REVOKE ROLE

Removes the privileges of one role from another role. The role that is being revoked must have been granted to the role by another role. Privilege removal is immediate, even to active client sessions.

See REVOKE PERMISSION to revoke permission to resources from a role.

Syntax

REVOKE <role_name> FROM <role_name> ;
Syntax legend
Legend
Syntax conventions Description

UPPERCASE

Literal keyword.

Lowercase

Not literal.

< >

Variable value. Replace with a user-defined value.

[]

Optional. Square brackets ([]) surround optional command arguments. Do not type the square brackets.

( )

Group. Parentheses ( ( ) ) identify a group to choose from. Do not type the parentheses.

|

Or. A vertical bar (|) separates alternative elements. Type any one of the elements. Do not type the vertical bar.

...

Repeatable. An ellipsis ( ... ) indicates that you can repeat the syntax element as often as required.

'<Literal string>'

Single quotation (') marks must surround literal strings in CQL statements. Use single quotation marks to preserve upper case.

{ <key> : <value> }

Map collection. Braces ({ }) enclose map collections or key value pairs. A colon separates the key and the value.

<datatype2

Set, list, map, or tuple. Angle brackets ( < > ) enclose data types in a set, list, map, or tuple. Separate the data types with a comma.

<cql_statement>;

End CQL statement. A semicolon (;) terminates all CQL statements.

[--]

Separate the command line options from the command arguments with two hyphens ( -- ). This syntax is useful when arguments might be mistaken for command line options.

' <<schema\> ... </schema\>> '

Search CQL only: Single quotation marks (') surround an entire XML schema declaration.

@<xml_entity>='<xml_entity_type>'

Search CQL only: Identify the entity and literal value to overwrite the XML element in the schema and solrConfig files.

Parameters

Parameter Description Default

role_name

Identifier of the role. CQL forces all names to lowercase. If you need to preserve case or use special characters in the role name, enclose <role_name> in quotes.

Example

Manage permissions using GRANT and REVOKE.

+

A role can only modify permissions of another role and can only modify (GRANT or REVOKE) role permissions that it also has.

The role coach can no longer perform queries or modify data in the cycling keyspace.

REVOKE cycling_admin FROM coach;
  1. View the coach’s permissions, to see that coach now has lost the cycling_admin permissions.

    LIST ALL PERMISSIONS OF coach;
 role | resource | permissions
------+----------+-------------

(0 rows)

Restriction:

Because of inheritance, the user can perform SELECT queries on cycling.name if one of these conditions is met:

  • The user is a superuser.

  • The user has SELECT on ALL KEYSPACES permissions.

  • The user has SELECT on the cycling keyspace.

The role coach can no longer perform ALTER commands in the cycling keyspace:

# REVOKE ALTER ON KEYSPACE cycling FROM coach;

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000, info@datastax.com