Create an account for an RDS MariaDB instance-ApsaraDB RDS(RDS)-阿里云帮助中心

Account types

ApsaraDB RDS for MariaDB instances have two types of accounts: privileged and standard. You can manage all accounts in the ApsaraDB RDS console.

Type	Description
Privileged Account	You can create and manage them only in the console or by using API operations. Only one privileged account can be created per instance. This account manages all standard accounts and databases. Provides advanced permissions for custom and fine-grained access control. For example, you can grant permissions to query specific tables to different users. Has all permissions for all databases within the instance. It can disconnect any account session. If you create a privileged account that has the same name as an existing standard account, the privileged account replaces the standard account.
Standard Account	You can create and manage them in the console, by using API operations, or by running SQL statements. You can create multiple standard accounts for an instance. The maximum number of standard accounts depends on the instance's minor engine version. You must manually grant permissions on specific databases to a standard account. A standard account cannot create or manage other accounts, or disconnect other account sessions.

Create a privileged account

Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
In the left navigation pane, click Accounts. Then, click Create Account.

Configure the following parameters and click OK.

Note

After you create the privileged account, it is automatically activated within seconds.

Parameter	Description
Database Account	Enter a name for the account. The name must meet the following requirements: The name must be 2 to 16 characters long. The name must start with a letter and end with a letter or a digit. The name must contain only lowercase letters, digits, and underscores (_). The name must be unique within the instance. Note If you create a privileged account that has the same name as an existing standard account, the privileged account replaces the standard account.
Account Type	Select Privileged Account.
New Password	Set a password for the account. The password must meet the following requirements: The password must be 8 to 32 characters long. The password must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. The supported special characters are `!@#$%^&*()_+-=`.
Confirm Password	Re-enter the password to confirm.
Description	Add a description for the account to make it easier to manage. The description can be up to 256 characters long.

Reset privileged account permissions

If a privileged account has issues, such as accidentally revoking its permissions with a REVOKE statement, you can restore its permissions.

Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
In the left navigation bar, select Accounts, and click Reset Account Permissions to the right of Privileged Account.
Enter the privileged account's password to reset its permissions.

Create a standard account

Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.
In the left navigation pane, click Accounts. Then, click Create Account.

Configure the following parameters and click OK.

Parameter	Description
Database Account	Enter a name for the account. The name must meet the following requirements: The name must be 2 to 16 characters long. The name must start with a letter and end with a letter or a digit. The name must contain only lowercase letters, digits, and underscores (_).
Account Type	Select Standard Account.
Authorization database	Grant permissions on one or more databases to the account. Select one or more databases from the list on the left and click the > icon to add them to the panel on the right. In the panel on the right, select a permission level for each database: Read/Write (DDL + DML), Read-only, DDL Only, or DML Only. To grant the same permissions to multiple databases at once, click the button in the upper-right corner of the panel, such as Set all to read/write (DDL+DML). Note The button's label changes after each click. For example, after you click Set all to read/write (DDL+DML), the label changes to Set all to read-only. This parameter is optional. You can grant permissions to the account after it is created.
New Password	Set a password for the account. The password must meet the following requirements: The password must be 8 to 32 characters long. The password must contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters. The supported special characters are `!@#$%^&*()_+-=`.
Confirm Password	Re-enter the password to confirm.
Description	Optional. Add a description to make the account easier to manage. The description can be up to 256 characters long.

API reference

You can call the CreateAccount operation to create a database account.

FAQ

`AccountLimitExceeded` error

Problem

Calling the CreateAccount operation with incorrect parameters may return the following error:

"Code": "AccountLimitExceeded",
"Message": "AccountQuotaExceeded: Exceeding the allowed amount of account"

This error indicates that the instance has reached its account limit.

Causes

Account limit: Only one privileged account is allowed per instance, and this account cannot be deleted.
Parameter settings: For a MariaDB instance, if you set the AccountType parameter to Super but a privileged account already exists, the API returns the AccountLimitExceeded error.

Solutions

Create a standard account: Ensure that the AccountType parameter is set to Normal. The maximum number of standard accounts depends on the instance's minor engine version.
Create a privileged account: Ensure that the AccountType parameter is set to Super. Before you create a privileged account, go to the Accounts page in the ApsaraDB RDS console to check if a privileged account exists. If a privileged account exists, do not create another one.