REVOKE REPLICATION_APPLIER,ROLE_ADMIN ON *.* FROM "newuser"@"%"

Question

Created a new user and tried to remove all grants, ended with:

GRANT USAGE ON *.* TO "user"@"%"
GRANT REPLICATION_APPLIER,ROLE_ADMIN ON *.* TO "new user"@"%"

I’m stuck trying to remove these the last grant (REPLICATION_APPLIER,ROLE_ADMIN) with my admin user in a MySQL8 managed database.

Ran

REVOKE REPLICATION_APPLIER,ROLE_ADMIN ON *.* FROM "newuser"@"%"

but gives me this error: Access denied for AuthId doadmin@% to database ‘mysql’.

Since having root access is not an option, how can i remove this grant?

Bobby · Answer

Hey @geralsquid , When dealing with DigitalOcean’s Managed MySQL Database, you’re working within a slightly different environment compared to a self-managed MySQL instance. Managed databases often have certain restrictions to maintain security and stability across the platform. One such restriction is that you might not have the same level of access as a root user, which can limit your ability to perform certain actions, such as directly revoking privileges like REPLICATION_APPLIER and ROLE_ADMIN. The error message you’re encountering, “Access denied for AuthId doadmin@% to database ‘mysql’,” indicates that your administrative user (doadmin) does not have the necessary permissions to revoke these specific grants from the “newuser” user. This is a common security measure in managed environments to prevent accidental or malicious alterations to critical database functionalities, including replication and role administration. For actions that require higher privileges than your account possesses, the first step should be to contact DigitalOcean support. They can often make the necessary changes on your behalf or provide an alternative solution that complies with their managed database policies: https://www.digitalocean.com/support/ Although direct revocation of certain system-level privileges like REPLICATION_APPLIER and ROLE_ADMIN might not be поссибле due to the reasons mentioned, it’s still worth reaching out to the DigitalOcean support team. Hope that helps! - Bobby.

KFSys · Answer

Heya, Dealing with permission issues in a managed database environment like DigitalOcean can be challenging, especially without root access. In such cases as yours the only option would be contacting DigitalOcean’s support. They can assist in removing the permission for you. Please reach out to our amazing support team who will be more than happy to assist! :) https://www.digitalocean.com/support/ Hope that helps!- KFSys.

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

REVOKE REPLICATION_APPLIER,ROLE_ADMIN ON . FROM "newuser"@"%"

Related questions

Digital Ocean Team SSO with Entra ID - Work Around?

Post-Incident Security Validation: Rebuild or Trust the Existing Droplet

Best way to securely access a homelab remotely without relying only on Tailscale?

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

What’s the status of CopyFail patches in shared hosts?

How are you handling the Axios supply chain attack in your deployments?

Keeps signing me out (even more frequently than before)

What’s the best way to secure a DigitalOcean Droplet running WordPress against brute-force attacks?

prevent firewall ssh lock out

how do I find my droplet's username and password?

How To Set Up an Endlessh Tarpit on Ubuntu 22.04

Issues with SSH Access After Changing Firewall Settings