38 lines
1.5 KiB
SQL
38 lines
1.5 KiB
SQL
-- OneOS Scope 同步专用账号开通模板（由 RDS 管理员审核后执行）
|
||
--
|
||
-- 安全边界：
|
||
-- 1. 本文件包含 CREATE USER / GRANT，不能使用现有业务账号执行自动部署。
|
||
-- 2. <GENERATE_AND_STORE_A_STRONG_PASSWORD> 必须替换为独立随机密码，并写入受限的 platform.env。
|
||
-- 3. 172.17.111.55 是 2026-07-14 核验到的当前 ECS 私网源地址；迁移 ECS 后必须同步调整。
|
||
-- 4. 不授予 *.*、库级 SELECT、PROCESS、REPLICATION、DML、DDL 或角色。
|
||
|
||
CREATE USER 'vehicle_scope_reader'@'172.17.111.55'
|
||
IDENTIFIED BY '<GENERATE_AND_STORE_A_STRONG_PASSWORD>';
|
||
|
||
GRANT SELECT ON ln_asset_management.vehicle_lease_order_record
|
||
TO 'vehicle_scope_reader'@'172.17.111.55';
|
||
|
||
GRANT SELECT ON ln_asset_management.delivery_vehicle
|
||
TO 'vehicle_scope_reader'@'172.17.111.55';
|
||
|
||
GRANT SELECT ON ln_asset_management.return_vehicle_task
|
||
TO 'vehicle_scope_reader'@'172.17.111.55';
|
||
|
||
GRANT SELECT ON ln_asset_management.vehicle_info
|
||
TO 'vehicle_scope_reader'@'172.17.111.55';
|
||
|
||
GRANT SELECT ON ln_asset_management.customer_info
|
||
TO 'vehicle_scope_reader'@'172.17.111.55';
|
||
|
||
GRANT SELECT ON ln_asset_management.vehicle_lease_contract_info
|
||
TO 'vehicle_scope_reader'@'172.17.111.55';
|
||
|
||
GRANT SELECT ON ln_asset_management.vehicle_status
|
||
TO 'vehicle_scope_reader'@'172.17.111.55';
|
||
|
||
SHOW GRANTS FOR 'vehicle_scope_reader'@'172.17.111.55';
|
||
|
||
-- 管理员验收：输出只能包含 USAGE 和以上 7 个表的 SELECT。
|
||
-- 回收（仅在确认同步服务已停用后由管理员执行）：
|
||
-- DROP USER 'vehicle_scope_reader'@'172.17.111.55';
|