Manage Aiven for MySQL® service users

Create and manage service users in your Aiven for MySQL® service to control access to its databases and tables.

Service users only exist in the scope of the Aiven service. They are unique to the service and not shared with any other services. Every service has a default avnadmin user with full access to the service.

Add a service user

Aiven Console

1. In your service, in the Connect section, click Users.
2. Click Add service user or Create user.
3. Enter a name for your service user.
4. Set up all the other configuration options. If a password is required, a random password is generated automatically. You can change it later.
5. Click Add service user.

Aiven CLI

Run the avn service user-create command:

avn service user-create SERVICE_NAME --username USERNAME

Replace the following:

• SERVICE_NAME: the name of your Aiven for MySQL service.
• USERNAME: the name of the service user to create.

Aiven API

Use the ServiceUserCreate endpoint:

curl --request POST                                                          \
  --url https://api.aiven.io/v1/project/PROJECT_NAME/service/SERVICE_NAME/user \
  --header 'Authorization: Bearer YOUR_BEARER_TOKEN'                         \
  --header 'content-type: application/json'                                  \
  --data '{"username": "USERNAME"}'

Replace the placeholders with your project name, service name, bearer token, and the username to create.

To restrict the privileges granted to the new user, add the optional mysql_grants field. See Restrict privileges for a new user.

Terraform

Use the aiven_mysql_user resource to create and manage service users.

Restrict privileges for a new user

You can restrict the privileges assigned to a new Aiven for MySQL service user when you create it with the Aiven API. By default, a service user gets admin-level privileges, including the ability to create other users.

To restrict these privileges, set mysql_grants to an array containing only the privileges to assign. Set it to an empty array to create a user with no privileges beyond connecting to the service. Omit the field to keep the default admin-level privileges.

curl --request POST                                                          \
  --url https://api.aiven.io/v1/project/PROJECT_NAME/service/SERVICE_NAME/user \
  --header 'Authorization: Bearer YOUR_BEARER_TOKEN'                         \
  --header 'content-type: application/json'                                  \
  --data '{"username": "USERNAME", "mysql_grants": ["SELECT", "INSERT"]}'

Replace the placeholders with your project name, service name, bearer token, and the username to create.

If mysql_grants includes CREATE USER or ROLE_ADMIN, the created user can also grant every privilege in the list to other users, equivalent to MySQL's WITH GRANT OPTION.

Available privileges

mysql_grants accepts the following values:

Privilege	Applies to
ALTER	Databases you create
ALTER ROUTINE	Databases you create
CREATE	The service and databases you create
CREATE ROUTINE	Databases you create
CREATE TEMPORARY TABLES	Databases you create
CREATE USER	The service
CREATE VIEW	Databases you create
DELETE	Databases you create
DROP	The service and databases you create
EVENT	Databases you create
EXECUTE	Databases you create
INDEX	Databases you create
INSERT	Databases you create
LOCK TABLES	Databases you create
PROCESS	The service
REFERENCES	Databases you create
RELOAD	The service
REPLICATION_APPLIER	The service
REPLICATION CLIENT	The service
REPLICATION SLAVE	The service
ROLE_ADMIN	The service
SELECT	Databases you create, and read-only access to system databases
SHOW DATABASES	The service
SHOW VIEW	Databases you create
TRIGGER	Databases you create
UPDATE	Databases you create

For privileges that apply to databases, Aiven revokes the privilege from the service's system databases, except SELECT. This keeps read access to system information on every user without allowing changes to it.

Requirements

Restricting privileges at user creation requires your Aiven for MySQL service to support granular grants. If your service doesn't support this capability, requests that include mysql_grants fail with an HTTP 400 Bad Request status code. To add support, review and apply pending maintenance updates on your service.

Related pages

• Create a database
• Connect to your service
• Maintenance updates