ApsaraDB RDS:Create standard, privileged, and global read-only accounts

Choose an account type

When to use which type:

• Privileged account: Use as your primary administration account. It gets db_owner access on all existing databases automatically, making it suitable for DBA tasks across the instance.

• Standard account: Use for application connections or role-based access. Assign permissions per database and per role (read/write, read-only, or owner) to follow the principle of least privilege.

• Global read-only account: Use for read-heavy workloads such as analytics, reporting, or monitoring. It automatically covers all current and future databases without requiring per-database authorization.

Prerequisites

Before you begin, ensure that you have:

• A running ApsaraDB RDS for SQL Server instance

• A privileged account or superuser account (SA permissions) as the first account on the instance — standard and global read-only accounts can only be created after one exists

• (For global read-only accounts only) An instance running SQL Server 2016 or later on the General-purpose or dedicated instance family

Create an account

1. Go to the Instances page. In the top navigation bar, select the region where your RDS instance resides. Click the instance ID.

2. In the left navigation pane, click Accounts.

3. Click Create Account and fill in the parameters for your account type.

Privileged account

Parameter	Description
Database account	Enter a name that starts with a letter and ends with a letter or digit. The name can contain lowercase letters, digits, and underscores (_). Avoid keywords.
Account type	Select Privileged Account. One privileged account is allowed per instance.
New password	8–32 characters. Must include at least three of the following: uppercase letters, lowercase letters, digits, and special characters (!@#$%^&*()_+-=).
Confirm password	Re-enter the password.
Apply password policy	(Optional) Attach a password policy to control the validity period and enhance security.
Description	(Optional) Up to 256 characters.

Standard account

Parameter	Description
Database account	Enter a name that starts with a letter and ends with a letter or digit. The name can contain lowercase letters, digits, and underscores (_). Avoid keywords.
Account type	Select Standard Account.
Authorize database	(Optional) Grant the account access to one or more databases. In the Unauthorized databases list, select a database, click to move it to Authorized databases, then set the permission to Read/Write (DML), Read-Only, or Owner. If you skip this step, the account is created with no database access. For details on permission levels, see Account permissions.
New password	8–32 characters. Must include at least three of the following: uppercase letters, lowercase letters, digits, and special characters (!@#$%^&*()_+-=).
Confirm password	Re-enter the password.
Apply password policy	(Optional) Attach a password policy to control the validity period and enhance security.
Description	(Optional) Up to 256 characters.

Global read-only account

Parameter	Description
Database account	Enter a name that starts with a letter and ends with a letter or digit. The name can contain lowercase letters, digits, and underscores (_). Avoid keywords.
Account type	Select Global Read-Only Account. Two global read-only accounts are allowed per instance. After creation, the account is automatically granted read-only access to all existing databases and any databases added later.
New password	8–32 characters. Must include at least three of the following: uppercase letters, lowercase letters, digits, and special characters (!@#$%^&*()_+-=).
Confirm password	Re-enter the password.
Apply password policy	(Optional) Attach a password policy to control the validity period and enhance security.
Description	(Optional) Up to 256 characters.

1. Click OK. After the page refreshes, the account appears in the account list.

Permission behavior reference

Each account type behaves differently when databases are added, deleted, or recreated. Understanding this helps you avoid unexpected access issues.

Security best practices

• Use strong passwords. Set a complex password and rotate it regularly. Attach a password policy to enforce expiration rules.

• Apply least privilege. Create accounts based on business roles and assign only the permissions each role needs. If write access is not required, use read-only permissions.

• Avoid using a privileged account in applications. Use a standard account with scoped permissions for application connections instead.

FAQ

Why does my account show as Inactive and return "The account is disabled."?

Symptoms

Accounts created through the console or the API are active by default. If an account shows as Inactive on the Accounts page and returns The account is disabled. on logon, it was either disabled via SQL at creation or manually disabled afterward.

To re-enable the account, use an active account to connect to the instance via SSMS, then choose one of the following methods:

• Method 1: Use the SSMS GUI. Right-click the login in Object Explorer, open Properties, and set the status to Enabled.

  

• Method 2: Use SQL statements. Check the current account status:

  SELECT
      name AS LoginName,
      is_disabled AS IsDisabled   -- 1 = disabled, 0 = enabled
  FROM sys.server_principals
  WHERE name = 'ReplaceWithTargetLoginName';

  If is_disabled = 1, enable the account:

  ALTER LOGIN [ReplaceWithTargetLoginName] ENABLE;

  

  

Causes

Solution

Next steps

• Create a database account with SA permissions using the console.

• Modify account permissions after adding new databases.

• Create accounts via API: CreateAccount.

• Delete accounts via API: DeleteAccount.