DocsICP FilingConsole
官方文档
首页

Create a high-privilege account using Terraform

更新时间：
复制 MD 格式
我的收藏

This topic describes how a RAM user can use Terraform to call the OpenAPI of AnalyticDB for MySQL to create a high-privilege account for an Enterprise Edition, Basic Edition, or Lakehouse Edition cluster.

Note

You can run the sample code in this tutorial with a single click. Run

Prerequisites

  • An Alibaba Cloud account has full permissions for all resources. To mitigate security risks from potential credential leaks, we recommend using a RAM user with its own AccessKey. For more information, see Create a RAM user and Create an AccessKey.

  • RAM authorization allows you to manage resource access for multi-user collaboration. Granting least-privilege access helps reduce security risks from excessive permissions. For more information, see Manage the permissions of a RAM user.

    Permission policy

    {
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "vpc:DescribeVpcAttribute",
                "vpc:DescribeRouteTableList",
                "vpc:DescribeVSwitchAttributes",
                "vpc:DeleteVpc",
                "vpc:DeleteVSwitch",
                "vpc:CreateVpc",
                "vpc:CreateVSwitch",
                "vpc:ModifyVpcAttribute",
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "bss:ModifyAgreementRecord",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "bss:DescribeOrderList",
                "bss:DescribeOrderDetail",
                "bss:PayOrder"
            ],
            "Resource": "*"
        },
        {
            "Action": "ram:ListUserBasicInfos",
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "ads.aliyuncs.com"
                }
            }
        },
        {
            "Action": "ram:PassRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "acs:Service": "ads.aliyuncs.com"
                }
            }
        }
    ]
}

  • Prepare a Terraform runtime environment. You can use Terraform in one of the following ways:

    • Use Terraform in Terraform Explorer: Alibaba Cloud provides an online environment for Terraform. You do not need to install Terraform. After you log on, you can use Terraform online. This method is fast, convenient, and free, making it ideal for testing and debugging.

    • Use Terraform to quickly create resources: Alibaba Cloud Cloud Shell comes with Terraform preinstalled and pre-configured with your credentials. You can run Terraform commands directly in Cloud Shell. This method provides fast, low-cost, and convenient access to Terraform.

    • Install and configure Terraform locally: This method is ideal if you have a poor network connection or require a custom development environment.

Resources

Note

If you no longer need these resources after the tutorial, delete them promptly to avoid further charges.

Create a database account

This example shows how to create a high-privilege account for an AnalyticDB for MySQL Lakehouse Edition cluster.

  1. Create a working directory, and then create a file named main.tf within it. Copy the following code into the main.tf file.

    • Create the prerequisite resources.

      variable "name" {
  default = "terraform-example"
}

variable "region" {
  default = "cn-shenzhen"
}

variable "zone_id" {
  default = "cn-shenzhen-e"
}

provider "alicloud" {
  region = var.region
}

resource "alicloud_vpc" "default" {
  vpc_name   = "alicloud"
  cidr_block = "172.16.0.0/16"
}

resource "alicloud_vswitch" "default" {
  vpc_id     = alicloud_vpc.default.id
  cidr_block = "172.16.192.0/20"
  zone_id    = var.zone_id
}

resource "alicloud_adb_db_cluster_lake_version" "CreateInstance" {
  storage_resource              = "0ACU"
  zone_id                       = var.zone_id
  vpc_id                        = alicloud_vpc.default.id
  vswitch_id                    = alicloud_vswitch.default.id
  db_cluster_description        = var.name
  compute_resource              = "32ACU"
  db_cluster_version            = "5.0"
  payment_type                  = "PayAsYouGo"
  security_ips                  = "127.0.0.1"
  enable_default_resource_group = false
}

    • Add the following resource "alicloud_adb_lake_account" "default" block to your main.tf file.

      resource "alicloud_adb_lake_account" "default" {
  db_cluster_id    = alicloud_adb_db_cluster_lake_version.CreateInstance.id
  account_type     = "Super"
  account_name     = "tfnormal"
  account_password = "normal@2023"
  account_privileges {
    privilege_type = "Database"
    privilege_object {
      database = "MYSQL"
    }

    privileges = [
      "select",
      "update"
    ]
  }
  account_privileges {
    privilege_type = "Table"
    privilege_object {
      database = "INFORMATION_SCHEMA"
      table    = "ENGINES"
    }

    privileges = [
      "update"
    ]
  }
  account_privileges {
    privilege_type = "Column"
    privilege_object {
      table    = "COLUMNS"
      column   = "PRIVILEGES"
      database = "INFORMATION_SCHEMA"
    }

    privileges = [
      "update"
    ]
  }

  account_description = var.name
}

  2. Run the following command to initialize the Terraform runtime environment:

    terraform init

    The following output indicates that Terraform has been successfully initialized.

    Initializing the backend...

Initializing provider plugins...
- Checking for available provider plugins...
- Downloading plugin for provider "alicloud" (hashicorp/alicloud) 1.90.1...
...

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other

  3. Create an execution plan and preview the changes.

    terraform plan

  4. Run the following command to create the resources:

    terraform apply

    When prompted, enter yes and press Enter. After the operation completes, the following output indicates that the resources were created successfully.

    alicloud_vpc.default: Refreshing state... [id=vpc-****]
alicloud_vswitch.default: Refreshing state... [id=vsw-****]
alicloud_adb_db_cluster_lake_version.CreateInstance: Refreshing state... [id=amv-****]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the
following symbols:
  + create

Terraform will perform the following actions:

  # alicloud_adb_lake_account.default will be created
  + resource "alicloud_adb_lake_account" "default" {
      + account_description = "terraform-example"
      + account_name        = "tfnormal"
      + account_password    = (sensitive value)
      + account_type        = "Super"
      + db_cluster_id       = "amv-****"
      + id                  = (known after apply)
      + status              = (known after apply)

      + account_privileges {
          + privilege_type = "Column"
          + privileges     = [
              + "update",
            ]

          + privilege_object {
              + column   = "PRIVILEGES"
              + database = "INFORMATION_SCHEMA"
              + table    = "COLUMNS"
            }
        }
      + account_privileges {
          + privilege_type = "Table"
          + privileges     = [
              + "update",
            ]

          + privilege_object {
              + column   = (known after apply)
              + database = "INFORMATION_SCHEMA"
              + table    = "ENGINES"
            }
        }
      + account_privileges {
          + privilege_type = "Database"
          + privileges     = [
              + "select",
              + "update",
            ]

          + privilege_object {
              + column   = (known after apply)
              + database = "MYSQL"
              + table    = (known after apply)
            }
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

alicloud_adb_lake_account.default: Creating...
alicloud_adb_lake_account.default: Creation complete after 4s [id=amv-****:tfnormal]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

  5. Verify the result.

    Terraform show

    Run terraform show to view the account you created.

    terraform show
    # alicloud_adb_lake_account.default:
resource "alicloud_adb_lake_account" "default" {
    account_description = "terraform-example"
    account_name        = "tfnormal"
    account_password    = (sensitive value)
    account_type        = "Super"
    db_cluster_id       = "amv-****"
    id                  = "amv-****:tfnormal"
    status              = "Available"

    account_privileges {
        privilege_type = "Table"
        privileges     = [
            "update",
        ]

        privilege_object {
            column   = null
            database = "INFORMATION_SCHEMA"
            table    = "ENGINES"
        }
    }
    account_privileges {
        privilege_type = "Database"
        privileges     = [
            "select",
            "update",
        ]

        privilege_object {
            column   = null
            database = "MYSQL"
            table    = null
        }
    }
    account_privileges {
        privilege_type = "Column"
        privileges     = [
            "update",
        ]

        privilege_object {
            column   = "PRIVILEGES"
            database = "INFORMATION_SCHEMA"
            table    = "COLUMNS"
        }
    }
}

    Log in to the console

    Log in to the AnalyticDB for MySQL console to view the account you created.

Clean up resources

If you no longer need the created resources, run the following command to delete them. For more information about the terraform destroy command, see Common commands.

terraform destroy

Complete example

Note

You can run the sample code in this tutorial with a single click. Run

Sample code

variable "name" {
  default = "terraform-example"
}

variable "region" {
  default = "cn-shenzhen"
}

variable "zone_id" {
  default = "cn-shenzhen-e"
}

provider "alicloud" {
  region = var.region
}

resource "alicloud_vpc" "default" {
  vpc_name   = "alicloud"
  cidr_block = "172.16.0.0/16"
}

resource "alicloud_vswitch" "default" {
  vpc_id     = alicloud_vpc.default.id
  cidr_block = "172.16.192.0/20"
  zone_id    = var.zone_id
}

resource "alicloud_adb_db_cluster_lake_version" "CreateInstance" {
  storage_resource              = "0ACU"
  zone_id                       = var.zone_id
  vpc_id                        = alicloud_vpc.default.id
  vswitch_id                    = alicloud_vswitch.default.id
  db_cluster_description        = var.name
  compute_resource              = "32ACU"
  db_cluster_version            = "5.0"
  payment_type                  = "PayAsYouGo"
  security_ips                  = "127.0.0.1"
  enable_default_resource_group = false
}

resource "alicloud_adb_lake_account" "default" {
  db_cluster_id    = alicloud_adb_db_cluster_lake_version.CreateInstance.id
  account_type     = "Super"
  account_name     = "tfnormal"
  account_password = "normal@2023"
  account_privileges {
    privilege_type = "Database"
    privilege_object {
      database = "MYSQL"
    }

    privileges = [
      "select",
      "update"
    ]
  }
  account_privileges {
    privilege_type = "Table"
    privilege_object {
      database = "INFORMATION_SCHEMA"
      table    = "ENGINES"
    }

    privileges = [
      "update"
    ]
  }
  account_privileges {
    privilege_type = "Column"
    privilege_object {
      table    = "COLUMNS"
      column   = "PRIVILEGES"
      database = "INFORMATION_SCHEMA"
    }

    privileges = [
      "update"
    ]
  }

  account_description = var.name
}

For more complete examples, visit More examples and open the relevant product folder.

Previous：Terraform resourcesNext：Manage Resource Groups with Terraform