GRANT PERMISSION

Grants access to data resources to a role. Database resources are database objects that store or modify data, such as keyspaces, tables, and functions. Permissions are applied immediately, even to active client sessions.

Enable authentication and authorization in the cassandra.yaml file to enable the access control to database resources.

Syntax

GRANT <permission> ON <resource> TO <role_name> ;

Syntax legend

Legend
Syntax conventions	Description
UPPERCASE	Literal keyword.
Lowercase	Not literal.
`< >`	Variable value. Replace with a user-defined value.
`[]`	Optional. Square brackets (`[]`) surround optional command arguments. Do not type the square brackets.
`( )`	Group. Parentheses ( `( )` ) identify a group to choose from. Do not type the parentheses.
`\|`	Or. A vertical bar (`\|`) separates alternative elements. Type any one of the elements. Do not type the vertical bar.
`...`	Repeatable. An ellipsis ( `...` ) indicates that you can repeat the syntax element as often as required.
`'<Literal string>'`	Single quotation (`'`) marks must surround literal strings in CQL statements. Use single quotation marks to preserve upper case.
`{ <key> : <value> }`	Map collection. Braces (`{ }`) enclose map collections or key value pairs. A colon separates the key and the value.
`<datatype2`	Set, list, map, or tuple. Angle brackets ( `< >` ) enclose data types in a set, list, map, or tuple. Separate the data types with a comma.
`<cql_statement>;`	End CQL statement. A semicolon (`;`) terminates all CQL statements.
`[--]`	Separate the command line options from the command arguments with two hyphens ( `--` ). This syntax is useful when arguments might be mistaken for command line options.
`' <<schema\> ... </schema\>> '`	Search CQL only: Single quotation marks (`'`) surround an entire XML schema declaration.
`@<xml_entity>='<xml_entity_type>'`	Search CQL only: Identify the entity and literal value to overwrite the XML element in the schema and solrConfig files.

Parameters

Access control matrix tables

In the following tables, the hierarchy of permissions is shown for each resource type, as well as the permissions that can be granted on each resource.

Data resources

Cassandra database objects on which permissions are applied. Database resources have modelled hierarchy, the permission on a top level object gives the role the same permission on the objects ancestors.

Resource permissions

Type of access a role has to a database resource.

The following hierarchy is true for data: ALL KEYSPACES > KEYSPACE <keyspace_name> > ALL TABLES IN KEYSPACE <keyspace_name> > TABLE <table_name> > '<filtering_data>' ROWS IN <table_name>

Resource type: Data

Privilege Resource Permissions

Privilege	Resource	Permissions
ALL PERMISSIONS	`resource_name`	All operations that are applicable to the resource and its ancestors, where resource name is listed below.
ALTER	ALL KEYSPACES	ALTER KEYSPACE, ALTER TABLE, ALTER TYPE, RESTRICT ROW in any keyspace.
ALTER	KEYSPACE `keyspace_name`	ALTER KEYSPACE, ALTER TABLE, ALTER TYPE, and RESTRICT ROW in specified keyspace.
ALTER	TABLE `table_name`	ALTER TABLE and RESTRICT ROW of specified table.
CREATE	ALL KEYSPACES	CREATE KEYSPACE, CREATE TABLE, CREATE FUNCTIONS, and CREATE TYPE in any keyspace.
CREATE	KEYSPACE `keyspace_name`	CREATE TABLE and CREATE TYPE in specified keyspace.
DROP	ALL KEYSPACES	DROP KEYSPACE, DROP TABLE, and DROP TYPE in any keyspace
DROP	KEYSPACE `keyspace_name`	DROP TABLE and DROP TYPE in specified keyspace
DROP	TABLE `table_name`	DROP TABLE specified.
MODIFY	`filtering_data` ROWS IN `table_name`	MODIFY on rows that exactly match the `filtering_data` in specified table.
MODIFY	ALL KEYSPACES	INSERT, UPDATE, DELETE, and TRUNCATE on any table.
MODIFY	KEYSPACE `keyspace_name`	INSERT, UPDATE, DELETE, and TRUNCATE on any table in specified keyspace.
MODIFY	TABLE `table_name`	INSERT, UPDATE, DELETE, and TRUNCATE on specified table.
SELECT	`filtering_data` ROWS IN `table_name`	SELECT on rows that exactly match the `filtering_data` in specified table.
SELECT	ALL KEYSPACES	SELECT on any table.
SELECT	KEYSPACE `keyspace_name`	SELECT on any table in specified keyspace.
SELECT	TABLE `table_name`	SELECT on specified table.

ALL PERMISSIONS

resource_name

All operations that are applicable to the resource and its ancestors, where resource name is listed below.

ALTER

ALL KEYSPACES

ALTER KEYSPACE, ALTER TABLE, ALTER TYPE, RESTRICT ROW in any keyspace.

ALTER

KEYSPACE keyspace_name

ALTER KEYSPACE, ALTER TABLE, ALTER TYPE, and RESTRICT ROW in specified keyspace.

ALTER

TABLE table_name

ALTER TABLE and RESTRICT ROW of specified table.

CREATE

ALL KEYSPACES

CREATE KEYSPACE, CREATE TABLE, CREATE FUNCTIONS, and CREATE TYPE in any keyspace.

CREATE

KEYSPACE keyspace_name

CREATE TABLE and CREATE TYPE in specified keyspace.

DROP

ALL KEYSPACES

DROP KEYSPACE, DROP TABLE, and DROP TYPE in any keyspace

DROP

KEYSPACE keyspace_name

DROP TABLE and DROP TYPE in specified keyspace

DROP

TABLE table_name

DROP TABLE specified.

MODIFY

filtering_data ROWS IN table_name

MODIFY on rows that exactly match the filtering_data in specified table.

MODIFY

ALL KEYSPACES

INSERT, UPDATE, DELETE, and TRUNCATE on any table.

MODIFY

KEYSPACE keyspace_name

INSERT, UPDATE, DELETE, and TRUNCATE on any table in specified keyspace.

MODIFY

TABLE table_name

INSERT, UPDATE, DELETE, and TRUNCATE on specified table.

SELECT

filtering_data ROWS IN table_name

SELECT on rows that exactly match the filtering_data in specified table.

SELECT

ALL KEYSPACES

SELECT on any table.

SELECT

KEYSPACE keyspace_name

SELECT on any table in specified keyspace.

SELECT

TABLE table_name

SELECT on specified table.

The following hierarchy is true for JMX resources: ALL MBEANS > MBEAN <mbean_name> and MBEANS <pattern>

Resource type: JMX

Privilege Resource Permissions

Privilege	Resource	Permissions
DESCRIBE	ALL MBEANS	Retrieve metadata about any mbean from the platform’s MBeanServer.
DESCRIBE	MBEAN `mbean_name`	Retrieve metadata about a named mbean from the platform’s MBeanServer.
DESCRIBE	MBEANS pattern	Retrieve metadata about any mbean matching a wildcard pattern from the platform’s MBeanServer.
EXECUTE	ALL MBEANS	Execute operations on any mbean.
EXECUTE	MBEAN `mbean_name`	Execute operations on named mbean.
EXECUTE	MBEANS pattern	Execute operations on any mbean matching a wildcard pattern.
MODIFY	ALL MBEANS	Call setter methods on any mbean.
MODIFY	MBEAN `mbean_name`	Call setter methods on named mbean.
MODIFY	MBEANS pattern	Call setter methods on any mbean matching a wildcard pattern.
SELECT	ALL MBEANS	Call getter methods on any mbean.
SELECT	MBEAN `mbean_name`	Call getter methods on named mbean.
SELECT	MBEANS pattern	Call getter methods on any mbean matching a wildcard pattern.

DESCRIBE

ALL MBEANS

Retrieve metadata about any mbean from the platform’s MBeanServer.

DESCRIBE

MBEAN mbean_name

Retrieve metadata about a named mbean from the platform’s MBeanServer.

DESCRIBE

MBEANS pattern

Retrieve metadata about any mbean matching a wildcard pattern from the platform’s MBeanServer.

EXECUTE

ALL MBEANS

Execute operations on any mbean.

EXECUTE

MBEAN mbean_name

Execute operations on named mbean.

EXECUTE

MBEANS pattern

Execute operations on any mbean matching a wildcard pattern.

MODIFY

ALL MBEANS

Call setter methods on any mbean.

MODIFY

MBEAN mbean_name

Call setter methods on named mbean.

MODIFY

MBEANS pattern

Call setter methods on any mbean matching a wildcard pattern.

SELECT

ALL MBEANS

Call getter methods on any mbean.

SELECT

MBEAN mbean_name

Call getter methods on named mbean.

SELECT

MBEANS pattern

Call getter methods on any mbean matching a wildcard pattern.

Examples

Grant simple permission on a resource to a role

Grant the ALTER permission on the keyspace cycling to the coach role:

GRANT ALTER ON KEYSPACE cycling TO coach;

Grant the SELECT permission on all keyspaces to the team_manager role:

GRANT SELECT ON ALL KEYSPACES TO team_manager;

Grant EXECUTE on functions to the team_manager role:

GRANT EXECUTE ON FUNCTION cycling.fLog(double) TO team_manager;

Grant all permissions on a resource to a role

Grant all permissions on the keyspace cycling to the cycling_admin role:

GRANT ALL PERMISSIONS ON KEYSPACE cycling TO cycling_admin;

Grant multiple permissions on a resource to a role

Grant AUTHORIZE permission on a resource to a role

Grant the AUTHORIZE permission on all keyspaces to the sys_admin role:

GRANT AUTHORIZE ON ALL KEYSPACES TO sys_admin;

Grant the AUTHORIZE permission on the keyspace cycling to the cycling_admin role:

GRANT AUTHORIZE ON KEYSPACE cycling TO cycling_admin;

Grant the AUTHORIZE permission on the table cycling.birthday_list to the sam role:

GRANT AUTHORIZE ON TABLE cycling.birthday_list TO sam;

Manage permissions using `GRANT` and `REVOKE`.

A role can only modify permissions of another role and can only modify (GRANT or REVOKE) role permissions that it also has.

Assign the role full access to the cycling keyspace:

GRANT ALL PERMISSIONS ON KEYSPACE cycling TO cycling_admin;

Now assign the role to the coach.
```
GRANT cycling_admin TO coach;
```
This allows you to manage the permissions of all cycling administrators by modifying the cycling_admin role.

View the coach’s permissions.

CREATE ROLE IF NOT EXISTS coach 
WITH LOGIN = true 
  AND PASSWORD = 'All4One2day!';

Use `AUTHORIZE` to allow a role to manage access control of specific resources.

Allow role to grant any permission type, including AUTHORIZE, on all objects in the cycling keyspace:
```
GRANT AUTHORIZE ON KEYSPACE cycling TO cycling_admin;
```
This makes the role a superuser in the cycling keyspace because roles can modify their own permissions as well as roles that they inherit permissions from.
Allow the sam role to assign permission to run queries and change data in the cycling keyspace on a specific table:
```
GRANT AUTHORIZE ON TABLE cycling.birthday_list TO sam;
```

GRANT PERMISSION

Syntax

Parameters

Access control matrix tables

Data resources

Resource permissions

Examples

Grant simple permission on a resource to a role

Grant all permissions on a resource to a role

Grant multiple permissions on a resource to a role

Grant AUTHORIZE permission on a resource to a role

Manage permissions using `GRANT` and `REVOKE`.

Use `AUTHORIZE` to allow a role to manage access control of specific resources.

Was this helpful?

Give Feedback