance.

    • The account automatically gains read-only permissions on databases created later. Manual authorization is not required.

    Important notes

    • Use strong passwords: To ensure database security, set a strong password for your database account and change it regularly. You can also set a password policy for an account to control the password validity period and enhance account security.

    • Follow the principle of least privilege: Assign permissions according to the principle of least privilege. Create accounts based on business roles and assign read-only and read/write permissions as needed. If necessary, create database accounts and databases with finer granularity. This ensures that each database account can access only the data that is required for its business. If write operations are not required, assign read-only permissions.

    Create an account

    1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

    2. In the left-side navigation pane, click Accounts.

    3. Click Create Account and configure the following parameters.

      Note

      The first account for an instance must be a privileged account or a superuser account. You can create other account types only after one of these exists.

      Privileged account

      Parameter

      Description

      Database Account

      Enter a name for the database account. The name must start with a lowercase letter and end with a lowercase letter or a digit. The name can contain lowercase letters, digits, and underscores (_). The account name cannot be the same as a keyword.

      Account Type

      Select Privileged Account. Each instance supports only one privileged account.

      New Password

      Enter a password for the account. The password must meet the following requirements:

      • The password must be 8 to 32 characters in length.

      • The password must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters.

      • The following special characters are supported: !@#$%^&*()_+-=.

      Confirm Password

      Enter the password again to confirm.

      Apply password policy

      By applying a password policy, you can control the password validity period and enhance account security. Before you apply a policy, you must set a password policy for the account.

      Description

      Enter a description. The description can be up to 256 characters in length.

      Standard account

      Parameter

      Description

      Database Account

      Enter a name for the database account. The name must start with a lowercase letter and end with a lowercase letter or a digit. The name can contain lowercase letters, digits, and underscores (_). The account name cannot be the same as a keyword.

      Account Type

      Select Standard Account. An instance can have multiple standard accounts.

      Authorize Database:

      You can grant a Standard Account permissions on one or more databases and set different permissions for each database. If no databases exist, you can leave this field empty and grant permissions to the account later. To grant permissions, perform the following steps:

      1. In the Unauthorized Databases list, select the databases that you want to authorize.

      2. Click image.png to add the databases to the Authorized Databases list.

      3. Set permissions on the databases for the account. You can set the permissions to Read/Write (DML), Read-Only, or Owner. For more information about permissions, see Account permissions.

      New Password

      Enter a password for the account. The password must meet the following requirements:

      • The password must be 8 to 32 characters in length.

      • The password must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters.

      • The following special characters are supported: !@#$%^&*()_+-=.

      Confirm Password

      Enter the password again to confirm.

      Apply password policy

      By applying a password policy, you can control the password validity period and enhance account security. Before you apply a policy, you must set a password policy for the account.

      Description

      Enter a description. The description can be up to 256 characters in length.

      Global read-only account

      Parameter

      Description

      Database Account

      Enter a name for the database account. The name must start with a lowercase letter and end with a lowercase letter or a digit. The name can contain lowercase letters, digits, and underscores (_). The account name cannot be the same as a keyword.

      Account Type

      Select global read-only account. After this account is created, it is automatically granted read-only permissions on all existing databases in the instance. These permissions also apply to new databases.

      New Password

      Enter a password for the account. The password must meet the following requirements:

      • The password must be 8 to 32 characters in length.

      • The password must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters.

      • The following special characters are supported: !@#$%^&*()_+-=.

      Confirm Password

      Enter the password again to confirm.

      Apply password policy

      By applying a password policy, you can control the password validity period and enhance account security. Before you apply a policy, you must set a password policy for the account.

      Description

      Enter a description. The description can be up to 256 characters in length.

    4. Click OK. After the page refreshes, you can view the account that you created.

    References

    FAQ

    Accounts on read-only instances

    Accounts that are created on a primary instance are synchronized to its read-only instances. You cannot manage accounts on read-only instances. On a read-only instance, accounts have only read-only permissions and cannot be used to perform write operations.

    Bypass password complexity check

    To ensure database security, ApsaraDB RDS for SQL Server requires passwords to be 8 to 32 characters in length and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters.

    If you must bypass the password complexity check for business needs, follow these steps:

    Important

    A simple password increases the risk of system attacks. We recommend that you set a strong password for your database account and change it regularly.

    1. Create a user account on the RDS instance (Account A). Use SQL Server Management Studio (SSMS) and this account to connect to the SQL Server instance.

    2. Use account A to create the target account. When you create the target account, disable the password complexity check by running the following SQL statements:

      Note

      You cannot switch to the master database for a SQL Server connection by using DMS. Please connect by using SSMS and execute SQL statements.

      -- Switch to the master database.
USE master
GO
-- Create the target account.
CREATE LOGIN [Target Account Name] WITH PASSWORD=N'Target Account Password', CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF
GO
-- Enable the target account.
ALTER LOGIN [Target Account Name] ENABLE
GO

      CHECK_EXPIRATION = OFF disables the password expiration feature. CHECK_POLICY = OFF disables the password complexity policy check, which includes requirements for password length and complexity.

      Note

      You can use the ApsaraDB RDS console to customize password policies for individual user accounts on an ApsaraDB RDS for SQL Server instance to implement fine-grained password management and enhance account security.

    An ApsaraDB RDS for SQL Server account is inactive and login failsThe account is disabled.?

    Symptoms

    On the Accounts page of an ApsaraDB RDS for SQL Server instance, the status of a user account is displayed as inactive. When you use the inactive account to log on to the database, the The account is disabled. error is returned.

    The full error message is Login failed for user 'zht01'. Reason: The account is disabled., which corresponds to Microsoft SQL Server error 18470.

    Causes

    User accounts that are created on the Accounts page of an ApsaraDB RDS for SQL Server instance or by calling an API operation are active by default and do not need to be manually activated. If the status of an account changes to inactive, the cause might be one of the following:

    • The account status was specified as disabled when you created the account by using an SQL statement.

    • The account status was manually changed to disabled after you created the account in the ApsaraDB RDS console or by calling an API operation.

    Solution

    1. Use SSMS and another active account to connect to the SQL Server instance.

    2. Check whether the target user account is disabled. If it is, enable it.

      • Method 1: Use the SSMS GUI to check and modify the account status.

        In the SSMS Object Explorer, expand Security > Logins. Double-click the target login (for example, zht01) to open the Login Properties dialog box. On the left, click Status. In the Login section on the right, select Enabled and click OK.

      • Method 2: Use SQL to check and modify the account status.

        1. Run the following SQL query to confirm the current status of the target account:

          -- Query the status of the target login.
SELECT 
    name AS LoginName,          -- Login name
    is_disabled AS IsDisabled   -- Status: 1 indicates disabled, and 0 indicates enabled.
FROM 
    sys.server_principals
WHERE 
    name = 'Replace with the target login name';
          LoginName    IsDisabled
---------    ----------
zht01        1

        2. If the target account is disabled (is_disabled = 1), run the following SQL command to enable the account:

          ALTER LOGIN [Replace with the target login name] ENABLE;
          ALTER LOGIN zht01 ENABLE;
Commands completed successfully.
Completion time: 2025-06-26T13:58:17.5090371+08:00

    Error when creating a user by calling the CreateAccount operationAccountLimitExceeded?

    Symptoms

    When you call the CreateAccount API operation to create a database account, you may receive the following error if you specify incorrect parameters:

    "Code": "AccountLimitExceeded",
"Message": "AccountQuotaExceeded: Exceeding the allowed amount of account"

    This error indicates that the number of accounts on the instance has reached the maximum limit.

    Causes

    • Account limit: A maximum of one privileged account and one superuser account is allowed per instance. The privileged account cannot be deleted.

    • Incorrect parameter settings: For SQL Server instances, the AccountLimitExceeded error occurs if you set the AccountType parameter to Sysadmin (superuser account) or Super (privileged account), but an account of that type already exists.

    Solutions

    • Create a standard account: Set the AccountType parameter to Normal. ApsaraDB RDS typically does not limit the number of standard accounts. The actual limit depends on the instance kernel.

    • Create a privileged account: Set the AccountType parameter to Super. On the Accounts page of the ApsaraDB RDS console, check whether a privileged account already exists. If one exists, do not create another.

    • Create a superuser account: Set the AccountType parameter to Sysadmin. On the Accounts page of the ApsaraDB RDS console, check whether a superuser account already exists. If one exists, do not create another.