Skip to content

dm: add LOCK TABLES privilege note for managed MySQL sources (8.5) #22606

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alastori wants to merge 2 commits into
base: release-8.5
Choose a base branch
from
+19 −1
Open

dm: add LOCK TABLES privilege note for managed MySQL sources (8.5) #22606

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cd4fb2b
add LOCK TABLES note for managed MySQL sources in OSS DM docs
alastori Mar 20, 2026
39d99df
add ApsaraDB RDS for MySQL to managed provider list
alastori Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion dm/dm-precheck.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,11 @@ For the full data migration mode (`task-mode: full`), in addition to the [common

- SELECT permission on INFORMATION_SCHEMA and dump tables
- RELOAD permission if `consistency=flush`
- LOCK TABLES permission on the dump tables if `consistency=flush/lock`
- LOCK TABLES permission on the dump tables if `consistency=lock`

> **Note:**
>
> When `consistency=auto` (the default), DM first attempts `FLUSH TABLES WITH READ LOCK` and falls back to `LOCK TABLES` if FTWRL is unavailable. This fallback commonly occurs on managed MySQL services (such as Amazon RDS, Aurora, ApsaraDB RDS for MySQL, Azure Database for MySQL, or Google Cloud SQL) where FTWRL is not permitted. In this case, the `LOCK TABLES` privilege is required at runtime, but the precheck does not currently validate it. See [DM-worker privileges](/dm/dm-worker-intro.md#upstream-database-user-privileges) for the full privilege list.

* (Mandatory) Consistency of upstream MySQL multi-instance sharding tables

Expand Down
10 changes: 10 additions & 0 deletions dm/dm-worker-intro.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,13 +51,23 @@ The upstream database (MySQL/MariaDB) user must have the following privileges:
| `REPLICATION SLAVE` | Global |
| `REPLICATION CLIENT` | Global |

> **Note:**
>
> If migrating from a managed MySQL service (such as Amazon RDS, Aurora, ApsaraDB RDS for MySQL, Azure Database for MySQL, or Google Cloud SQL) where `FLUSH TABLES WITH READ LOCK` is not permitted, the user also needs the `LOCK TABLES` privilege. DM's default `consistency=auto` mode falls back to `LOCK TABLES` for data consistency when FTWRL is unavailable.

If you need to migrate the data from `db1` to TiDB, execute the following `GRANT` statement:

```sql
GRANT RELOAD,REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO 'your_user'@'your_wildcard_of_host';
GRANT SELECT ON db1.* TO 'your_user'@'your_wildcard_of_host';
```

For managed MySQL services where FTWRL is not permitted, also grant `LOCK TABLES`:

```sql
GRANT LOCK TABLES ON db1.* TO 'your_user'@'your_wildcard_of_host';
```

If you also need to migrate the data from other databases into TiDB, make sure the same privileges are granted to the user of the respective databases.

### Downstream database user privileges
Expand Down
4 changes: 4 additions & 0 deletions dm/quick-start-with-dm.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,8 @@ You can use Docker to quickly deploy a test MySQL 8.0 instance.
GRANT PROCESS, BACKUP_ADMIN, RELOAD, REPLICATION SLAVE, REPLICATION CLIENT, SELECT ON *.* TO 'tidb-dm'@'%';
```

> **Note:** If your MySQL source is a managed service (such as Amazon RDS, Aurora, ApsaraDB RDS for MySQL, Azure Database for MySQL, or Google Cloud SQL), also grant `LOCK TABLES`. See [DM-worker privileges](/dm/dm-worker-intro.md#upstream-database-user-privileges) for details.

4. Create sample data:

```sql
Expand Down Expand Up @@ -147,6 +149,8 @@ On macOS, you can quickly install and start MySQL 8.0 locally using [Homebrew](h
GRANT PROCESS, BACKUP_ADMIN, RELOAD, REPLICATION SLAVE, REPLICATION CLIENT, SELECT ON *.* TO 'tidb-dm'@'%';
```

> **Note:** If your MySQL source is a managed service (such as Amazon RDS, Aurora, ApsaraDB RDS for MySQL, Azure Database for MySQL, or Google Cloud SQL), also grant `LOCK TABLES`. See [DM-worker privileges](/dm/dm-worker-intro.md#upstream-database-user-privileges) for details.

6. Create sample data:

```sql
Expand Down
Loading