Managing user permissions

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

• Granting privileges to a user:

  yc managed-mysql user grant-permission <username> \
    --cluster-name <cluster_name> \
    --database <DB_name> \
    --permissions <privileges_separated_by_commas>
  

  You can get the cluster name with the list of clusters in the folder, the database name, with the list of databases in the cluster, and the username, with the list of users in the cluster.

• Revoking privileges from a user:

  yc managed-mysql user revoke-permission <username> \
    --cluster-name <cluster_name> \
    --database <DB_name> \
    --permissions <privileges_separated_by_commas>
  

  To grant or revoke ALL_PRIVILEGES, specify the ALL alias as the privilege name.

1. Open the current Terraform configuration file describing your infrastructure.

   For more information on how to create this file, see this guide.

2. Find the relevant yandex_mdb_mysql_user resource and change the list of user’s privileges for the appropriate database in the roles parameter:

   resource "yandex_mdb_mysql_user" "<username>" {
     cluster_id = "<cluster_ID>"
     name       = "<username>"
     permission {
       database_name = "<DB_name>"
       roles         = [<list_of_privileges>]
     }
     ...
   }
   

   Where:

   • database_name: Name of the database the user will have access to.
   • roles: List of user privileges for the database.

3. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

4. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider article.

1. Get an IAM token for API authentication and set it as an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Call the User.update method, e.g., via the following cURL request:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the updateMask parameter as a single comma-separated string.

   curl \
       --request PATCH \
       --header "Authorization: Bearer $IAM_TOKEN" \
       --header "Content-Type: application/json" \
       --url 'https://mdb.api.cloud.yandex.net/managed-mysql/v1/clusters/<cluster_ID>/users/<username>' \
       --data '{
                 "updateMask": "permissions",
                 "permissions": [
                   {
                     "databaseName": "<DB_name>",
                     "roles": [
                       "<privilege_1>", "<privilege_2>", ..., "<privilege_N>"
                     ]
                   }
                 ]
               }'
   

   Where:

   • updateMask: Comma-separated list of settings you want to update.

     Here, we provide only one setting.

   • permissions: User permission settings:

     • databaseName: Name of the database to which the user will have access.
     • roles: Array of user privileges, each provided as a separate string in the array. For the list of possible values, see User privileges in a cluster.

     For each database, add a separate element with permission settings to the permissions array.

   You can get the cluster ID with the list of clusters in the folder, and the username, with the list of users in the cluster.

3. Check the server response to make sure your request was successful.

1. Get an IAM token for API authentication and set it as an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume the repository contents are stored in the ~/cloudapi/ directory.

3. Call the UserService/Update method, e.g., via the following gRPCurl request:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the update_mask parameter as an array of paths[] strings.

   Format for listing settings

   "update_mask": {
       "paths": [
           "<setting_1>",
           "<setting_2>",
           ...
           "<setting_N>"
       ]
   }
   

   grpcurl \
       -format json \
       -import-path ~/cloudapi/ \
       -import-path ~/cloudapi/third_party/googleapis/ \
       -proto ~/cloudapi/yandex/cloud/mdb/mysql/v1/user_service.proto \
       -rpc-header "Authorization: Bearer $IAM_TOKEN" \
       -d '{
             "cluster_id": "<cluster_ID>",
             "user_name": "<username>",
             "update_mask": {
               "paths": [
                 "permissions"
               ]
             },
             "permissions": [
               {
                 "database_name": "<DB_name>",
                 "roles": [
                   "<privilege_1>", "<privilege_2>", ..., "<privilege_N>"
                 ]
               }
             ]
           }' \
       mdb.api.cloud.yandex.net:443 \
       yandex.cloud.mdb.mysql.v1.UserService.Update
   

   Where:

   • update_mask: List of settings you want to update as an array of strings (paths[]).

     Here, we provide only one setting.

   • permissions: User permission settings:

     • database_name: Name of the database to which the user will have access.
     • roles: Array of user privileges, each provided as a separate string in the array. For the list of possible values, see User privileges in a cluster.

     For each database, add a separate element with permission settings to the permissions array.

   You can get the cluster ID with the list of clusters in the folder, and the username, with the list of users in the cluster.

4. Check the server response to make sure your request was successful.

1. Create a user named user2:

   yc managed-mysql user create "user2" \
     --cluster-name "cluster1" \
     --password "SecretPassword"
   

2. Add the SELECT role for db1:

   yc managed-mysql users grant-permission "user2" \
     --cluster-name "cluster1" \
     --database "db1" \
     --permissions "SELECT"
   

1. Open the current Terraform configuration file describing your infrastructure.

   For more information on how to create this file, see this guide.

2. Add the yandex_mdb_mysql_user resource:

   resource "yandex_mdb_mysql_user" "user2" {
     cluster_id = yandex_mdb_mysql_cluster.cluster1.id
     name       = "user2"
     password   = "SecretPassword"
     permission {
       database_name = "db1"
       roles         = ["SELECT"]
     ...
     }
   }
   

3. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

4. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider article.