- Newest
- Most votes
- Most comments
As an RDS admin for MySQL, you cannot directly grant SELECT privileges on the information_schema database using the GRANT statement you provided. This is because the information_schema is a read-only database that contains metadata about other databases and tables, and its privileges are managed differently in RDS for MySQL.
Instead, you can use the built-in role-based privilege model in RDS for MySQL to grant the necessary permissions to your monitoring tool user. The 'rds_superuser_role' includes privileges that allow access to system schemas like information_schema.
Here's what you can do:
-
First, create the monitor_user if you haven't already: CREATE USER 'monitor_user'@'%' IDENTIFIED BY 'password';
-
Then, grant the rds_superuser_role to the monitor_user: GRANT rds_superuser_role TO 'monitor_user'@'%';
-
The user will need to activate the role when they connect: SET ROLE 'rds_superuser_role';
This approach will give the monitor_user read access to the information_schema and other system schemas, along with additional privileges. If you need more fine-grained control, you may want to create a custom role with only the specific privileges required for your monitoring tool.
Remember that in RDS for MySQL, especially from version 8.0.36 onwards, direct modifications to system tables are restricted, and it's recommended to use account-management statements and roles to manage user privileges.
Sources
Role-based privilege model for RDS for MySQL - Amazon Relational Database Service
Relevant content
asked 2 years ago
asked 3 years ago

I want the monitor_user to only have read permissions on DB metadata and not data, something that seems not feasible in RDS for MySQL v8.0.40.