Creating a Database Account

Scenarios

When you create a DB instance, account root is created at the same time by default. You can create other database accounts as needed.

If your RDS instance is associated with a DDM instance, go to the DDM console to manage databases and accounts.

You can create a database account using RDS or DAS:

RDS: RDS is easy to use. There are no special commands to remember.
DAS: DAS is a powerful platform that offers more flexibility, but you need to be familiar with the creation commands. The process requires a bit more expertise.

Account Type

**Table 1** Account description
Account Type	Description
Administrator account root	Only the administrator account root is provided on the instance creation page. For details about the supported permissions, see RDS for MySQL Constraints. NOTE: Running revoke, drop user, or rename user on root may cause service interruption. Exercise caution when running any of these statements.
System accounts	To provide O&M services, the system automatically creates system accounts when you create RDS for MySQL DB instances. These system accounts are unavailable to you. rdsAdmin: a management account with the highest permission. It is used to query and modify instance information, rectify faults, migrate data, and restore data. rdsRepl: a replication account, used to synchronize data from the primary instance to the standby instance or read replicas. rdsBackup: a backup account, used for backend backup. rdsMetric: a metric monitoring account used by watchdog to collect database status data. rdsProxy: a database proxy account, used for authentication when the database is connected through the read/write splitting address. This account is automatically created when you enable read/write splitting.
Other accounts	Accounts created through the console, APIs, or SQL statements After an account is created, you can assign permissions to it as required. For details, see Changing Permissions for a Database Account.

Constraints

Accounts cannot be created for DB instances that are being restored.
Databases and accounts created using other methods than the RDS console and APIs are also displayed on the RDS console. If the names of the created databases or accounts do not meet the database naming rule or account naming rule, for example, the names containing Chinese characters or unsupported special characters, the databases or accounts cannot be managed on the RDS console or through APIs.
If the name of any database or account on the source database does not meet the database naming rule or account naming rule, the database or account cannot be managed on the RDS console or through APIs after being migrated to the destination RDS for MySQL instance.

Creating a Database Account Through RDS

Log in to the management console.
Click in the upper left corner and select a region.
Click in the upper left corner of the page and choose Databases > Relational Database Service.
On the Instances page, click the target instance name.
In the navigation pane, choose Accounts and then click Create Account. In the displayed dialog box, specify Username and Host IP Address, authorize permissions for databases, enter a password, and confirm the password. Then, click OK.

Figure 1 Creating a database account
- If the DB engine version is MySQL 5.6, the username can contain 1 to 16 characters. Only letters, digits, hyphens (-), and underscores (_) are allowed.
- If the DB engine version is MySQL 5.7 or 8.0, the username can contain 1 to 32 characters. Only letters, digits, hyphens (-), and underscores (_) are allowed.
- You can specify IP addresses that are allowed to access your DB instance.
  - To enable all IP addresses to access your instance, enter % for Host IP Address.
  - To enable all IP addresses in the subnet 10.10.10.X to access your instance, enter 10.10.10.% for Host IP Address.
  - To specify multiple IP addresses, separate them with commas (,), for example, 192.168.0.1,172.16.213.9 (no spaces before or after the comma).
- Select unauthorized databases and click to authorize them or select authorized databases and click to revoke permissions.
  If there are no unauthorized databases, you can create one by referring to Creating a Database. You can also modify the permissions after the account creation by referring to Changing Permissions for a Database Account.
- The password must consist of 8 to 32 characters and contain at least three types of the following characters: uppercase letters, lowercase letters, digits, and special characters (~ ! @ # $ % ^ * - _ = + ? , ( ) & . | ).
- The password must be different from the username or username spelled backwards.
- You are advised to enter a strong password to improve security and prevent security risks such as brute force cracking.
- If you require fine-grained permissions control, log in to the database through the DAS console.
After the database account is created, you can add remarks (for 8.0.25 and later versions), reset the password, modify permissions, change the host IP addresses for the account, and delete the account.

Creating a Database Account Through DAS

Log in to the management console.
Click in the upper left corner and select a region.
Click in the upper left corner of the page and choose Databases > Relational Database Service.
On the Instances page, locate the DB instance and click Log In in the Operation column.
On the displayed page, enter the correct username and password and click Log In.
Create an account.
- On the top menu bar, choose Account Management > User Management. On the displayed page, click Create User. Then, configure basic information, advanced settings, global permissions, and object permissions, and click Save. In the displayed dialog box, click OK.
  For details about how to set permissions, see Creating a User.
- You can also choose SQL Operations > SQL Query from the top menu bar and run the following command to create an account:
  create user username;