Docs

RDS for MySQL

Account and access authorization

Modifying account permissions

You can modify the permissions of a normal account as needed. This topic explains how to modify account privileges for a normal account and the procedure.

Prerequisites

An instance is created and in the Running state. For details, see Creating an instance.

An account has been created. For more information on specific operations, refer to Creating an account.

The instance account permission is Normal account.

Precautions

A super account can only be reset to the initial status. Its permissions cannot be modified.

Modifying account permissions may cause impact on business, proceed with caution.

Only databases that meet the database name naming rules can be deleted through the console.

If the account obtains permissions that are not supported by RDS for MySQL through non-console methods, it cannot modify the permissions through the console. It is recommended to use the command-line tool to adjust the permissions. For the permissions supported by RDS for MySQL, see Account permissions.

Procedure

Log on to the RDS for MySQL console.

In the upper-left corner of the top menu bar, select the project and region for the instance.

tip

If the project of the instance has not been set, the project should be selected as All resources.

Click on Instances in the left navigation bar.

On the Instances page, click on the target instance name.

Click Accounts at the top of the page.

On the Accounts tab, click Modify permission in the Actions column of the target account.

Set the following parameters in the Modify permission pop-up dialog box.

Parameter	Description
Host IP	Required. Specifies the IP address where the account accesses the database. If the host IP is specified as %, allow the account to access the database from any IP address. If the host IP is specified as 192.10.10.%, the account can access the database from IP addresses between 192.10.10.0 and 192.10.10.255. The specified host IP needs to be added to the allowlist to which the instance is associated with, otherwise the instance cannot be accessed normally. For information on adding IP addresses to an allowlist, see Modifying an allowlist. tip If the account type created is a super account, the host IP can only be specified as %. If you need to specify the IP address for the account to access the database, you need to enable the database agent service for the instance. For more information, refer to Enabling the database proxy.
Permission settings	Grant global authorization for the account within the instance scope, authorization for a specified database, or authorization for tables and columns under a specified database. tip Only permission setting for normal accounts is supported, and super accounts have all permissions by default. Only databases that meet the database name naming rules can be deleted through the console. Global authorization Set instance-wide global permissions for the account. The available global permissions are shown in the table below. You can select multiple permissions. In the Global authorization area, check the corresponding permissions. PROCESS Allows viewing information about all currently executing threads and processes. REPLICATION SLAVE Allows replication of data from the primary server. REPLICATION CLIENT Allows viewing and managing the status and parameters of the replication process. SELECT Allows querying data from the specified table. INSERT Allows inserting new data into the table. UPDATE Allows updating data in the specified table. DELETE Allows deletion of data from the specified table. CREATE Allows creation of new databases, tables, views, stored procedures, functions, and other objects. DROP Allows deletion of databases, tables, views, stored procedures, functions, and other objects. RELOAD Allows reloading of system configuration files, restarting or shutting down the database, and other operations. REFERENCES Allows creation or deletion of foreign key constraints in the current database. INDEX Allows creation and deletion of indexes. ALTER Allows modification of the structure of tables in the database, including operations such as changing fields, adding or deleting fields, and adding and deleting indexes. LOCK TABLES Allows locking the specified data table for read and write operations. EXECUTE Allows execution of existing stored procedures and functions, etc. CREATE VIEW Allows creation of view objects. SHOW VIEW Allows displaying the definition of views. CREATE ROUTINE Allows creation of routine objects such as stored procedures and functions. ALTER ROUTINE Allows modification of the definition of routines such as stored procedures and functions. CREATE USER Allows creation of new users. EVENT Allows creation, modification, and deletion of events. TRIGGER Allows creation and management of triggers. SHOW DATABASES Allows displaying all databases in the current database server. CREATE TEMPORARY TABLES Allows creation of temporary tables. Database-specific authorization Grants the account permissions for the specified databases. In the Database list of the Database-specific authorization area, click text box in the Permissions column of the database for which permissions need to be set, and click OK after checking the corresponding permissions in the drop-down menu. tip If you need to set the same permissions for multiple databases, you can check multiple target databases, click Batch setting of permissions, and click OK after checking permissions in the pop-up window. Supports granting the account Read/Write (DDL+DML), Read-only, DDL only, DML only, or Custom permissions for the specified database. Custom permissions can be one or more of SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, REFERENCES, INDEX, ALTER, CREATE TEMPORARY TABLES, LOCK TABLES, EXECUTE, CREATE VIEW, EVENT, SHOW VIEW, TRIGGER, CREATE ROUTINE and ALTER ROUTINE. Authorization for tables and columns in a specified database Grants permissions to some tables or columns in a specified database to an account. In the database list of the Database-specific authorization area, click the icon to the right of the name of the database for which table and column permissions need to be seticon. In the pop-up Set table and column permissions window, select the target table or column, select the permissions on the right side of the window, and click OK. tip When the account has permissions for tables or columns in the database, the icon to the right of the database name will be displayed as。 Note: If a table or column for which the account has permissions is deleted, the icon will be displayed as。 If you retain the permissions of the account associated with the database for a database with the same name when deleting the database, and the account has list permissions for that database. After creating a new database with the same name, the icon will be displayed as。 Up to 200 data tables can be listed in the Set table and column permissions window. If the table or column for which you need to set permissions is not listed, use the Search table or Search column function to find it. Supports granting accounts one or more of the following permissions for specified tables: ALTER, CREATE, DELETE, DROP, INDEX, INSERT, SELECT, SHOW VIEW, TRIGGER, UPDATE, CREATE VIEW, REFERENCES. Supports granting accounts one or more of the following permissions for specified columns: INSERT, REFERENCES, SELECT, UPDATE.

tip

You can also click Preview to preview the SQL statement for modifying the account's permission configuration. Note that if a database name contains an underscore (_), the underscore is escaped as (\_) in the SQL statement when granting permissions to an account.

Click OK to complete the permission modification of the account.

Related API

API	Description
GrantDBAccountPrivilege	Call GrantDBAccountPrivilege API to grant database account permissions.

Last updated: 2026.04.24 19:03:01