Skip to content
This repository was archived by the owner on Nov 12, 2024. It is now read-only.

Update recommended user permissions #280

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update recommended user permissions #280

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 17 additions & 15 deletions docs/imports/import-tool-user-requirements.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,21 +8,21 @@ When importing a database using our [Import tool](/docs/imports/database-imports

Below is the minimum set of permissions needed and what each allows the user to do:

| Scope | Databases | Grant | Description |
| ------ | -------------------------------- | -------------------- | ---------------------------------------------------------------------------- |
| Global | n/a | `PROCESS` | Enable the user to see all processes with SHOW PROCESSLIST. |
| Global | n/a | `REPLICATION SLAVE` | Enable replicas to read binary log events from the source. |
| Global | n/a | `REPLICATION CLIENT` | Enable the user to ask where source or replica servers are. |
| Global | n/a | `RELOAD` | Enable use of FLUSH operations. |
| Table | `<DATABASE_NAME>`, `ps_import_*` | `SELECT` | Enable use of SELECT. |
| Table | `<DATABASE_NAME>`, `ps_import_*` | `INSERT` | Enable use of INSERT. |
| Table | `<DATABASE_NAME>` | `LOCK TABLES` | Enable use of LOCK TABLES on tables for which you have the SELECT privilege. |
| Table | `<DATABASE_NAME>` | `SHOW VIEW` | Enable use of SHOW VIEW. |
| Table | `<DATABASE_NAME>`, `ps_import_*` | `UPDATE` | Enable use of UPDATE. |
| Table | `<DATABASE_NAME>`, `ps_import_*` | `DELETE` | Enable use of DELETE. |
| Table | `ps_import_*` | `CREATE` | Enable database and table creation. |
| Table | `ps_import_*` | `DROP` | Enable databases, tables, and views to be dropped. |
| Table | `ps_import_*` | `ALTER` | Enable use of ALTER TABLE. |
| Scope | Databases | Grant | Description |
| ------ | ------------------------------------------------------- | -------------------- | ---------------------------------------------------------------------------- |
| Global | n/a | `PROCESS` | Enable the user to see all processes with SHOW PROCESSLIST. |
| Global | n/a | `REPLICATION SLAVE` | Enable replicas to read binary log events from the source. |
| Global | n/a | `REPLICATION CLIENT` | Enable the user to ask where source or replica servers are. |
| Global | n/a | `RELOAD` | Enable use of FLUSH operations. |
| Table | `<DATABASE_NAME>`, `ps_import_*`, `_vt`, `mysql`.`func` | `SELECT` | Enable use of SELECT. |
| Table | `<DATABASE_NAME>`, `ps_import_*`, `_vt` | `INSERT` | Enable use of INSERT. |
| Table | `<DATABASE_NAME>` | `LOCK TABLES` | Enable use of LOCK TABLES on tables for which you have the SELECT privilege. |
| Table | `<DATABASE_NAME>` | `SHOW VIEW` | Enable use of SHOW VIEW. |
| Table | `<DATABASE_NAME>`, `ps_import_*`, `_vt` | `UPDATE` | Enable use of UPDATE. |
| Table | `<DATABASE_NAME>`, `ps_import_*`, `_vt` | `DELETE` | Enable use of DELETE. |
| Table | `ps_import_*`, `_vt` | `CREATE` | Enable database and table creation. |
| Table | `ps_import_*`, `_vt` | `DROP` | Enable databases, tables, and views to be dropped. |
| Table | `ps_import_*`, `_vt` | `ALTER` | Enable use of ALTER TABLE. |

{% callout %}
The descriptions in the table above were taken from the MySQL docs. For a full list of all possible grants and their
Expand All @@ -42,5 +42,7 @@ CREATE USER 'migration_user'@'%' IDENTIFIED BY '<SUPER_STRONG_PASSWORD>';
GRANT PROCESS, REPLICATION SLAVE, REPLICATION CLIENT, RELOAD ON *.* TO 'migration_user'@'%';
GRANT SELECT, INSERT, UPDATE, DELETE, SHOW VIEW, LOCK TABLES ON `<DATABASE_NAME>`.* TO 'migration_user'@'%';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER ON `ps\_import\_%`.* TO 'migration_user'@'%';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, ALTER ON `_vt`.* TO 'migration_user'@'%';
GRANT SELECT ON `mysql`.`func` TO 'migration_user'@'%';
GRANT EXECUTE ON PROCEDURE mysql.rds_show_configuration TO 'migration_user'@'%';
```