Docs

RDS for MySQL

Account and access authorization

Creating an account

This topic describes how to create a database account for a MySQL instance.

Prerequisites

An instance has been created and the instance state is Running. For details, see Creating an instance.

If you need to authorize an account by host IP, enable database proxy for the instance first. For more information about enabling the database proxy, refer to Enabling database proxy.

Precautions

The console Accounts page does not support creating normal accounts with the same name as super accounts but a different host IP. If your business requires this, use SQL statements to create the account. Such normal accounts created via SQL are not displayed on the console Account page. Account‑management operations for these accounts cannot be performed through the console. In addition, do not perform any operations on these accounts using API interfaces.

Creating accounts, modifying accounts, granting and revoking permissions can be completed via the console, Account‑management API interfaces, or SQL commands (CREATE USER, ALTER USER, GRANT, and REVOKE).

Instances of different versions support different password authentication plugins. The specific differences are as follows:

MySQL 5.7 instances only support the mysql_native_password password authentication plugin.

MySQL 8.0 and MySQL 8.4 instances support two password authentication plugins: mysql_native_password and caching_sha2_password . By Default, MySQL 8.0 uses mysql_native_password; MySQL 8.4 uses caching_sha2_password.

Do not directly modify authentication fields such as plugin and authentication_string via UPDATE mysql.user. Such operations bypass the consistency processing for authentication plugins and authentication data performed by MySQL account‑management statements, and do not immediately refresh privilege information stored in memory. If authentication plugins do not match authentication data, account records may be deemed invalid and ignored when privilege tables reload (for example, after you run FLUSH PRIVILEGES, restart the instance, or perform a version upgrade with a subsequent restart). Consequently, the account cannot log in, or related account management operations fail. For more information, refer to the official documentation.

If you need to specify the password authentication plugin for a new account during account creation, or modify the password authentication plugin used by an existing account, use the CREATE USER and ALTER USER commands. Example as follows:

-- Specify the password authentication plugin when creating a new account
CREATE USER 'app_user'@'%' IDENTIFIED WITH mysql_native_password BY 'psssword1';
-- Modify the password authentication plugin for an existing account
ALTER USER 'app_user'@'%' IDENTIFIED WITH caching_sha2_password BY 'password2';

Procedure

FAQ

What are the differences between a super account and a normal account?

Super account: Can manage all normal accounts and databases.

Normal account: You must manually grant specific database privileges.

tip

For detailed information about account permissions, refer to Account permission description.

Can I modify a specific permission of a super account?

The super account can only be reset to the initial status, not modified to specific permissions.

tip

For detailed information about account permissions, refer to Account permission description.

Can a database be associated with multiple accounts?

Yes.

Why is the account state 'Unavailable'?

Reason: If a database account is deleted from the command line after it has been created, its state is displayed as Unavailable in the account list on the console.

Solution: Reset the password for the account in the console to restore it to an available state. For details about resetting the password, refer to Resetting account password. We recommend performing account management operations in the console to prevent the account from becoming Unavailable.

Related API

API	Description
CreateDBAccount	Call the CreateDBAccount API to create an account.
DescribeDBAccounts	Call the DescribeDBAccounts API to view the account list.

Last updated: 2026.09.18 11:16:19