# Self-Service RDS Access

Create your own MySQL user on the ows-coda Aurora cluster.

## 1. Connect to the VPN

The RDS cluster is in a private VPC. Connect to the Orchard VPN before proceeding.

## 2. Reset the master password

The master user is `coda_admin`. Reset its password so you can log in.

### Via AWS Console

1. Open **RDS > Databases** in the AWS console (account `989790945997`, `us-east-1`)
2. Select the `qa-ows-coda` cluster
3. Click **Modify**
4. Under **Settings**, enter a new master password
5. Click **Continue**, select **Apply immediately**, then **Modify cluster**

### Via AWS CLI

```bash
aws rds modify-db-cluster \
  --db-cluster-identifier qa-ows-coda \
  --master-user-password '<new-master-password>' \
  --apply-immediately \
  --profile orchard-dev
```

Generate the master password the same way as your personal password (see step 3). This password is temporary — it only needs to last long enough to create your user.

## 3. Generate your password

Create a 20-character password using only MySQL-safe characters (letters, digits, and `!@#$%^&*`). Avoid backticks, quotes, semicolons, backslashes, and spaces.

```bash
openssl rand -base64 30 | tr -dc 'A-Za-z0-9!@#$%^&*' | head -c 20; echo
```

Save this somewhere secure (1Password, etc.) — you'll need it in the next steps.

## 4. Log in as master and create your user

```bash
mysql -h qa-ows-coda-db.theorchard.io -u coda_admin -p
```

Enter the master password from step 2 when prompted. Then run:

```sql
CREATE USER 'firstname.lastname'@'%' IDENTIFIED BY '<your-password-from-step-3>';
GRANT SELECT ON coda.* TO 'firstname.lastname'@'%';
FLUSH PRIVILEGES;
```

> Adjust grants as needed. `SELECT` is the default for read-only access. If you need write access for a specific task, add `INSERT`, `UPDATE`, or `DELETE` on the relevant tables and coordinate with the team.

Exit the master session:

```sql
EXIT;
```

## 5. Verify by logging in as your user

```bash
mysql -h qa-ows-coda-db.theorchard.io -u firstname.lastname -p coda
```

Run a quick check:

```sql
SELECT COUNT(*) FROM Chat;
```

If you see a result, you're good.

## Environments

| Environment | Host                             |
| ----------- | -------------------------------- |
| **QA**      | `qa-ows-coda-db.theorchard.io`   |
| **Prod**    | `prod-ows-coda-db.theorchard.io` |

Repeat the process for each environment. Production access requires the production AWS profile and team coordination in `#abacus-devs`.