This page describes how Cloud SQL works with MySQL users. MySQL user accountsprovide security by controlling access to MySQL databases.

For complete documentation about users in MySQL, seeAccess Control and Account Management inthe MySQL documentation. For informationabout creating and managing Cloud SQL users in Cloud SQL, seeCreate and manage users.

Why you need MySQL user accounts

MySQL user accounts enable you to log in to and administer your Cloud SQLinstance. User accounts are also required for applications to access yourinstance.

Superuser restrictions

In Cloud SQL, customers cannot create or access users with superuserattributes.

Because Cloud SQL for MySQL is a managed service, it restricts accessto certain system procedures and tables.

Data Manipulation Language (DML) and Data Definition Language (DDL) privilegesare restricted on some schema tables.

Here's the list of MySQL 5.6 system tables in themysql schema that require write permissions:

• audit_log_rules_expanded
• audit_log_supported_ops
• audit_log_rules
• cloudsql_replica_index
• db
• event
• func
• heartbeat
• plugin
• proc
• user
• tables_priv

For MySQL 5.7, here's the list:

• audit_log_rules_expanded
• audit_log_supported_ops
• audit_log_rules
• cloudsql_replica_index
• db
• event
• func
• gtid_executed
• heartbeat
• plugin
• proc
• user
• tables_priv

For related information about MySQL 8.0 and MySQL 8.4, seeMySQL 8.0 user privileges (cloudsqlsuperuser) andMySQL 8.4 user privileges (cloudsqlsuperuser).

MySQL user account format

MySQL user accounts have two components: a username and a hostname. Theusername identifies the user, and the hostname specifies what hosts that user canconnect from. The username and hostname are combined to create a user account:

'<user_name>'@'<host_name>'

You can specify a specific IP address or address range for hostname, or usethe percent character ("%") to leave the hostname unrestricted. Note thatif you connect to your instance using IP addresses, you must add your clientIP address as anAuthorized Address, even if your user'shostname is unrestricted.

User accounts are defined byboth the username and the hostname. Forexample,'user'@'%' is a different user account than'user'@'localhost'.

Default MySQL user

Upon creation, MySQL instances have one default user account:'root'@'%'. You use this account to connect to and manage thedatabase instance for the first time. The default user has all databaseprivileges except forSUPERandFILE. InCloud SQL, you can't rename'root'@'%'.

The default forroot'@'% is no password, and MySQL does not require you to usea password forroot'@'%. However, becauseroot'@'% exists on most MySQLinstallations, theroot'@'% user is a common target for unauthorized access.Any person or program that gains access to your instance has almostunlimited access to, and control over, your instance and data. For this reason,we recommend you configure yourroot'@'% user with a strong password or deletethis user. For help with configuring the default user account, seeConfigure the default user account.

System users

Cloud SQL supports the following system users:

• root@localhost,root@127.0.0.1,root@::1

  Used to provide the managed database service.

• cloudsqlreplica@%

  Used as a replication user for replicas.

• cloudsqlimport@localhost,cloudsqlimport@127.0.0.1

  Used for data imports.

• cloudsqlexport@localhost,cloudsqlexport@127.0.0.1

  Used for data exports.

• cloudsqloneshot

  Used for other database operations.

• cloudsqlapplier@localhost

  Used for replication operations in external server replica or cross major version replication.

• cloudsqlobservabilityadmin

  Used for database observability.

• cloudiamgroup@'%'

  Used for the IAM group authentication.

• cloudsqlreadonly

  Used to execute read-only operations on system tables.

• cloudsqlreplicaindex

  Used to manage secondary indexes on replicas.

You can't delete, modify, or assign database roles to these users.

Other MySQL user accounts

You can also create other MySQL user accounts. This is a good practice becauseit lets you use different MySQL user accounts for different purposes.

You can create a user account witha restricted hostname, or useSQL commands to limit privileges on your user accounts.

For more information about user account names, seeSpecifying Account Names in theMySQL documentation. To create a newMySQL user in Cloud SQL, seeCreate a user.

MySQL 5.6 and 5.7 user privileges

MySQL provides fine-grained privileges you can grant or remove for a user. Thislets you control what a user can do on your instance.

Users created using Cloud SQL have the same privileges as thedefault MySQL user. You can change their privileges by using theGRANT orREVOKE statements.

When you use themysql client to create a user, you must explicitly grant thatuser privileges with theGRANT statement.

For more information about the privileges supported by MySQL, seePrivileges Provided by MySQL.

MySQL 8.0 user privileges (cloudsqlsuperuser)

In Cloud SQL for MySQL 8.0, when you create a new user who usesbuilt-in authentication, the user isautomatically granted thecloudsqlsuperuser role. Thecloudsqlsuperuser roleis a Cloud SQL role that contains a number of MySQL privileges. This rolegives the user all of the MySQLstatic privileges, except forSUPER andFILE.

Thecloudsqlsuperuser role only supports the followingdynamic privileges based on MySQL 8.0 minor versions:

Thecloudsqlsuperuser role doesn't support any Data Definition Language (DDL)operations on themysql system database.

To see a complete list of privileges granted to thecloudsqlsuperuser role,execute theSHOW GRANTS statement in themysql client:

SHOW GRANTS FOR 'cloudsqlsuperuser'

MySQL 8.4 user privileges (cloudsqlsuperuser)

Similar to Cloud SQL for MySQL 8.0, in Cloud SQL for MySQL 8.4,when you create a new user who uses built-in authentication, the user isautomatically granted thecloudsqlsuperuser role.

In MySQL 8.4, thecloudsqlsuperuser role has the same privileges as MySQL 8.0.x.However, MySQL 8.4 has the following main differences with MySQL 8.0.x:

• Removes theSET_USER_IDprivilege and replaces it with the newlyintroducedALLOW_NONEXISTENT_DEFINER andSET_ANY_DEFINER privileges.
• GrantsFLUSH_PRIVILEGESas a subset of theRELOAD privilege.This grant isn't a replacement for theRELOAD privilege, and theRELOADprivilege is still granted for backwards compatibility.
• Grants the newOPTIMIZE_LOCAL_TABLE privilege.

In addition, Cloud SQL for MySQL 8.4 doesn't grant theTRANSACTION_GTID_TAGorTELEMETRY_LOG_ADMIN privilegesintroduced in MySQL 8.4.

MySQL roles

If you're using MySQL 8.0 or later, then you can create custom rolesto help you organize and assign database privileges to your MySQL users.You can use roles to provide initial database privilegesfor users when you create a Cloud SQL instance.

For more information about creating and using roles in MySQL,seeUsing roles.

When you create a built-in MySQL user in Cloud SQL for MySQL and don't assignany database roles, thebuilt-in MySQL user is granted thecloudsqlsuperuser role automatically.Alternatively, you can create a new MySQL user and assign a different customrole or roles with more fine-grained privileges.For more information about assigning roles to users inCloud SQL for MySQL, seeManage users with built-in authentication.

IAM users and database roles

When you create an IAM user accountin Cloud SQL for MySQL and don't assign anydatabase roles, the user isn't granted anydatabase roles automatically.

You can grant thecloudsqlsuperuser role and custom database rolesto IAM users, service accounts or groups by assigning thosedatabase roles when you create or update the IAMaccounts on the instance.

For more information aboutgranting roles to IAM users, seeAssign database roles while adding an IAM account to an instance.

What's next

• Configure theroot user account for your instance.
• Create and manage users.
• Create and manage databases.
• See theMySQL documentation about MySQL users.
• See theMySQL documentation about privileges provided by MySQL.
• Learn aboutoptions for connecting to your instance.