I have created a SELECT-only login for a MariaDB database hosted on AWS RDS, named data with a password, and permission to connect from any host. The login should be able to connect to the server and SELECT only from all tables & views in a database named erp. The login should also be able to read view definitions.

Running show grants for 'data'@'%'; gives:

"GRANT USAGE ON *.* TO `data`@`%` IDENTIFIED BY PASSWORD '*^^^^^'"
"GRANT SELECT, SHOW VIEW ON `erp`.* TO `data`@`%`"

Running

select user, host, password
from mysql.user
where user = 'data';

gives

"User","Host","Password"
"data","%","*^^^^"

However, when I try to connect using this login I get :

[28000][1045] (conn=3269827) Access denied for user 'data'@'^^^^' (using password: YES)

Any ideas – have I missed a step? Where should I look to try to troubleshoot this?