Update a database user for a Cloud SQL instance. A common use case for
the `update_user` is to grant a user the `cloudsqlsuperuser` role,
which can provide a user with many required permissions.
This tool only supports updating users to assign database roles.
* This tool returns a long-running operation. Use the `get_operation` tool to poll its status
until the operation completes.
* Before calling the `update_user` tool, always check the existing configuration of the user
such as the user type with `list_users` tool.
* As a special case for MySQL, if the `list_users` tool returns a full email address for
the `iamEmail` field, for example `{name=test-account,
iamEmail=test-account@project-id.iam.gserviceaccount.com}`, then in your `update_user`
request, use the full email address in the `iamEmail` field in the `name` field of your
toolrequest. For example, `name=test-account@project-id.iam.gserviceaccount.com`.
Key parameters for updating user roles:
* `database_roles`: A list of database roles to be assigned to the user.
* `revokeExistingRoles`: A boolean field (default: false) that controls how existing roles
are handled.
How role updates work:
1. **If `revokeExistingRoles` is true:**
* Any existing roles granted to the user but NOT in the provided `database_roles` list
will be REVOKED.
* Revoking only applies to non-system roles. System roles like `cloudsqliamuser` etc won't be revoked.
* Any roles in the `database_roles` list that the user does NOT already have will be GRANTED.
* If `database_roles` is empty, then ALL existing non-system roles are revoked.
2. **If `revokeExistingRoles` is false (default):**
* Any roles in the `database_roles` list that the user does NOT already have will be GRANTED.
* Existing roles NOT in the `database_roles` list are KEPT.
* If `database_roles` is empty, then there is no change to the user's roles.
Examples:
* Existing Roles: `[roleA, roleB]`
* Request: `database_roles: [roleB, roleC], revokeExistingRoles: true`
* Result: Revokes `roleA`, Grants `roleC`. User roles become `[roleB, roleC]`.
* Request: `database_roles: [roleB, roleC], revokeExistingRoles: false`
* Result: Grants `roleC`. User roles become `[roleA, roleB, roleC]`.
* Request: `database_roles: [], revokeExistingRoles: true`
* Result: Revokes `roleA`, Revokes `roleB`. User roles become `[]`.
* Request: `database_roles: [], revokeExistingRoles: false`
* Result: No change. User roles remain `[roleA, roleB]`.