[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for MySQL®](../index.md) > [Step-by-step guides](index.md) > MySQL® users > Managing users

# Managing MySQL® users

You can add and remove users, as well as manage their settings.

{% note warning %}

To change user permissions at the [cluster](../concepts/settings-list.md#setting-administrative-priveleges) or [database](grant.md#grant-privilege) level, use the Yandex Cloud interfaces. Changes made using SQL commands are not saved.

For more information, see [User permissions in Managed Service for MySQL®](../concepts/user-rights.md).

{% endnote %}

## Getting a list of users {#list-users}

{% list tabs group=instructions %}

- Management console {#console}

  1. Navigate to **Managed Service for MySQL**.
  1. Click the cluster name and select the ![image-users](../../_assets/console-icons/persons.svg) **Users** tab.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To get a list of cluster users, run this command:

  ```
  yc managed-mysql user list --cluster-name=<cluster_name>
  ```

  You can get the cluster name with the [list of clusters in the folder](cluster-list.md).

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Call the [User.list](../api-ref/User/list.md) method, e.g., via the following [cURL](https://curl.se/) request:

      ```bash
      curl \
          --request GET \
          --header "Authorization: Bearer $IAM_TOKEN" \
          --url 'https://mdb.api.cloud.yandex.net/managed-mysql/v1/clusters/<cluster_ID>/users'
      ```

      You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

  1. Check the [server response](../api-ref/User/list.md#yandex.cloud.mdb.mysql.v1.ListUsersResponse) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.
  1. Call the [UserService/List](../api-ref/grpc/User/list.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

      ```bash
      grpcurl \
          -format json \
          -import-path ~/cloudapi/ \
          -import-path ~/cloudapi/third_party/googleapis/ \
          -proto ~/cloudapi/yandex/cloud/mdb/mysql/v1/user_service.proto \
          -rpc-header "Authorization: Bearer $IAM_TOKEN" \
          -d '{
                "cluster_id": "<cluster_ID>"
              }' \
          mdb.api.cloud.yandex.net:443 \
          yandex.cloud.mdb.mysql.v1.UserService.List
      ```

      You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

  1. View the [server response](../api-ref/grpc/User/list.md#yandex.cloud.mdb.mysql.v1.ListUsersResponse) to make sure your request was successful.

- SQL {#sql}

  To get a list of all users in a MySQL® cluster:

  1. [Grant](grant.md) the `mdb_admin` permissions to the user on whose behalf you will be connecting to the cluster database.

  1. [Connect to the database](connect/clients.md).

  1. Get a list of all users:

      ```sql
      SELECT user FROM mysql.v_user;
      ```

      Result example:

      ```sql
      +-------+
      | user  |
      +-------+
      | user1 |
      | user2 |
      | user3 |
      +-------+
      ```

      To get more detailed information about users, run this query:

      ```sql
      SELECT * FROM mysql.v_user;
      ```

{% endlist %}

## Creating a user {#adduser}

{% list tabs group=instructions %}

- Management console {#console}

  1. Navigate to **Managed Service for&nbsp;MySQL**.
  1. Click the name of your cluster and select the ![image-users](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Click **Create user**.

  
  1. Select the authentication method:
     
     * **Password**: Authentication by username and password.

       1. Specify the database user name.

          The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter or underscore. The name may be up to 32 characters long.

       
       1. Select the method for setting a password:

          * **Enter manually**: Set your own password. It must be from 8 to 128 characters long.

          * **Generate**: Generate a password using Connection Manager.

          To view the password, navigate to the cluster page, select the **Users** tab, and click **View password** for the new user. This will open the page of the Yandex Lockbox secret containing the password. To view passwords, you need the `lockbox.payloadViewer` role.


     * **IAM**: Authentication with a [Yandex account](../../iam/concepts/users/accounts.md#passport), [federated account](../../iam/concepts/users/accounts.md#saml-federation), or [local user](../../iam/concepts/users/accounts.md#local).

       In the **User** field, open the list of available user accounts and select the one you need. To find the account, use the search bar above the list.


  1. Select which databases the user should have access to:
      1. Click **Add database**.
      1. Select the database from the drop-down list.
      1. Repeat these two steps to select all required databases.
      1. To delete a database added by mistake, hover over the database row and click ![image](../../_assets/console-icons/xmark.svg).
  1. Set up [user privileges](../concepts/user-rights.md#db-privileges) for each of the selected databases:
      1. In the **Roles** column, click ![image](../../_assets/console-icons/plus.svg).
      1. In the drop-down list, select the privilege you want to grant the user.
      1. Repeat these two steps to add all required privileges.
  1. To revoke a privilege granted by mistake, click ![image](../../_assets/console-icons/xmark.svg) to its right.
  1. Optionally, under **Advanced settings**: 
      * Configure the [MySQL® settings](../concepts/settings-list.md#dbms-user-settings) for the user.
      * Under **Global permissions**, specify the [administrative privileges](../concepts/settings-list.md#setting-administrative-privileges) to grant the user at the cluster level.
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To create a cluster user, run this command:

  ```bash
  yc managed-mysql user create <username> \
    --cluster-name=<cluster_name> \
    --password=<user_password> \
    --permissions=<database_list>
  ```

  Where:

  * `cluster-name`: Cluster name.

  * `password`: User password. The password must be from 8 to 128 characters long.

    
    You can also generate a password using Connection Manager. Do it by specifying `--generate-password` instead of `--password=<password>`.

    To view the password, select your cluster in the [management console](https://console.yandex.cloud), navigate to the **Users** tab, and click **View password** for the new user. This will open the page of the Yandex Lockbox secret containing the password. To view passwords, you need the `lockbox.payloadViewer` role.


  * `permissions`: List of databases the user should have access to.

  The username may contain Latin letters, numbers, hyphens, and underscores, and must start with a letter, number, or underscore. It must be from 1 to 32 characters long.

  You can get the cluster name from the [list of clusters in your folder](cluster-list.md).

- Terraform {#tf}

  1. Open the current Terraform configuration file describing your infrastructure.

      To learn how to create this file, see [Creating a cluster](cluster-create.md).

  1. Add the `yandex_mdb_mysql_user` resource:

      ```hcl
      resource "yandex_mdb_mysql_user" "<username>" {
        cluster_id = "<cluster_ID>"
        name       = "<username>"
        password   = "<password>"
        permission {
          database_name = "<DB_name>"
          roles         = [<list_of_privileges>]
        }
        ...
      }
      ```

      Where:

      * `database_name`: Name of the database the user will have access to.
      * `roles`: List of user privileges for the database.

      The username may contain Latin letters, numbers, hyphens, and underscores, and must start with a letter, number, or underscore. It must be from 1 to 32 characters long.

      The password must be from 8 to 128 characters long.

      
      You can also generate a password using Connection Manager. Do it by specifying `generate_password = true` instead of `password = "<password>"`.

      To view the password, select your cluster in the [management console](https://console.yandex.cloud), navigate to the **Users** tab, and click **View password** for the new user. This will open the page of the Yandex Lockbox secret containing the password. To view passwords, you need the `lockbox.payloadViewer` role.


  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  For more information, see [this Terraform provider guide](../../terraform/resources/mdb_mysql_user.md).

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
          "userSpec": {
              "name": "<username>",
              "password": "<user_password>",
              "permissions": [
                  {
                      "databaseName": "<DB_name>",
                      "roles": [
                          "<privilege_1>", "<privilege_2>", ..., "<privilege_N>"
                      ]
                  }
              ]
          }
      }'
      ```

      Where `userSpec` are the settings for the new database user:

      * `name`: Username.

          The username may contain Latin letters, numbers, hyphens, and underscores, and must start with a letter, number, or underscore. It must be from 1 to 32 characters long.

      * `password`: User password. The password must be from 8 to 128 characters long.

          
          You can also generate a password using Connection Manager. Do it by specifying `"generatePassword": true` instead of `"password": "<user_password>"`.

          To view the password, select your cluster in the [management console](https://console.yandex.cloud), navigate to the **Users** tab, and click **View password** for the relevant user. This will open the page of the Yandex Lockbox secret containing the password. To view passwords, you need the `lockbox.payloadViewer` role.


      * `permissions`: User permission settings:

          * `databaseName`: Name of the database to which the user will have access.
          * `roles`: Array of user privileges, each privilege is provided as a separate string in the array. For the list of possible values, see [Database-level user privileges in Managed Service for MySQL®](../concepts/user-rights.md#db-privileges).

          For each database, add a separate element with permission settings to the `permissions` array.

  1. Call the [User.create](../api-ref/User/create.md) method, e.g., via the following [cURL](https://curl.se/) request:

      ```bash
      curl \
          --request POST \
          --header "Authorization: Bearer $IAM_TOKEN" \
          --header "Content-Type: application/json" \
          --url 'https://mdb.api.cloud.yandex.net/managed-mysql/v1/clusters/<cluster_ID>/users' \
          --data "@body.json"
      ```

      You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

  1. Check the [server response](../api-ref/User/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and place it in an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.
  1. Create a file named `body.json` and paste the following code into it:

      ```json
      {
          "cluster_id": "<cluster_ID>",
          "user_spec": {
              "name": "<username>",
              "password": "<user_password>",
              "permissions": [
                  {
                      "database_name": "<DB_name>",
                      "roles": [
                          "<privilege_1>", "<privilege_2>", ..., "<privilege_N>"
                      ]
                  }
              ]
          }
      }
      ```

      Where `user_spec` are the settings for the new database user:

      * `name`: Username.

        The username may contain Latin letters, numbers, hyphens, and underscores, and must start with a letter, number, or underscore. It must be from 1 to 32 characters long.

      * `password`: User password. The password must be from 8 to 128 characters long.

        
        You can also generate a password using Connection Manager. Do it by specifying `"generate_password": true` instead of `"password": "<user_password>"`.

        To view the password, select your cluster in the [management console](https://console.yandex.cloud), navigate to the **Users** tab, and click **View password** for the relevant user. This will open the page of the Yandex Lockbox secret containing the password. To view passwords, you need the `lockbox.payloadViewer` role.


      * `permissions`: User permissions:

          * `database_name`: Name of the database to which the user will have access.
          * `roles`: Array of user privileges, each priviledge is provided as a separate string in the array. For the list of possible values, see [Database-level user privileges in Managed Service for MySQL®](../concepts/user-rights.md#db-privileges).

          In the `permissions` array, add a separate element with permission settings for each database.

      You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters).

  1. Call the [UserService/Create](../api-ref/grpc/User/create.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

      ```bash
      grpcurl \
          -format json \
          -import-path ~/cloudapi/ \
          -import-path ~/cloudapi/third_party/googleapis/ \
          -proto ~/cloudapi/yandex/cloud/mdb/mysql/v1/user_service.proto \
          -rpc-header "Authorization: Bearer $IAM_TOKEN" \
          -d @ \
          mdb.api.cloud.yandex.net:443 \
          yandex.cloud.mdb.mysql.v1.UserService.Create \
          < body.json
      ```

  1. Check the [server response](../api-ref/grpc/User/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Changing a password {#updateuser}

{% list tabs group=instructions %}

- Management console {#console}

  1. Navigate to **Managed Service for&nbsp;MySQL**.
  1. Click the name of your cluster and select the ![image-users](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Click ![image](../../_assets/console-icons/ellipsis.svg) and select **Change password**.

  
  1. Select the method for setting a new password:

      * **Enter manually**: Set your own password. It must be from 8 to 128 characters long.

      * **Generate**: Generate a password using Connection Manager.


  1. Click **Edit**.

  
  To view the new password, navigate to the cluster page, select the **Users** tab, and click **View password** for the relevant user. This will open the page of the Yandex Lockbox secret containing the password. The new password version is marked as **Current**.

  To view passwords, you need the `lockbox.payloadViewer` role.


- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To change a user password, run this command:

  ```bash
  yc managed-mysql user update <username> \
    --cluster-name=<cluster_name> \
    --password=<new_password>
  ```

  The password must be from 8 to 128 characters long.

  
  You can also generate a new password using Connection Manager. Do it by specifying `--generate-password` instead of `--password=<new_password>`.

  To view the new password, select your cluster in the [management console](https://console.yandex.cloud), navigate to the **Users** tab, and click **View password** for the relevant user. This will open the page of the Yandex Lockbox secret containing the password. The new password version is marked as **Current**.

  To view passwords, you need the `lockbox.payloadViewer` role.


  You can get the cluster name from the [list of clusters in your folder](cluster-list.md).

- Terraform {#tf}

  1. Open the current Terraform configuration file describing your infrastructure.

      To learn how to create this file, see [Creating a cluster](cluster-create.md).

  1. Locate the `yandex_mdb_mysql_user` resource for the user in question.

  1. Edit the `password` field value:

      ```hcl
      resource "yandex_mdb_mysql_user" "<username>" {
        cluster_id = "<cluster_ID>"
        name       = "<username>"
        password   = "<new_password>"
        ...
      }
      ```

      The password must be from 8 to 128 characters long.

      
      You can also generate a new password using Connection Manager. Do it by specifying `generate_password = true` instead of `password = "<new_password>"`.

      To view the new password, select your cluster in the [management console](https://console.yandex.cloud), navigate to the **Users** tab, and click **View password** for the relevant user. This will open the page of the Yandex Lockbox secret containing the password. The new password version is marked as **Current**.

      {% note info %}

      If the current password has been automatically generated, you cannot regenerate it using Terraform due to the provider limitations.

      {% endnote %}


  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  For more information, see [this Terraform provider guide](../../terraform/resources/mdb_mysql_user.md).

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Call the [User.update](../api-ref/User/update.md) method, e.g., via the following [cURL](https://curl.se/) request:

      {% note warning %}
      
      The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `updateMask` parameter as a single comma-separated string.
      
      {% endnote %}

      ```bash
      curl \
          --request PATCH \
          --header "Authorization: Bearer $IAM_TOKEN" \
          --header "Content-Type: application/json" \
          --url 'https://mdb.api.cloud.yandex.net/managed-mysql/v1/clusters/<cluster_ID>/users/<username>' \
          --data '{
                    "updateMask": "password",
                    "password": "<new_password>"
                  }'
      ```

      Where:

      * `updateMask`: Comma-separated string of settings to update.

          Here, we provide only one setting.

      * `password`: New password. The password must be from 8 to 128 characters long.

        
        You can also generate a password using Connection Manager. To do this, edit the `data` field as follows:

        ```bash
        {
          "updateMask": "generatePassword",
          "generatePassword": true
        }
        ```

        To view the new password, select your cluster in the [management console](https://console.yandex.cloud), navigate to the **Users** tab, and click **View password** for the relevant user. This will open the page of the Yandex Lockbox secret containing the password. The new password version is marked as **Current**.

        To view passwords, you need the `lockbox.payloadViewer` role.


      You can get the cluster ID with the [list of clusters in the folder](cluster-list.md#list-clusters), and the username, with the [list of users in the cluster](#list-users).

  1. Check the [server response](../api-ref/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.
  1. Call the [UserService/Update](../api-ref/grpc/User/update.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

      {% note warning %}
      
      The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `update_mask` parameter as an array of `paths[]` strings.
      
      {% cut "Format for listing settings" %}
      
      ```yaml
      "update_mask": {
          "paths": [
              "<setting_1>",
              "<setting_2>",
              ...
              "<setting_N>"
          ]
      }
      ```
      
      {% endcut %}
      
      {% endnote %}

      ```bash
      grpcurl \
          -format json \
          -import-path ~/cloudapi/ \
          -import-path ~/cloudapi/third_party/googleapis/ \
          -proto ~/cloudapi/yandex/cloud/mdb/mysql/v1/user_service.proto \
          -rpc-header "Authorization: Bearer $IAM_TOKEN" \
          -d '{
                "cluster_id": "<cluster_ID>",
                "user_name": "<username>",
                "update_mask": {
                  "paths": [
                    "password"
                  ]
                },
                "password": "<new_password>"
              }' \
          mdb.api.cloud.yandex.net:443 \
          yandex.cloud.mdb.mysql.v1.UserService.Update
      ```

      Where:

      * `update_mask`: List of settings you want to update as an array of strings (`paths[]`).

          Here, we provide only one setting.

      * `password`: New password. The password must be from 8 to 128 characters long.

        
        You can also generate a password using Connection Manager. To do this, edit the `d` parameter as follows:

        ```bash
        {
          "cluster_id": "<cluster_ID>",
          "user_name": "<username>",
          "update_mask": {
            "paths": [
              "generate_password"
            ]
          },
          "generate_password": true
        }
        ```

        To view the new password, select your cluster in the [management console](https://console.yandex.cloud), navigate to the **Users** tab, and click **View password** for the relevant user. This will open the page of the Yandex Lockbox secret containing the password. The new password version is marked as **Current**.

        To view passwords, you need the `lockbox.payloadViewer` role.


      You can get the cluster ID from the [list of clusters in your folder](cluster-list.md#list-clusters), and the username from the [list of cluster users](#list-users).

  1. Check the [server response](../api-ref/grpc/User/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Changing user settings {#update-settings}

{% note tip %}

To change user's database access privileges, follow [this guide](grant.md#grant-privilege).

{% endnote %}

{% list tabs group=instructions %}

- Management console {#console}

  1. Navigate to **Managed Service for&nbsp;MySQL**.
  1. Click the name of your cluster and select the ![image-users](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Click ![image](../../_assets/console-icons/ellipsis.svg) and select **Configure**.
  1. Configure the [MySQL® settings](../concepts/settings-list.md#dbms-user-settings) for the user.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To configure the [MySQL® settings](../concepts/settings-list.md#dbms-user-settings) for a user, run this command:

  ```
  yc managed-mysql user update <username> \
    --cluster-name=<cluster_name> \
    --global-permissions=<list_of_privileges> \
    --authentication-plugin=<authentication_plugin> \
    --max-questions-per-hour=<maximum_requests> \
    --max-updates-per-hour=<maximum_UPDATE_requests> \
    --max-connections-per-hour=<maximum_connections> \
    --max-user-connections=<maximum_concurrent_connections>
  ```

  Where:

  * `global-permissions`: Comma-separated list of administrative privileges.
  * `max-questions-per-hour`: Maximum number of requests per hour.
  * `max-updates-per-hour`: Maximum number of `UPDATE` requests per hour.
  * `max-connections-per-hour`: Maximum number of connections per hour.
  * `max-user-connections`: Maximum number of concurrent connections.

  You can get the cluster name from the [list of clusters in your folder](cluster-list.md).

- Terraform {#tf}

  1. Open the current Terraform configuration file describing your infrastructure.

      For more on how to create this file, see [Creating a cluster](cluster-create.md).

  1. Locate the `yandex_mdb_mysql_user` resource for the user in question.

  1. To set limits on the number of connections and requests, add the `connection_limits` section to the user description:

      ```hcl
      resource "yandex_mdb_mysql_user" "<username>" {
        ...
        connection_limits {
          max_questions_per_hour   = <maximum_requests>
          max_updates_per_hour     = <maximum_UPDATE_requests>
          max_connections_per_hour = <maximum_connections>
          max_user_connections     = <maximum_concurrent_connections>
          ...
        }
      }
      ```

      Where:

      * `max-questions-per-hour`: Maximum number of requests per hour.
      * `max-updates-per-hour`: Maximum number of `UPDATE` requests per hour.
      * `max-connections-per-hour`: Maximum number of connections per hour.
      * `max-user-connections`: Maximum number of concurrent connections.

  1. To configure a user authentication plugin, add the `authentication_plugin` section to the user description:

      ```hcl
      resource "yandex_mdb_mysql_user" "<username>" {
        ...
        authentication_plugin = "<authentication_plugin>"
      }
      ```

  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  For more information, see [this Terraform provider guide](../../terraform/resources/mdb_mysql_user.md).

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Call the [User.update](../api-ref/User/update.md) method, e.g., via the following [cURL](https://curl.se/) request:

      {% note warning %}
      
      The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `updateMask` parameter as a single comma-separated string.
      
      {% endnote %}

      ```bash
      curl \
          --request PATCH \
          --header "Authorization: Bearer $IAM_TOKEN" \
          --header "Content-Type: application/json" \
          --url 'https://mdb.api.cloud.yandex.net/managed-mysql/v1/clusters/<cluster_ID>/users/<username>' \
          --data '{
                    "updateMask": "globalPermissions,connectionLimits,authenticationPlugin",
                    "globalPermissions": [
                      "<administrative_privilege_1>",
                      "<administrative_privilege_2>",
                      ...,
                      "<administrative_privilege_N>"
                    ],
                    "connectionLimits": {
                      "maxQuestionsPerHour": "<maximum_requests>",
                      "maxUpdatesPerHour": "<maximum_UPDATE_requests>",
                      "maxConnectionsPerHour": "<maximum_connections>",
                      "maxUserConnections": "<maximum_concurrent_connections>"
                    },
                    "authenticationPlugin": "<authentication_plugin>"
                  }'
      ```

      Where:

      * `updateMask`: Comma-separated string of settings to update.
      * `globalPermissions`: Array of administrative privileges, each provided as a separate string in the array. For the list of possible values, see the [method description](../api-ref/User/update.md#yandex.cloud.mdb.mysql.v1.UpdateUserRequest).
      * `connectionLimits`: User connection settings:

          * `maxQuestionsPerHour`: Maximum number of requests per hour.
          * `maxUpdatesPerHour`: Maximum number of `UPDATE` requests per hour.
          * `maxConnectionsPerHour`: Maximum number of connections per hour.
          * `maxUserConnections`: Maximum number of concurrent connections.

          The minimum value for each of these connection settings is `0`.

      * `authenticationPlugin`: User authentication plugin. For the list of available plugins, see the [method description](../api-ref/User/update.md#yandex.cloud.mdb.mysql.v1.UpdateUserRequest).

      You can get the cluster ID from the [list of clusters in your folder](cluster-list.md#list-clusters), and the username from the [list of cluster users](#list-users).

  1. Check the [server response](../api-ref/User/update.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.
  1. Call the [UserService/Update](../api-ref/grpc/User/update.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

      {% note warning %}
      
      The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `update_mask` parameter as an array of `paths[]` strings.
      
      {% cut "Format for listing settings" %}
      
      ```yaml
      "update_mask": {
          "paths": [
              "<setting_1>",
              "<setting_2>",
              ...
              "<setting_N>"
          ]
      }
      ```
      
      {% endcut %}
      
      {% endnote %}

      ```bash
      grpcurl \
          -format json \
          -import-path ~/cloudapi/ \
          -import-path ~/cloudapi/third_party/googleapis/ \
          -proto ~/cloudapi/yandex/cloud/mdb/mysql/v1/user_service.proto \
          -rpc-header "Authorization: Bearer $IAM_TOKEN" \
          -d '{
                "cluster_id": "<cluster_ID>",
                "user_name": "<username>",
                "update_mask": {
                  "paths": [
                    "global_permissions",
                    "connection_limits",
                    "authentication_plugin"
                  ]
                },
                "global_permissions": [
                  "<administrative_privilege_1>",
                  "<administrative_privilege_2>",
                  ...,
                  "<administrative_privilege_N>"
                ],
                "connection_limits": {
                  "max_questions_per_hour": "<maximum_requests>",
                  "max_updates_per_hour": "<maximum_UPDATE_requests>",
                  "max_connections_per_hour": "<maximum_connections>",
                  "max_user_connections": "<maximum_concurrent_connections>"
                },
                "authentication_plugin": "<authentication_plugin>"
              }' \
          mdb.api.cloud.yandex.net:443 \
          yandex.cloud.mdb.mysql.v1.UserService.Update
      ```

      Where:

      * `update_mask`: List of settings to update as an array of strings (`paths[]`).
      * `global_permissions`: Array of administrative privileges, each provided as a separate string in the array. For the list of possible values, see the [method description](../api-ref/grpc/User/update.md#yandex.cloud.mdb.mysql.v1.UpdateUserRequest).
      * `connection_limits`: User connection settings:

          * `max_questions_per_hour`: Maximum number of requests per hour.
          * `max_updates_per_hour`: Maximum number of `UPDATE` requests per hour.
          * `max_connections_per_hour`: Maximum number of connections per hour.
          * `max_user_connections`: Maximum number of concurrent connections.

          The minimum value for each of these connection settings is `0`.

      * `authentication_plugin`: User authentication plugin. For the list of available plugins, see the [method description](../api-ref/grpc/User/update.md#yandex.cloud.mdb.mysql.v1.UpdateUserRequest).

      You can get the cluster ID from the [list of clusters in your folder](cluster-list.md#list-clusters), and the username from the [list of cluster users](#list-users).

  1. Check the [server response](../api-ref/grpc/User/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Deleting a user {#removeuser}

{% list tabs group=instructions %}

- Management console {#console}

  1. Navigate to **Managed Service for&nbsp;MySQL**.
  1. Click the name of your cluster and select the ![image-users](../../_assets/console-icons/persons.svg) **Users** tab.
  1. Click ![image](../../_assets/console-icons/ellipsis.svg) and select **Delete**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To delete a user, run this command:

  ```
  yc managed-mysql user delete <username> --cluster-name=<cluster_name>
  ```

  You can get the cluster name with the [list of clusters in the folder](cluster-list.md).

- Terraform {#tf}

  1. Open the current Terraform configuration file describing your infrastructure.

      To learn how to create this file, see [Creating a cluster](cluster-create.md).

  1. Delete the `yandex_mdb_mysql_user` resource with the target user’s description.

  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm resource changes.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  For more information, see [this Terraform provider guide](../../terraform/resources/mdb_mysql_user.md).

- REST API {#api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Call the [User.delete](../api-ref/User/delete.md) method, e.g., via the following [cURL](https://curl.se/) request:

      ```bash
      curl \
          --request DELETE \
          --header "Authorization: Bearer $IAM_TOKEN" \
          --url 'https://mdb.api.cloud.yandex.net/managed-mysql/v1/clusters/<cluster_ID>/users/<username>'
      ```

      You can get the cluster ID from the [list of clusters in your folder](cluster-list.md#list-clusters), and the username from the [list of cluster users](#list-users).

  1. Check the [server response](../api-ref/User/delete.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

  1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

      ```bash
      export IAM_TOKEN="<IAM_token>"
      ```

  1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
     
     ```bash
     cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
     ```
     
     Below, we assume that the repository contents reside in the `~/cloudapi/` directory.
  1. Call the [UserService/Delete](../api-ref/grpc/User/delete.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

      ```bash
      grpcurl \
          -format json \
          -import-path ~/cloudapi/ \
          -import-path ~/cloudapi/third_party/googleapis/ \
          -proto ~/cloudapi/yandex/cloud/mdb/mysql/v1/user_service.proto \
          -rpc-header "Authorization: Bearer $IAM_TOKEN" \
          -d '{
                "cluster_id": "<cluster_ID>",
                "user_name": "<username>"
              }' \
          mdb.api.cloud.yandex.net:443 \
          yandex.cloud.mdb.mysql.v1.UserService.Delete
      ```

      You can get the cluster ID from the [list of clusters in your folder](cluster-list.md#list-clusters), and the username from the [list of cluster users](#list-users).

  1. Check the [server response](../api-ref/grpc/User/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Examples {#examples}

### Creating a user with read-only permissions {#user-read-only}

To create a new user named `user2` with the `SecretPassword` password and read-only access to the `db1` database in the existing `cluster1`:

{% list tabs group=instructions %}

- Management console {#console}

  [Create a user](cluster-users.md#adduser) named `user2`. When creating the user:

  1. Add `db1` to the database list.
  1. Add the `SELECT` role for `db1`.

- CLI {#cli}

  1. Create a user named `user2`:

      ```bash
      yc managed-mysql user create "user2" \
        --cluster-name "cluster1" \
        --password "SecretPassword"
      ```

  1. Add the `SELECT` role for `db1`:

      ```bash
      yc managed-mysql users grant-permission "user2" \
        --cluster-name "cluster1" \
        --database "db1" \
        --permissions "SELECT"
      ```

- Terraform {#tf}

  1. Open the current Terraform configuration file with the infrastructure plan.

      For more information on how to create this file, see [this guide](cluster-create.md).

  1. Add the `yandex_mdb_mysql_user` resource:

      ```hcl
      resource "yandex_mdb_mysql_user" "user2" {
        cluster_id = yandex_mdb_mysql_cluster.cluster1.id
        name       = "user2"
        password   = "SecretPassword"
        permission {
          database_name = "db1"
          roles         = ["SELECT"]
        ...
        }
      }
      ```

  1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

  1. Confirm updating the resources.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

  For more information, see [this Terraform provider article](../../terraform/resources/mdb_mysql_user.md).

{% endlist %}