MySQL 'ERROR 1045 (28000): Access denied for user' - how do I find out which account was matched and fix it?

Cause: The server found no account matching the user name, client host and password you sent. The message shows what it received, for example Access denied for user 'app'@'10.0.0.8' (using password: YES) or (using password: NO). Accounts in MySQL are user plus host, so 'app'@'localhost' and 'app'@'10.0.0.8' are different accounts. Other causes: a stale password in an option file or environment variable, a fresh install where root has a temporary password in the error log, a 'localhost' or anonymous row shadowing a wider host row, and grants edited directly in the grant tables without a reload. Fix (best first): 1. Read the message: 'using password: NO' means the client sent no password (check your connection string or config); the host shown is the one that must match an account. 2. Rule out stale client config: run the mysql client with --no-defaults, then supply the password explicitly. 3. As an admin, compare accounts: SELECT user, host, plugin FROM mysql.user WHERE user='app'; and SHOW GRANTS FOR 'app'@'10.0.0.8'; 4. Create or fix the exact account and give least privilege: CREATE USER 'app'@'10.0.0.%' IDENTIFIED BY '<new-password>'; GRANT SELECT, INSERT, UPDATE, DELETE ON appdb.* TO 'app'@'10.0.0.%'; Avoid '%' hosts and avoid granting ALL PRIVILEGES. 5. If grants were changed by editing tables directly, run FLUSH PRIVILEGES. Statements such as CREATE USER and GRANT do not need it. 6. If the connection works from the server but not remotely, check bind_address and skip_networking, the firewall, and host name resolution (the server may see a different host name than you expect; skip_name_resolve plus IP-based accounts avoids that). 7. Lost root password: use the documented reset procedure. --skip-grant-tables is for brief, local recovery only and must never be left on. 8. If the error appears only with an old connector after an upgrade to MySQL 8, see the caching_sha2_password authentication entry. 9. On Amazon RDS, if you are locked out, the master user password can be reset by modifying the DB instance (console, CLI or API); also check that the security group allows your client, since that gives connection errors rather than 1045. Verify: mysql -u app -p -h <host> appdb connects and SELECT CURRENT_USER(); shows the account you intended. Sources: https://dev.mysql.com/doc/refman/8.0/en/problems-connecting.html https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_Troubleshooting.html