Skip to content

Allow to grant select on MySQL information_schema

0

I want (as an MySQL RDS admin) to grant a monitoring tool user read only access to DB metadata through information_schema, but when I run:

GRANT SELECT ON information_schema.* TO monitor_user;

I get this error:

SQL Error [1044] [42000]: Access denied for user 'DBAdmin'@'%' to database 'information_schema'

(RDS for MySQL v8.0.40)

asked 2 years ago984 views

1 Answer
0

As an RDS admin for MySQL, you cannot directly grant SELECT privileges on the information_schema database using the GRANT statement you provided. This is because the information_schema is a read-only database that contains metadata about other databases and tables, and its privileges are managed differently in RDS for MySQL.

Instead, you can use the built-in role-based privilege model in RDS for MySQL to grant the necessary permissions to your monitoring tool user. The 'rds_superuser_role' includes privileges that allow access to system schemas like information_schema.

Here's what you can do:

  1. First, create the monitor_user if you haven't already: CREATE USER 'monitor_user'@'%' IDENTIFIED BY 'password';

  2. Then, grant the rds_superuser_role to the monitor_user: GRANT rds_superuser_role TO 'monitor_user'@'%';

  3. The user will need to activate the role when they connect: SET ROLE 'rds_superuser_role';

This approach will give the monitor_user read access to the information_schema and other system schemas, along with additional privileges. If you need more fine-grained control, you may want to create a custom role with only the specific privileges required for your monitoring tool.

Remember that in RDS for MySQL, especially from version 8.0.36 onwards, direct modifications to system tables are restricted, and it's recommended to use account-management statements and roles to manage user privileges.
Sources
Role-based privilege model for RDS for MySQL - Amazon Relational Database Service

answered 2 years ago

EXPERT

reviewed 2 years ago

  • I want the monitor_user to only have read permissions on DB metadata and not data, something that seems not feasible in RDS for MySQL v8.0.40.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.