User management in Sharded PostgreSQL

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To get a list of cluster users, run this command:

yc managed-sharded-postgresql user list \
     --cluster-name <cluster_name>

You can get the cluster name with the list of clusters in the folder.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Call the User.List method, e.g., via the following cURL request:

   curl \
     --request GET \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --url 'https://mdb.api.cloud.yandex.net/managed-spqr/v1/clusters/<cluster_ID>/users'
   

   You can get the cluster ID with the list of clusters in the folder.

3. View the server response to make sure your request was successful.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

3. Call the UserService.List method, e.g., via the following gRPCurl request:

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/spqr/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>"
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.spqr.v1.UserService.List
   

   You can get the cluster ID with the list of clusters in the folder.

4. Check the server response to make sure your request was successful.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Call the User.Get method, e.g., via the following cURL request:

   curl \
     --request GET \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --url 'https://mdb.api.cloud.yandex.net/managed-spqr/v1/clusters/<cluster_ID>/users/<username>'
   

   You can get the cluster ID with the list of clusters in the folder.

3. Check the server response to make sure your request was successful.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

3. Call the UserService.Get method, e.g., via the following gRPCurl request:

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/spqr/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_name": "<username>"
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.spqr.v1.UserService.Get
   

   You can get the cluster ID with the list of clusters in the folder.

4. Check the server response to make sure your request was successful.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To create a cluster user, run this command:

yc managed-sharded-postgresql user create <username> \
   --cluster-name <cluster_name> \
   --password=<password> \
   --permissions=<list_of_databases> \
   --grants=<list_of_grants>
   --connection-limit=<maximum_number_of_connections> \
   --connection-retries=<maximum_number_of_connection_retries>

Where:

• cluster-name: Cluster name.
• password: User password. It must be from 8 to 128 characters long.
• permissions: List of databases the user should have access to.
• grants: List of grants to be assigned to the user. Its possible values are:
  • reader
  • writer
  • admin
  • transfer
• connection-limit: Maximum number of user connections to the database.
• connection-retries: Number of reconnect attempts from the router to the shards.

The username may contain Latin letters, numbers, hyphens, and underscores. It must start with a letter, number, or underscore, but cannot begin with a pg_ prefix. The name may be up to 63 characters long.

The following names are reserved: admin, repl, monitor, postgres, mdb_admin, mdb_monitor, mdb_replication. You cannot create users with these names.

You can get the cluster name from the list of clusters in your folder.

1. Open the current Terraform configuration file with the infrastructure plan.

   To learn how to create this file, see creating a cluster.

   For the complete list of adjustable configuration fields for Managed Service for Sharded PostgreSQL cluster users, see this Terraform provider guide.

2. Add the yandex_mdb_sharded_postgresql_user resource:

   resource "yandex_mdb_sharded_postgresql_user" "my_user" {
     cluster_id = "<cluster_ID>"
     name       = "<username>"
     password   = "<password>"
     grants     = [ "<role1>","<role2>" ]
     settings   = {
       connection_limit = <maximum_number_of_connections>
       connection_retries = <maximum_number_of_connection_retries>
     }
     permissions {
       database = "<DB_name>"
     }
   }
   

   Where:

   • name: Username.

     The username may contain Latin letters, numbers, hyphens, and underscores. It must start with a letter, number, or underscore, but cannot begin with a pg_ prefix. The name may be up to 63 characters long.

     The following names are reserved: admin, repl, monitor, postgres, mdb_admin, mdb_monitor, mdb_replication. You cannot create users with these names.

   • password: User password. The password must be from 8 to 128 characters long.

   • grants: List of grants to be assigned to the user. Its possible values are:

     • reader
     • writer
     • admin
     • transfer

   • settings: Connection settings:

     • connection_limit: Maximum number of user connections to the database.
     • connection_retries: Number of reconnect attempts from the router to the shards.

   • permissions: Database the user must gain access to. To grant a user access to multiple databases, specify each one in a separate permissions block.

3. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

4. Confirm updating the resources.

   1. Run this command to view the intended changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Call the User.Create method, e.g., via the following cURL request:

   curl \
     --request POST \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --url 'https://mdb.api.cloud.yandex.net/managed-spqr/v1/clusters/<cluster_ID>/users' \
     --data '{
               "userSpec": {
                 "name": "<username>",
                 "password": "<user_password>",
                 "permissions": [
                   {
                     "databaseName": "<DB_name>"
                   }
                 ],
                 "settings": {
                   "connectionLimit": "<maximum_number_of_DB_connections>",
                   "connectionRetries": "<number_of_reconnect_attempts_to_shards>"
                 },
                 "grants": [
                   "<list_of_grants>"
                 ],
                 "deletionProtection": "<protect_user_from_deletion>"
               }
             }'
   

   Where:

   • <cluster_ID>: Cluster ID which you can get with the list of clusters in the folder.

   • Where userSpec are the new database user settings:

     • name: Username.

       The username may contain Latin letters, numbers, hyphens, and underscores. It must start with a letter, number, or underscore, but cannot begin with a pg_ prefix. The name may be up to 63 characters long.

       The following names are reserved: admin, repl, monitor, postgres, mdb_admin, mdb_monitor, mdb_replication. You cannot create users with these names.

     • password: User password. The password must be from 8 to 128 characters long.

     • permissions: List of databases the user needs access to. Each element in the list contains the databaseName parameter: The database name.

     • settings: Connection settings:

       • connLimit: Maximum number of user connections to the database.
       • connectionRetries: Number of reconnect attempts between the router and the shards.

     • grants: List of grants to be assigned to the user. Its possible values are:

       • reader
       • writer
       • admin
       • transfer

     • deletionProtection: User deletion protection, true or false.

3. Check the server response to make sure your request was successful.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

3. Call the UserService.Create method, e.g., via the following gRPCurl request:

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/spqr/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_spec": {
             "name": "<username>",
             "password": "<user_password>",
             "permissions": [
               {
                 "database_name": "<DB_name>"
               }
             ],
             "settings": {
               "connection_limit": "<maximum_number_of_DB_connections>",
               "connection_retries": "<number_of_reconnect_attempts_to_shards>"
             },
             "grants": [
               "<list_of_grants>"
             ],
             "deletion_protection": "<protect_user_from_deletion>"
           }
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.spqr.v1.UserService.Create
   

   Where:

   • cluster_id: Cluster ID which you can get with the list of clusters in the folder.

   • Where user_spec are the new database user settings:

     • name: Username.

       The username may contain Latin letters, numbers, hyphens, and underscores. It must start with a letter, number, or underscore, but cannot begin with a pg_ prefix. The name may be up to 63 characters long.

       The following names are reserved: admin, repl, monitor, postgres, mdb_admin, mdb_monitor, mdb_replication. You cannot create users with these names.

     • password: User password. The password must be from 8 to 128 characters long.

     • permissions: List of databases the user needs access to. Each element in the list contains the database_name parameter: The database name.

     • settings: Connection settings:

       • connection_limit: Maximum number of user connections to the database.
       • connection_retries: Number of reconnect attempts between the router and the shards.

     • grants: List of grants to be assigned to the user. Its possible values are:

       • reader
       • writer
       • admin
       • transfer

     • deletion_protection: User deletion protection, true or false.

4. Check the server response to make sure your request was successful.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

• To configure user access to specific databases, run this command with a list of database names specified in the --permissions option:

  yc managed-sharded-postgresql user update <username> \
       --cluster-name=<cluster_name> \
       --permissions=<list_of_databases>
  

  Where:

  • cluster-name: Cluster name.
  • permissions: List of databases the user should have access to.

  You can get the cluster name from the list of clusters in your folder.

  To revoke access to a database, remove its name from the list, and run the command once again.

• To update the list of grants for a user, run this command:

  yc managed-sharded-postgresql user update <username> \
    --cluster-name=<cluster_name> \
    --grants=<new_list_of_grants>
  

  You can get the cluster name from the list of clusters in your folder.

  To revoke a specific grant, remove it from the list, and run the command once again.

• To update connection settings for a user, run this command:

  yc managed-sharded-postgresql user update <username> \
    --cluster-name=<cluster_name> \
    --connection-limit=<maximum_number_of_connections> \
    --connection-retries=<maximum_number_of_connection_retries>
  

  Where:

  • connection-limit: Maximum number of user connections to the database.
  • connection-retries: Number of reconnect attempts from the router to the shards.

  You can get the cluster name from the list of clusters in your folder.

1. Open the current Terraform configuration file with the infrastructure plan.

   To learn how to create this file, see creating a cluster.

   For the complete list of adjustable configuration fields for Managed Service for Sharded PostgreSQL cluster users, see this Terraform provider guide.

2. Update parameters in the yandex_mdb_sharded_postgresql_user resource:

   resource "yandex_mdb_sharded_postgresql_user" "my_user" {
     ...
     name     = "<username>"
     grants   = [ "<role1>","<role2>" ]
     settings = {
       connection_limit = <maximum_number_of_connections>
       connection_retries = <maximum_number_of_connection_retries>
     }
     permissions {
       database = "<DB_name>"
     }
   }
   

   Where:

   • name: Username.

     The username may contain Latin letters, numbers, hyphens, and underscores. It must start with a letter, number, or underscore, but cannot begin with a pg_ prefix. The name may be up to 63 characters long.

     The following names are reserved: admin, repl, monitor, postgres, mdb_admin, mdb_monitor, mdb_replication. You cannot create users with these names.

     Warning

     Updating the username in Terraform deletes the current user and creates a new one with similar settings.

   • grants: List of grants to be assigned to the user. Its possible values are:

     • reader
     • writer
     • admin
     • transfer

   • settings: Connection settings:

     • connection_limit: Maximum number of user connections to the database.
     • connection_retries: Number of reconnect attempts from the router to the shards.

   • permissions: Database the user must gain access to. To grant a user access to multiple databases, specify each one in a separate permissions block. To deny a user access to a specific database, remove the respective permissions block.

3. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

4. Confirm updating the resources.

   1. Run this command to view the intended changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Call the User.Update method, e.g., via the following cURL request:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the updateMask parameter as a single comma-separated string.

   curl \
     --request PATCH \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --url 'https://mdb.api.cloud.yandex.net/managed-spqr/v1/clusters/<cluster_ID>/users/<username>' \
     --data '{
               "updateMask": "<list_of_parameters_to_update>",
               "password": "<user_password>",
               "permissions": [
                 {
                   "databaseName": "<DB_name>"
                 }
               ],
               "settings": {
                 "connectionLimit": "<maximum_number_of_DB_connections>",
                 "connectionRetries": "<number_of_reconnect_attempts_to_shards>"
               },
               "grants": [
                 "<list_of_grants>"
               ],
               "deletionProtection": "<protect_user_from_deletion>"
             }'
   

   Where:

   • <cluster_ID>: Cluster ID which you can get with the list of clusters in the folder.

   • updateMask: Comma-separated string of settings you want to update.

   • password: New password. It must be from 8 to 128 characters long.

   • permissions: List of databases the user needs access to. Each element in the list contains the databaseName parameter: The database name.

   • settings: Connection settings:

     • connLimit: Maximum number of user connections to the database.
     • connectionRetries: Number of reconnect attempts between the router and the shards.

   • grants: List of grants to be assigned to the user.

     Its possible values are:

     • reader
     • writer
     • admin
     • transfer

   • deletionProtection: User deletion protection, true or false.

3. Check the server response to make sure your request was successful.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

3. Call the UserService.Update method, e.g., via the following gRPCurl request:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the update_mask parameter as an array of paths[] strings.

   Format for listing settings

   "update_mask": {
       "paths": [
           "<setting_1>",
           "<setting_2>",
           ...
           "<setting_N>"
       ]
   }
   

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/spqr/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_name": "<username>",
           "update_mask": {
             "paths": [
               "<array_of_settings_to_update>"
             ]
           },
           "password": "<user_password>",
           "permissions": [
             {
               "database_name": "<DB_name>"
             }
           ],
           "settings": {
             "connection_limit": "<maximum_number_of_DB_connections>",
             "connection_retries": "<number_of_reconnect_attempts_to_shards>"
           },
           "grants": [
             "<list_of_grants>"
           ],
           "deletion_protection": "<protect_user_from_deletion>"
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.spqr.v1.UserService.Update
   

   Where:

   • cluster_id: Cluster ID which you can get with the list of clusters in the folder.

   • update_mask: List of settings to update as an array of strings (paths[]).

   • password: User password. The password must be from 8 to 128 characters long.

   • permissions: List of databases the user needs access to. Each element in the list contains the database_name parameter: The database name.

   • settings: Connection settings:

     • connection_limit: Maximum number of user connections to the database.
     • connection_retries: Number of reconnect attempts between the router and the shards.

   • grants: List of grants to be assigned to the user.

     Its possible values are:

     • reader
     • writer
     • admin
     • transfer

   • deletion_protection: User deletion protection, true or false.

4. Check the server response to make sure your request was successful.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To change a user password, run this command:

yc managed-sharded-postgresql user update <username> \
     --cluster-name=<cluster_name> \
     --password=<new_password>

The password must be from 8 to 128 characters long.

You can get the cluster name from the list of clusters in your folder.

1. Open the current Terraform configuration file with the infrastructure plan.

   To learn how to create this file, see Creating a cluster.

   For the complete list of adjustable configuration fields for Managed Service for Sharded PostgreSQL cluster users, see this Terraform provider guide.

2. Update parameters in the yandex_mdb_sharded_postgresql_user resource:

   resource "yandex_mdb_sharded_postgresql_user" "my_user" {
     ...
     password = "<password>"
     ...
   }
   

   Where password is the user password. The password must be from 8 to 128 characters long.

3. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

4. Confirm updating the resources.

   1. Run this command to view the intended changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Call the User.Update method, e.g., via the following cURL request:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the updateMask parameter as a single comma-separated string.

   curl \
     --request PATCH \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --url 'https://mdb.api.cloud.yandex.net/managed-spqr/v1/clusters/<cluster_ID>/users/<username>' \
     --data '{
               "updateMask": "password",
               "password": "<new_password>"
             }'
   

   Where:

   • <cluster_ID>: Cluster ID which you can get with the list of clusters in the folder.

   • updateMask: Comma-separated string of settings to update.

     Here, we provide only one setting.

   • password: New password. It must be from 8 to 128 characters long.

3. Check the server response to make sure your request was successful.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

3. Call the UserService.Update method, e.g., via the following gRPCurl request:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the update_mask parameter as an array of paths[] strings.

   Format for listing settings

   "update_mask": {
       "paths": [
           "<setting_1>",
           "<setting_2>",
           ...
           "<setting_N>"
       ]
   }
   

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/spqr/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_name": "<username>",
           "update_mask": {
             "paths": [
               "password"
             ]
           },
           "password": "<new_password>"
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.spqr.v1.UserService.Update
   

   Where:

   • cluster_id: Cluster ID which you can get with the list of clusters in the folder.

   • update_mask: List of settings you want to update as an array of strings (paths[]).

     Here, we provide only one setting.

   • password: New password. It must be from 8 to 128 characters long.

4. Check the server response to make sure your request was successful.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Call the User.Update method, e.g., via the following cURL request:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the updateMask parameter as a single comma-separated string.

   curl \
     --request PATCH \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --url 'https://mdb.api.cloud.yandex.net/managed-spqr/v1/clusters/<cluster_ID>/users/<username>' \
     --data '{
               "updateMask": "deletionProtection",
               "deletionProtection": "<protect_user_from_deletion>"
             }'
   

   Where:

   • <cluster_ID>: Cluster ID which you can get with the list of clusters in the folder.

   • updateMask: Comma-separated string of settings to update.

     Here, we provide only one setting.

   • deletionProtection: User deletion protection, true or false.

3. Check the server response to make sure your request was successful.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

3. Call the UserService.Update method, e.g., via the following gRPCurl request:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the update_mask parameter as an array of paths[] strings.

   Format for listing settings

   "update_mask": {
       "paths": [
           "<setting_1>",
           "<setting_2>",
           ...
           "<setting_N>"
       ]
   }
   

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/spqr/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_name": "<username>",
           "update_mask": {
             "paths": [
               "deletion_protection"
             ]
           },
           "deletion_protection": "<protect_user_from_deletion>"
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.spqr.v1.UserService.Update
   

   Where:

   • cluster_id: Cluster ID which you can get with the list of clusters in the folder.

   • update_mask: List of settings you want to update as an array of strings (paths[]).

     Here, we provide only one setting.

   • deletion_protection: User deletion protection, true or false.

4. Check the server response to make sure your request was successful.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To delete a user, run this command:

yc managed-sharded-postgresql user delete <username> \
     --cluster-name <cluster_name>

You can get the cluster name with the list of clusters in the folder.

To delete a user:

1. Open the current Terraform configuration file with the infrastructure plan.

2. In the manifest, remove the yandex_mdb_sharded_postgresql_user resource describing the user you want to delete.

3. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

4. Confirm updating the resources.

   1. Run this command to view the intended changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Call the User.Delete method, e.g., via the following cURL request:

   curl \
     --request DELETE \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --url 'https://mdb.api.cloud.yandex.net/managed-spqr/v1/clusters/<cluster_ID>/users/<username>'
   

   You can get the cluster ID with the list of clusters in the folder.

3. Check the server response to make sure your request was successful.

1. Get an IAM token for API authentication and put it into an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

3. Call the UserService.Delete method, e.g., via the following gRPCurl request:

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/spqr/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_name": "<username>"
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.spqr.v1.UserService.Delete
   

   You can get the cluster ID with the list of clusters in the folder.

4. Check the server response to make sure your request was successful.