Creating a SQL Login and User on an AlwaysOn Replica
You need to create the login on the DB2 server. Use Robert's script so that it grabs the sid and password, well if it's a SQL account that is. 

Then grant the permission on DB1. That permission will auto-magically get copied over to DB2 due to the AG. 

There is no way to just grant permission on DB2. It has to be done on DB1. You can control access by disabling the login on DB1 though.