Manage roles and permissions

Organization users can access databases via the Astra Portal, and applications can access them via the API.

To grant a user access to a database in the Astra Portal, you assign a role to the user’s account in your organization. To grant your application access to a database, you assign a role to the application token that your application uses to authenticate with the Astra API.

About roles

A role defines the level of access that a user or application has to a database. A role can be either a default role or a custom role.

All roles consist of:

A name
A set of permissions
A set of database and keyspace scopes

For example, you could assign one role to an organization user that grants access to a set of databases and another role to an application token that grants access to a specific set of keyspaces within a single database. This system allows you to mix and match access levels to different databases and keyspaces to satisfy your application and security requirements.

Default roles

Astra provides a set of default roles that you can assign to organization users and application tokens. These roles are designed to cover the most common use cases for accessing databases and other Astra resources.

Default roles are permitted to access all databases in an organization. If you assign a default role to an application token, then any application using that token is granted the privileges of that role on any of your databases. To limit the databases an application token can access, you must create a custom role.

Default roles available in Astra
Role name	Role permissions
Organization Administrator	Grants all permissions.
Administrator Service Account	Expand to see role permissions Organization permissions check Add Peering check Create DB block Delete Custom Role check Expand DB check Manage Metrics check Manage Private Endpoint check Manage Region check Manage Streaming block Read Audits check Read Billing check Read CMK Key block Read Custom Role block Read External Auth block Read Integrations block Read IP Access List block Read Organization block Read Token check Read User check Terminate DB check View DB check Write Billing check Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token check Write User Keyspace permissions check Alter Keyspace check Authorize Keyspace check Create All Keyspaces check Create Keyspace check Describe All Keyspaces check Describe Keyspace check Drop Keyspace check Grant Keyspace check Modify Keyspace Table permissions check Alter Table check Authorize Table check Create Table check Describe Table check Drop Table check Grant Table check Modify Table check Select Table API access permissions check Access CQL check Access GraphQL check Access REST
Administrator User	Expand to see role permissions Organization permissions check Add Peering check Create DB block Delete Custom Role check Expand DB check Manage Metrics check Manage Private Endpoint check Manage Region block Manage Streaming block Read Audits check Read Billing check Read CMK Key block Read Custom Role block Read External Auth block Read Integrations block Read IP Access List check Read Organization block Read Token check Read User check Terminate DB check View DB check Write Billing check Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token check Write User Keyspace permissions check Alter Keyspace check Authorize Keyspace check Create All Keyspaces check Create Keyspace check Describe All Keyspaces check Describe Keyspace check Drop Keyspace check Grant Keyspace check Modify Keyspace Table permissions check Alter Table check Authorize Table check Create Table check Describe Table check Drop Table check Grant Table check Modify Table check Select Table API access permissions check Access CQL check Access GraphQL check Access REST
Billing Administrator	Expand to see role permissions Organization permissions block Add Peering block Create DB block Delete Custom Role block Expand DB block Manage Metrics block Manage Private Endpoint block Manage Region block Manage Streaming block Read Audits check Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations block Read IP Access List block Read Organization block Read Token check Read User block Terminate DB check View DB check Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token block Write User Keyspace permissions block Alter Keyspace block Authorize Keyspace block Create All Keyspaces block Create Keyspace block Describe All Keyspaces block Describe Keyspace block Drop Keyspace block Grant Keyspace block Modify Keyspace Table permissions block Alter Table block Authorize Table block Create Table block Describe Table block Drop Table block Grant Table block Modify Table block Select Table API access permissions block Access CQL block Access GraphQL block Access REST
UI View Only	Expand to see role permissions Organization permissions block Add Peering block Create DB block Delete Custom Role block Expand DB block Manage Metrics block Manage Private Endpoint block Manage Region block Manage Streaming block Read Audits block Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token check Read User block Terminate DB check View DB block Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token block Write User Keyspace permissions block Alter Keyspace block Authorize Keyspace block Create All Keyspaces block Create Keyspace block Describe All Keyspaces block Describe Keyspace block Drop Keyspace block Grant Keyspace block Modify Keyspace Table permissions block Alter Table block Authorize Table block Create Table block Describe Table block Drop Table block Grant Table block Modify Table block Select Table API access permissions block Access CQL block Access GraphQL block Access REST
Database Administrator	Expand to see role permissions Organization permissions check Add Peering check Create DB block Delete Custom Role check Expand DB check Manage Metrics check Manage Private Endpoint check Manage Region block Manage Streaming block Read Audits block Read Billing check Read CMK Key check Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization check Read Token check Read User check Terminate DB check View DB block Write Billing check Write CMK Key block Write Custom Role block Write External Auth block Write Integrations check Write IP Access List block Write Organization check Write Token block Write User Keyspace permissions check Alter Keyspace check Authorize Keyspace check Create All Keyspaces check Create Keyspace check Describe All Keyspaces check Describe Keyspace check Drop Keyspace check Grant Keyspace check Modify Keyspace Table permissions check Alter Table check Authorize Table check Create Table check Describe Table check Drop Table check Grant Table check Modify Table check Select Table API access permissions check Access CQL check Access GraphQL check Access REST
Read Only Service Account	Expand to see role permissions Organization permissions block Add Peering block Create DB block Delete Custom Role block Expand DB block Manage Metrics block Manage Private Endpoint block Manage Region block Manage Streaming block Read Audits block Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token block Read User block Terminate DB block View DB block Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token block Write User Keyspace permissions block Alter Keyspace block Authorize Keyspace block Create All Keyspaces block Create Keyspace check Describe All Keyspaces check Describe Keyspace block Drop Keyspace block Grant Keyspace block Modify Keyspace Table permissions block Alter Table block Authorize Table block Create Table check Describe Table block Drop Table block Grant Table block Modify Table check Select Table API access permissions check Access CQL check Access GraphQL check Access REST
Read/Write Service Account	Expand to see role permissions Organization permissions block Add Peering block Create DB block Delete Custom Role block Expand DB block Manage Metrics block Manage Private Endpoint block Manage Region block Manage Streaming block Read Audits block Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token block Read User block Terminate DB block View DB block Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token block Write User Keyspace permissions block Alter Keyspace block Authorize Keyspace block Create All Keyspaces block Create Keyspace check Describe All Keyspaces check Describe Keyspace block Drop Keyspace block Grant Keyspace block Modify Keyspace Table permissions block Alter Table block Authorize Table block Create Table check Describe Table block Drop Table block Grant Table check Modify Table check Select Table API access permissions check Access CQL check Access GraphQL check Access REST
Read Only User	Expand to see role permissions Organization permissions block Add Peering block Create DB block Delete Custom Role block Expand DB block Manage Metrics block Manage Private Endpoint block Manage Region block Manage Streaming block Read Audits block Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token check Read User block Terminate DB check View DB block Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token block Write User Keyspace permissions block Alter Keyspace block Authorize Keyspace block Create All Keyspaces block Create Keyspace check Describe All Keyspaces check Describe Keyspace block Drop Keyspace block Grant Keyspace block Modify Keyspace Table permissions block Alter Table block Authorize Table block Create Table check Describe Table block Drop Table block Grant Table block Modify Table check Select Table API access permissions check Access CQL check Access GraphQL check Access REST
Read/Write User	Expand to see role permissions Organization permissions block Add Peering block Create DB block Delete Custom Role block Expand DB block Manage Metrics block Manage Private Endpoint block Manage Region block Manage Streaming block Read Audits block Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token check Read User block Terminate DB check View DB block Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token block Write User Keyspace permissions block Alter Keyspace block Authorize Keyspace block Create All Keyspaces block Create Keyspace check Describe All Keyspaces check Describe Keyspace block Drop Keyspace block Grant Keyspace block Modify Keyspace Table permissions block Alter Table block Authorize Table block Create Table check Describe Table block Drop Table block Grant Table check Modify Table check Select Table API access permissions check Access CQL check Access GraphQL check Access REST
API Administrator Service Account	Expand to see role permissions Organization permissions check Add Peering check Create DB block Delete Custom Role check Expand DB block Manage Metrics check Manage Private Endpoint check Manage Region check Manage Streaming block Read Audits check Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token check Read User check Terminate DB check View DB check Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token check Write User Keyspace permissions check Alter Keyspace check Authorize Keyspace check Create All Keyspaces check Create Keyspace check Describe All Keyspaces check Describe Keyspace check Drop Keyspace check Grant Keyspace check Modify Keyspace Table permissions check Alter Table check Authorize Table check Create Table check Describe Table check Drop Table check Grant Table check Modify Table check Select Table API access permissions block Access CQL check Access GraphQL check Access REST
API Read/Write Service Account	Expand to see role permissions Organization permissions block Add Peering block Create DB block Delete Custom Role block Expand DB block Manage Metrics block Manage Private Endpoint block Manage Region block Manage Streaming block Read Audits block Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token block Read User block Terminate DB block View DB block Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token block Write User Keyspace permissions block Alter Keyspace block Authorize Keyspace block Create All Keyspaces block Create Keyspace check Describe All Keyspaces check Describe Keyspace block Drop Keyspace block Grant Keyspace block Modify Keyspace Table permissions block Alter Table block Authorize Table block Create Table check Describe Table block Drop Table block Grant Table check Modify Table check Select Table API access permissions block Access CQL check Access GraphQL check Access REST
API Read Only Service Account	Expand to see role permissions Organization permissions block Add Peering block Create DB block Delete Custom Role block Expand DB block Manage Metrics block Manage Private Endpoint block Manage Region block Manage Streaming block Read Audits block Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token block Read User block Terminate DB block View DB block Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token block Write User Keyspace permissions block Alter Keyspace block Authorize Keyspace block Create All Keyspaces block Create Keyspace check Describe All Keyspaces check Describe Keyspace block Drop Keyspace block Grant Keyspace block Modify Keyspace Table permissions block Alter Table block Authorize Table block Create Table check Describe Table block Drop Table block Grant Table block Modify Table check Select Table API access permissions block Access CQL check Access GraphQL check Access REST
API Read Only User	Expand to see role permissions Organization permissions block Add Peering block Create DB block Delete Custom Role block Expand DB block Manage Metrics block Manage Private Endpoint block Manage Region block Manage Streaming block Read Audits block Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token check Read User block Terminate DB check View DB block Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token block Write User Keyspace permissions block Alter Keyspace block Authorize Keyspace block Create All Keyspaces block Create Keyspace check Describe All Keyspaces check Describe Keyspace block Drop Keyspace block Grant Keyspace block Modify Keyspace Table permissions block Alter Table block Authorize Table block Create Table check Describe Table block Drop Table block Grant Table block Modify Table check Select Table API access permissions block Access CQL check Access GraphQL check Access REST
API Administrator User	Expand to see role permissions Organization permissions check Add Peering check Create DB block Delete Custom Role check Expand DB block Manage Metrics check Manage Private Endpoint check Manage Region check Manage Streaming block Read Audits check Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token check Read User check Terminate DB check View DB check Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token check Write User Keyspace permissions check Alter Keyspace check Authorize Keyspace check Create All Keyspaces check Create Keyspace check Describe All Keyspaces check Describe Keyspace check Drop Keyspace check Grant Keyspace check Modify Keyspace Table permissions check Alter Table check Authorize Table check Create Table check Describe Table check Drop Table check Grant Table check Modify Table check Select Table API access permissions block Access CQL check Access GraphQL check Access REST
API Read/Write User	Expand to see role permissions Organization permissions block Add Peering block Create DB block Delete Custom Role block Expand DB block Manage Metrics block Manage Private Endpoint block Manage Region block Manage Streaming block Read Audits block Read Billing block Read CMK Key block Read Custom Role block Read External Auth block Read Integrations check Read IP Access List block Read Organization block Read Token check Read User block Terminate DB check View DB block Write Billing block Write CMK Key block Write Custom Role block Write External Auth block Write Integrations block Write IP Access List block Write Organization block Write Token block Write User Keyspace permissions block Alter Keyspace block Authorize Keyspace block Create All Keyspaces block Create Keyspace check Describe All Keyspaces check Describe Keyspace block Drop Keyspace block Grant Keyspace block Modify Keyspace Table permissions block Alter Table block Authorize Table block Create Table check Describe Table block Drop Table block Grant Table check Modify Table check Select Table API access permissions block Access CQL check Access GraphQL check Access REST

Custom roles

If none of the default roles meet your specific security requirements, you can create a custom role.

Manage custom roles

In the Astra Portal, you can view all custom roles in your organization by going to Settings > Roles.

To manage custom roles, you must have one of the following roles:

Organization Administrator
Database Administrator

Create a custom role

In the Astra Portal, go to Settings > Roles.
Click Add Custom Role.
Enter a name for the role in the Role Name field.
In the Add Permissions section, use the checkboxes to add permissions to the role.

You can add permissions from the following categories:
In the Add Databases section, select the specific databases and respective keyspaces you want the role scoped to. Or you can use the Apply permissions to all databases in this organization toggle to scope the role to all current and future databases.
Click Create Role.

The new role appears in the Roles tab. You can assign the role to an organization user or application token.

Edit a custom role

In the Astra Portal, go to Settings > Roles.
Find the role you want to edit, click more_vert More, and then select Edit Role.
When you’re done, click Edit Role.

Delete a custom role

Deleting a custom role removes it from all organization users and application tokens it is currently assigned to. Before deleting a custom role, reassign users to new roles and generate new application tokens to ensure continuity of access.

In the Astra Portal, go to Settings > Roles.
Find the role you want to delete, click more_vert More, and then select Delete Role.
In the confirmation dialog, click Delete Role.

About permissions

Permissions define resources and actions that can be accessed in a database. Permissions are assigned to roles and determine the level of access that a user or application has to a database.

Organization permissions

Permission name DevOps API parameter Description

Permission name	DevOps API parameter	Description
Add Peering	`org-db-addpeering`	Create a VPC peering connection (only for Astra DB Classic databases).
Create DB	`org-db-create`	Create a database using the DevOps API or Astra Portal.
Delete Custom Role	`org-role-delete`	Delete a custom role.
Manage Metrics	`db-manage-thirdpartymetrics`	Export metrics using the DevOps API. This permission is automatically assigned to the Organization Administrator, Database Administrator, Administrator Service Account, and Administrator User roles.
Manage Private Endpoint	`db-manage-privateendpoint`
Manage Region	`db-manage-region`	Add, create, or remove a region using the DevOps API or Astra Portal.
Manage Streaming
Read Audits	`org-audits-read`	Enables read and download audits.
Read Billing	`org-billing-read`	Enables links and access to billing details page.
Read CMK Key	`org-cmk-read`
Read Custom Role	`org-role-read`	View a custom role and its associated permissions.
Read External Auth	`org-external-auth-read`	View security settings related to external authentication providers.
Read Integrations	`org-integrations-read`	View available and installed third-party integrations in your organization.
Read IP Access List	`accesslist-read`	Enables links and access to acess list page.
Read Organization	`org-read`	View organization in Astra Portal.
Read Token	`org-token-read`	Read token details.
Read User	`org-user-read`	Access to viewing users of an organization.
Suspend DB	`org-db-suspend`	Suspend/unsuspend Astra DB Serverless databases.
Terminate DB	`org-db-terminate`	Permanently delete a database and all of of its data.
View DB	`org-db-view`	View a database in a list of databases or Astra Portal.
Write Billing	`org-billing-write`	Enables links and ability to add or edit billing payment info.
Write CMK Key	`org-cmk-write`
Write Custom Role	`org-role-write`	Create custom role.
Write External Auth	`org-external-auth-write`	Update security settings related to external auth providers.
Write Integrations	`org-integrations-write`	Install and manage third-party integrations in your organization.
Write IP Access List	`accesslist-write`	Create or modify an access list using the DevOps API or Astra Portal.
Write Organization	`org-write`	Create new organizations or delete an existing organization.
Write Token	`org-token-write`	Create application token.
Write User	`org-user-write`	Add, create, or remove a user using the DevOps API or Astra Portal.

Add Peering

org-db-addpeering

Create a VPC peering connection (only for Astra DB Classic databases).

Create DB

org-db-create

Create a database using the DevOps API or Astra Portal.

Delete Custom Role

org-role-delete

Delete a custom role.

Manage Metrics

db-manage-thirdpartymetrics

Export metrics using the DevOps API. This permission is automatically assigned to the Organization Administrator, Database Administrator, Administrator Service Account, and Administrator User roles.

Manage Private Endpoint

db-manage-privateendpoint

Manage Region

db-manage-region

Add, create, or remove a region using the DevOps API or Astra Portal.

Manage Streaming

Read Audits

org-audits-read

Enables read and download audits.

Read Billing

org-billing-read

Enables links and access to billing details page.

Read CMK Key

org-cmk-read

Read Custom Role

org-role-read

View a custom role and its associated permissions.

Read External Auth

org-external-auth-read

View security settings related to external authentication providers.

Read Integrations

org-integrations-read

View available and installed third-party integrations in your organization.

Read IP Access List

accesslist-read

Enables links and access to acess list page.

Read Organization

org-read

View organization in Astra Portal.

Read Token

org-token-read

Read token details.

Read User

org-user-read

Access to viewing users of an organization.

Suspend DB

org-db-suspend

Suspend/unsuspend Astra DB Serverless databases.

Terminate DB

org-db-terminate

Permanently delete a database and all of of its data.

View DB

org-db-view

View a database in a list of databases or Astra Portal.

Write Billing

org-billing-write

Enables links and ability to add or edit billing payment info.

Write CMK Key

org-cmk-write

Write Custom Role

org-role-write

Create custom role.

Write External Auth

org-external-auth-write

Update security settings related to external auth providers.

Write Integrations

org-integrations-write

Install and manage third-party integrations in your organization.

Write IP Access List

accesslist-write

Create or modify an access list using the DevOps API or Astra Portal.

Write Organization

org-write

Create new organizations or delete an existing organization.

Write Token

org-token-write

Create application token.

Write User

org-user-write

Add, create, or remove a user using the DevOps API or Astra Portal.

Keyspace permissions

Permission name DevOps API parameter Description

Permission name	DevOps API parameter	Description
Alter Keyspace	`db-keyspace-alter`	Make changes to a specified keyspace.
Authorize Keyspace	`db-keyspace-authorize`	Give access to specified keyspace.
Create All Keyspaces	`db-all-keyspace-create`
Create Keyspace	`db-keyspace-create`	Create keyspace. Available in only Astra Portal.
Describe All Keyspaces	`db-all-keyspace-describe`
Describe Keyspace	`db-keyspace-describe`	Get a list of tables within a specified keyspace.
Drop Keyspace	`db-keyspace-drop`	Remove keyspace. Available in only Astra Portal.
Grant Keyspace	`db-keyspace-grant`	Grant specific permissions for specified keyspace.
Modify Keyspace	`db-keyspace-modify`	Access or modify a keyspace.

Alter Keyspace

db-keyspace-alter

Make changes to a specified keyspace.

Authorize Keyspace

db-keyspace-authorize

Give access to specified keyspace.

Create All Keyspaces

db-all-keyspace-create

Create Keyspace

db-keyspace-create

Create keyspace. Available in only Astra Portal.

Describe All Keyspaces

db-all-keyspace-describe

Describe Keyspace

db-keyspace-describe

Get a list of tables within a specified keyspace.

Drop Keyspace

db-keyspace-drop

Remove keyspace. Available in only Astra Portal.

Grant Keyspace

db-keyspace-grant

Grant specific permissions for specified keyspace.

Modify Keyspace

db-keyspace-modify

Access or modify a keyspace.

Table permissions

Applies to all tables in the selected keyspaces.

Permission name DevOps API parameter Description

Permission name	DevOps API parameter	Description
Alter Table	`db-table-alter`
Authorize Table	`db-table-authorize`
Create Table	`db-table-create`
Describe Table	`db-table-describe`
Drop Table	`db-table-drop`
Grant Table	`db-table-grant`
Modify Table	`db-table-modify`
Select Table	`db-table-select`

Alter Table

db-table-alter

Authorize Table

db-table-authorize

Create Table

db-table-create

Describe Table

db-table-describe

Drop Table

db-table-drop

Grant Table

db-table-grant

Modify Table

db-table-modify

Select Table

db-table-select

API access permissions

Permission name DevOps API parameter Description

Permission name	DevOps API parameter	Description
Access CQL	`db-cql`	Connect to database via CQL.
Access GraphQL	`db-graphql`	Connect to database via GraphQL API.
Access REST	`db-rest`	Connect to database via REST API.

Access CQL

db-cql

Connect to database via CQL.

Access GraphQL

db-graphql

Connect to database via GraphQL API.

Access REST

db-rest

Connect to database via REST API.

Manage roles and permissions

About roles

Default roles

Custom roles

Manage custom roles

Create a custom role

Edit a custom role

Delete a custom role

About permissions

Organization permissions

Keyspace permissions

Table permissions

API access permissions

Was this helpful?

Give Feedback