CreateReadOnlyUser.sql

/*
Purpose:
- Create a database-scoped, read-only MySQL account for reporting or diagnostics.

Safety:
- Changes state by creating a user and granting SELECT.
- Grants no global privileges and no GRANT OPTION.

Requirements:
- MySQL 8.0 or later.
- CREATE USER and GRANT OPTION privileges for the administrator running the script.

Customization:
- Replace every angle-bracket placeholder before execution.
- Prefer a specific host or subnet over '%'. Supply the password from a secret manager.
*/

CREATE USER '<REPORTING_USER>'@'<ALLOWED_HOST>'
    IDENTIFIED BY '<STRONG_PASSWORD_FROM_SECRET_MANAGER>'
    REQUIRE SSL;

GRANT SELECT, SHOW VIEW
    ON `<DATABASE_NAME>`.*
    TO '<REPORTING_USER>'@'<ALLOWED_HOST>';

SHOW GRANTS FOR '<REPORTING_USER>'@'<ALLOWED_HOST>';

-- Rollback, if required:
-- DROP USER '<REPORTING_USER>'@'<ALLOWED_HOST>';