ApsaraDB RDS implements multi-dimensional access control to ensure data security. The two primary control mechanisms are account-based permissions that define what users can do, and IP address whitelists that control which hosts can connect. Apply both layers together to reduce the attack surface of your database instance.
Account-based access control
ApsaraDB RDS supports two account types with different levels of permission granularity.
| Account type | Permission granularity | Recommended for |
|---|---|---|
| Standard account | Database level: read-only, read/write, DDL-only, or DML-only | Most workloads — grant database-level permissions to application users |
| Privileged account | Table, view, and field level | Fine-grained control — use when database-level permissions are too broad |
For most workloads, standard accounts provide sufficient access control. Create a privileged account only when you need to restrict access below the database level.
Standard account
A standard account lets you grant read-only, read/write, DDL-only, or DML-only permissions on specific databases. Create and manage standard accounts from the ApsaraDB RDS console or via the API.
For setup instructions, see Create an account on an ApsaraDB RDS for MySQL instance.
Privileged account
A privileged account provides finer control — down to the table, view, and field level. After creating a privileged account from the console or API, log in to your RDS instance with that account to create standard accounts and grant them fine-grained permissions.
For setup instructions, see Authorize accounts to manage tables, views, and fields.
Whitelist-based access control
IP address whitelists control which hosts can connect to your RDS instance at the network level.
By default, the IP address whitelist contains only 127.0.0.1, which means the instance denies all connections from the Internet and internal networks. To allow access, add the IP addresses that need to connect to the instance to the whitelist.
Configure whitelists on the Data Security page of the ApsaraDB RDS console, or via the ApsaraDB RDS API. Whitelist updates take effect without restarting the instance, so there is no interruption to your workloads.
For configuration steps, see Configure a whitelist for an ApsaraDB RDS for MySQL instance.