Database Account Security

Setting the Account Password Complexity

For information about the database password strength requirements on the RDS console, see the database configuration table in Buy a DB Instance.

When you are creating a DB instance, the password strength is checked. You can modify the password strength as user root. For security reasons, you are advised to use a password that is at least as strong as the default password.

Account Description

To provide O&M services, the system automatically creates system accounts when you create RDS for MariaDB instances. These system accounts are unavailable to you.

Attempting to delete, rename, and change passwords or permissions for these accounts will result in an error. Exercise caution when performing these operations.

• rdsAdmin: a management account, used to query and modify instance information, rectify faults, migrate data, and restore data.
• rdsRepl: the replication account, which is used to synchronize data from primary DB instances to standby DB instances or read replicas.
• rdsBackup: the backup account, which is used for backend backup.
• rdsMetric: the metric monitoring account, which is used by watchdog to collect database status data.

Setting Password Complexity

1. Log in to the management console.
2. Click in the upper left corner and select a region and a project.
3. Click in the upper left corner of the page and choose Databases > Relational Database Service.
4. On the Instances page, click the DB instance to navigate to the Basic Information page.

   Passwords must:

   • Consist of at least eight characters.
   • Contain at least one uppercase letter, one lowercase letter, one digit, and one special character.
   • Must be different from the username.

5. In the navigation pane on the left, choose Parameters. On the displayed page, modify the required parameters.

   RDS for MariaDB allows you to modify the following parameters:

   • simple_password_check_minimal_length: Set this parameter to 8.
   • simple_password_check_letters_same_case: Set this parameter to 1.
   • simple_password_check_digits: Set this parameter to 1.
   • simple_password_check_other_characters: Set this parameter to 1.
   

   Check the value in the Effective upon Reboot column.

   • If the value is Yes and the DB instance status on the Instances page is Parameter change. Pending reboot, a reboot is required for the modifications to take effect.
     • If you have modified parameters of a primary DB instance, you need to reboot the primary DB instance for the modifications to take effect. (For primary/standby DB instances, the parameter modifications are also applied to the standby DB instance.)
     • If you have modified parameters of a read replica, you need to reboot the read replica for the modifications to take effect.
   • If the value is No, the modifications take effect immediately.

6. Perform the following operations as needed:
   • To save the modifications, click Save.
   • To cancel the modifications, click Cancel.
   • To preview the modifications, click Preview.

   After the parameters are modified, you can click Change History to view parameter modification details.