All Products
Search

This Product

    ApsaraDB RDS:Create standard, privileged, and global read-only accounts

    Document Center

    ApsaraDB RDS:Create standard, privileged, and global read-only accounts

    Dernière mise à jour :Aug 27, 2026

    You can create standard, privileged, and global read-only accounts for an ApsaraDB RDS for SQL Server instance by using the ApsaraDB RDS console or by calling an API operation.

    Prerequisites and limits

    • The first account for an instance must be a privileged account or a superuser account (with SA permissions).

    • You can create privileged and standard accounts on instances of any specification. Global read-only accounts can be created only on instances that meet the following requirements:

      • Database version: SQL Server 2016 or later.

      • Instance family: general-purpose or dedicated.

    • Account limits:

      • Standard accounts: No limit.

      • Privileged accounts: A maximum of one privileged account per instance.

      • Global read-only accounts: A maximum of two global read-only accounts per instance.

    Account permission rules

    Privileged account

    Scenario

    Description

    Create a privileged account

    Upon creation, the account is automatically granted the db_owner role for all existing databases.

    Add a database

    Delete a privileged account

    • This operation permanently removes the account and its permissions on all databases.

    • The account can no longer be used to log on or perform any database operations.

    Re-create a privileged account

    • If you re-create a privileged account, regardless of whether you use the original account name, the system automatically grants the new account the db_owner permission on all existing databases in the current instance.

    • For databases created afterward, you must still manually modify permissions to grant the account the db_owner permission.

    Manually selecting the sysadmin server role for a privileged account in SQL Server Management Studio (SSMS) does not take effect. ApsaraDB RDS applies security restrictions to privileged accounts and does not allow you to directly grant the sysadmin permission. If you need the sysadmin permission, create a superuser account (with SA permissions). After you create a superuser account, the instance is no longer covered by the SLA. For more information, see Create a database account with SA permissions.

    Standard account

    Scenario

    Description

    Create a standard account

    • When you create the account, you must manually specify the databases to authorize and the corresponding permissions (read/write, read-only, or owner).

    • If you do not authorize any databases during creation, the account will be created without access to any database.

    • You must then manually grant permissions for the account to access specific databases.

    Add a database

    Delete a standard account

    • Deleting the account permanently removes all its database access permissions.

    • The account can no longer be used to log on or perform any database operations.

    • Connections from associated applications will fail. You must update the account and password information promptly.

    Re-create a standard account with the same name

    Global read-only account

    Scenario

    Description

    Create a global read-only account

    • Upon creation, the account is automatically granted read-only permissions on all existing databases in the instance.

    • The account does not have access to the master and rdscore (if it exists) system databases.

    Add a database

    The account is automatically granted read-only access to new databases.

    Delete a global read-only account

    • Deleting the account permanently removes its read-only permissions.

    • The account can no longer be used to log on or perform any database operations.

    Re-create a global read-only account

    • If you re-create a global read-only account, regardless of whether you use the original account name, the system automatically grants it read-only permissions on all existing databases in the current instance.

    • The account is also automatically granted read-only permissions for databases created afterward.

    Precautions

    • Set a strong password: To ensure database security, set a strong password for the database account and change it regularly. You can also set a password policy for an account to control the password validity period and enhance account security.

    • Principle of least privilege: When assigning permissions, follow the principle of least privilege. Create accounts based on business roles and assign read-only and read/write permissions as needed. If necessary, you can create database accounts and databases with finer granularity. This ensures that each database account can access only the data required for its business. If an account does not need to modify data, grant it read-only permissions.

    Create an account

    1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

    2. In the left-side navigation pane, click Accounts.

    3. Click Create Account and configure the parameters.

      Note

      The first account for an ApsaraDB RDS for SQL Server instance must be a privileged account or a superuser account. You can create a standard or global read-only account only after one of these accounts has been created.

      Privileged account

      Parameter

      Description

      Database Account

      Enter a database account name. The name must start with a letter, end with a letter or a digit, and contain only lowercase letters, digits, and underscores (_). The account name cannot be the same as a reserved keyword.

      Account Type

      Select Privileged Account. Each instance can have only one privileged account.

      New Password

      Enter a password for the account. The password must meet the following requirements:

      • 8 to 32 characters in length.

      • Contains at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters.

      • The supported special characters are !@#$%^&*()_+-=.

      Confirm Password

      Enter the same password again to confirm it.

      Apply password policy

      Applying a password policy allows you to control the password validity period and enhance account security. Before you apply a policy, you must first set a password policy for an account.

      Description

      Enter a description. The description can be up to 256 characters in length.

      Standard account

      Parameter

      Description

      Database Account

      Enter a database account name. The name must start with a letter, end with a letter or a digit, and contain only lowercase letters, digits, and underscores (_). The account name cannot be the same as a reserved keyword.

      Account Type

      Select Standard Account. An instance can have multiple standard accounts.

      Authorize Database:

      You can grant a Standard Account permissions on one or more databases and set different permissions for each. If no databases exist, you can leave this field empty and grant permissions later. To grant permissions:

      1. In the Unauthorized Databases list, select the databases that you want to authorize.

      2. Click image.png to add the databases to the Authorized Databases list.

      3. Set permissions on the databases for the account. The permissions can be Read/Write (DML), Read-Only, or Owner. For more information about permissions, see Account permissions.

      New Password

      Enter a password for the account. The password must meet the following requirements:

      • 8 to 32 characters in length.

      • Contains at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters.

      • The supported special characters are !@#$%^&*()_+-=.

      Confirm Password

      Enter the same password again to confirm it.

      Apply password policy

      Applying a password policy allows you to control the password validity period and enhance account security. Before you apply a policy, you must first set a password policy for an account.

      Description

      Enter a description. The description can be up to 256 characters in length.

      Global read-only account

      Parameter

      Description

      Database Account

      Enter a database account name. The name must start with a letter, end with a letter or a digit, and contain only lowercase letters, digits, and underscores (_). The account name cannot be the same as a reserved keyword.

      Account Type

      Select Global Read-Only Account. After this account is created, it is automatically granted read-only permissions on all existing databases in the instance. These permissions also apply to any new databases that you create.

      New Password

      Enter a password for the account. The password must meet the following requirements:

      • 8 to 32 characters in length.

      • Contains at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters.

      • The supported special characters are !@#$%^&*()_+-=.

      Confirm Password

      Enter the same password again to confirm it.

      Apply password policy

      Applying a password policy allows you to control the password validity period and enhance account security. Before you apply a policy, you must first set a password policy for an account.

      Description

      Enter a description. The description can be up to 256 characters in length.

    4. Click OK. After the page refreshes, you can view the created account.

    Related documents

    FAQ

    Accounts on read-only instances

    Accounts created on a primary instance are synchronized to its read-only instances. You cannot manage accounts on read-only instances. These synchronized accounts have read-only permissions on the read-only instances and cannot be used for write operations.

    Bypass password complexity

    To ensure database security, ApsaraDB RDS for SQL Server requires that a password contains at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters, and is 8 to 32 characters in length.

    However, if you must bypass the password complexity requirements for business needs, perform the following steps:

    Important

    A simple password increases the risk of system attacks. We recommend that you set a strong password for your database account and change it regularly.

    1. In your ApsaraDB RDS instance, create a user account (for example, A). Use this account to connect to the SQL Server instance with SQL Server Management Studio (SSMS).

    2. Use account A to create the target account by running the following SQL statement, which also disables the password complexity check:

      Note

      Because Data Management (DMS) does not allow you to switch to the master database, you must use SSMS to run this SQL statement.

      -- Switch to the master database.
USE master
GO
-- Create the target account.
CREATE LOGIN [your_account_name] WITH PASSWORD=N'your_password', CHECK_EXPIRATION=OFF, CHECK_POLICY=OFF
GO
-- Enable the target account.
ALTER LOGIN [your_account_name] ENABLE
GO

      CHECK_EXPIRATION = OFF disables the password expiration feature. CHECK_POLICY = OFF disables the password complexity policy check, which includes requirements for password length and complexity.

      Note

      You can use the ApsaraDB RDS console to customize a password policy for an individual user account on an ApsaraDB RDS for SQL Server instance to implement fine-grained password management and enhance account security.

    An ApsaraDB RDS for SQL Server account is inactive and login fails with the errorThe account is disabled.?

    Issue

    On the Accounts page of an ApsaraDB RDS for SQL Server instance, the account status is displayed as Inactive. When you try to log on to the database by using an inactive account, the error message The account is disabled. is reported.

    image

    image

    Cause

    User accounts that are created on the Accounts page of an ApsaraDB RDS for SQL Server instance or by calling an API operation are active by default. You do not need to manually activate them. An account can become inactive for the following reasons:

    • The account was created in a disabled state using an SQL statement.

    • The account was manually disabled after it was created.

    Solution

    1. Use another active account to connect to the SQL Server instance by using SQL Server Management Studio (SSMS).

    2. Check whether the target account is disabled. If it is, enable the account.

      • Method 1: View and modify the account status in the SSMS graphical user interface (GUI).

        image

      • Method 2: View and modify the account status by using SQL statements.

        1. Execute the following SQL query to check the current status of the target account:

          -- Query the status of the target logon name.
SELECT 
    name AS LoginName,          -- Logon name
    is_disabled AS IsDisabled   -- Status: 1 indicates disabled, 0 indicates enabled.
FROM 
    sys.server_principals
WHERE 
    name = 'your_logon_name';

          image

        2. If the target account is disabled (is_disabled = 1), execute the following SQL command to enable the account:

          ALTER LOGIN [your_logon_name] ENABLE;

          image

    CreateAccount: AccountLimitExceeded error

    Issue

    When you call the CreateAccount API operation to create a database account, you may receive the following error if you specify incorrect parameters:

    "Code": "AccountLimitExceeded",
"Message": "AccountQuotaExceeded: Exceeding the allowed amount of account"

    This error indicates that the number of accounts in the instance has reached the maximum limit.

    Cause

    • Each instance is limited to one privileged account and one superuser account. The privileged account cannot be deleted.

    • Issue with parameter settings: In SQL Server, if the AccountType parameter is set to Sysadmin (superuser account) or Super (privileged account), and a corresponding privileged account already exists in the database, the AccountLimitExceeded error is triggered.

    Solution

    • Create a standard account: Ensure that AccountType is set to Normal. ApsaraDB RDS generally does not limit the number of standard accounts, but the specific number depends on the instance kernel.

    • Create a privileged account: Ensure that AccountType is set to Super. On the Accounts page of the ApsaraDB RDS console, check if a privileged account already exists in the instance. If one already exists, avoid creating a duplicate.

    • Create a superuser account: Ensure that AccountType is set to Sysadmin. You can check whether a privileged account already exists for the instance on the Accounts page in the ApsaraDB RDS console. If one already exists, do not create a duplicate.