Give limited access to pmm user while connecting pmm-client to mysql service

1

Hello everyone, As I am connecting my pmm-client to the MySQL instance and according to docs when we add pmm-client to mariadb: command is :

GRANT SELECT, PROCESS, SUPER, REPLICATION CLIENT, RELOAD, BACKUP_ADMIN ON . TO ‘pmm’@‘localhost’;

But I want to give pmm-user specific access, not all the access. I don’t want that pmm user to write to any of my databases as somehow my percona server is comprised, it can comprise my database also.

So, can we give some limited access to pmm-user to the database or can we give access to pmm-user to access only database logs, not the whole database?

2

Hello @Ayushi-gupta,
The GRANT you show has no write permissions to any databases; only read access.

1 Like
3

So, is not risky to give the pmm server to access read the database? As if the pmm-server is compromised, anyone can read our database. So, can we give only permission for pmm-user to access only logs of database?

4

I believe you can restrict SELECT to only mysql.*, information_schema.*, and performance_schema.* The other permissions are global and thus require *.*