GRANT PERMISSION

Grants access to data resources to a role. Database resources are database objects that store or modify data, such as keyspaces, tables, and functions. Permissions are applied immediately, even to active client sessions.

Enable authentication and authorization in the cassandra.yaml file to enable the access control to database resources.

Syntax

GRANT <permission> ON <resource> TO <role_name> ;

Legend
Syntax conventions	Description
UPPERCASE	Literal keyword.
Lowercase	Not literal.
`< >`	Variable value. Replace with a user-defined value.
`[]`	Optional. Square brackets (`[]`) surround optional command arguments. Do not type the square brackets.
`( )`	Group. Parentheses ( `( )` ) identify a group to choose from. Do not type the parentheses.
`\|`	Or. A vertical bar (`\|`) separates alternative elements. Type any one of the elements. Do not type the vertical bar.
`...`	Repeatable. An ellipsis ( `...` ) indicates that you can repeat the syntax element as often as required.
`'<Literal string>'`	Single quotation (`'`) marks must surround literal strings in CQL statements. Use single quotation marks to preserve upper case.
`{ <key> : <value> }`	Map collection. Braces (`{ }`) enclose map collections or key value pairs. A colon separates the key and the value.
`<datatype2`	Set, list, map, or tuple. Angle brackets ( `< >` ) enclose data types in a set, list, map, or tuple. Separate the data types with a comma.
`<cql_statement>;`	End CQL statement. A semicolon (`;`) terminates all CQL statements.
`[--]`	Separate the command line options from the command arguments with two hyphens ( `--` ). This syntax is useful when arguments might be mistaken for command line options.
`' <<schema\> ... </schema\>> '`	Search CQL only: Single quotation marks (`'`) surround an entire XML schema declaration.
`@<xml_entity>='<xml_entity_type>'`	Search CQL only: Identify the entity and literal value to overwrite the XML element in the schema and solrConfig files.

Access control matrix tables

In the following tables, the hierarchy of permissions is shown for each resource type, as well as the permissions that can be granted on each resource.

Resource permissions control the type of access that a role has to a database resource.

A database resource is a Cassandra database object on which permissions are applied. Database resources have a modeled hierarchy: Permissions on a top level object inherently grant the role the same permissions on the object’s children.

Data resources

The following hierarchy is true for data resources, from broadest to narrowest scope:

ALL KEYSPACES
KEYSPACE <keyspace_name>
ALL TABLES IN KEYSPACE <keyspace_name>
TABLE <table_name>
'<filtering_data>' ROWS IN <table_name>

Resource type: Data
Privilege	Resource	Permissions
ALL PERMISSIONS	`resource_name`	All operations that are applicable to the resource and its ancestors, where resource name is listed below.
ALTER	ALL KEYSPACES	ALTER KEYSPACE, ALTER TABLE, ALTER TYPE, RESTRICT ROW in any keyspace.
ALTER	KEYSPACE `keyspace_name`	ALTER KEYSPACE, ALTER TABLE, ALTER TYPE, and RESTRICT ROW in specified keyspace.
ALTER	TABLE `table_name`	ALTER TABLE and RESTRICT ROW of specified table.
CREATE	ALL KEYSPACES	CREATE KEYSPACE, CREATE TABLE, CREATE FUNCTIONS, and CREATE TYPE in any keyspace.
CREATE	KEYSPACE `keyspace_name`	CREATE TABLE and CREATE TYPE in specified keyspace.
DROP	ALL KEYSPACES	DROP KEYSPACE, DROP TABLE, and DROP TYPE in any keyspace
DROP	KEYSPACE `keyspace_name`	DROP TABLE and DROP TYPE in specified keyspace
DROP	TABLE `table_name`	DROP TABLE specified.
MODIFY	`filtering_data` ROWS IN `table_name`	MODIFY on rows that exactly match the `filtering_data` in specified table.
MODIFY	ALL KEYSPACES	INSERT, UPDATE, DELETE, and TRUNCATE on any table.
MODIFY	KEYSPACE `keyspace_name`	INSERT, UPDATE, DELETE, and TRUNCATE on any table in specified keyspace.
MODIFY	TABLE `table_name`	INSERT, UPDATE, DELETE, and TRUNCATE on specified table.
SELECT	`filtering_data` ROWS IN `table_name`	SELECT on rows that exactly match the `filtering_data` in specified table.
SELECT	ALL KEYSPACES	SELECT on any table.
SELECT	KEYSPACE `keyspace_name`	SELECT on any table in specified keyspace.
SELECT	TABLE `table_name`	SELECT on specified table.

Function resources

The following hierarchy is true for function resources, from broadest to narrowest scope:

ALL FUNCTIONS
ALL FUNCTIONS IN KEYSPACE <keyspace_name> and FUNCTION <keyspace_name.function_name>(<argument_types>)

Resource type: Functions
Privilege	Resource	Permissions
ALTER	ALL FUNCTIONS	CREATE FUNCTION and CREATE AGGREGATE, also replace existing.
ALTER	ALL FUNCTIONS IN KEYSPACE `keyspace_name`	CREATE FUNCTION and CREATE AGGREGATE, also replace existing in specified keyspace
ALTER	FUNCTION `function_name`	CREATE FUNCTION and CREATE AGGREGATE, also replace existing.
CREATE	ALL FUNCTIONS	CREATE FUNCTION in any keyspace and CREATE AGGREGATE in any keyspace.
CREATE	ALL FUNCTIONS IN KEYSPACE `keyspace_name`	CREATE FUNCTION and CREATE AGGREGATE in specified keyspace.
DROP	ALL FUNCTIONS	DROP FUNCTION and DROP AGGREGATE in any keyspace.
DROP	ALL FUNCTIONS IN KEYSPACE `keyspace_name`	DROP FUNCTION and DROP AGGREGATE in specified keyspace.
DROP	FUNCTION `function_name`	DROP FUNCTION specified function.
EXECUTE	ALL FUNCTIONS	SELECT, INSERT, and UPDATE using any function, and use of any function in CREATE AGGREGATE.
EXECUTE	ALL FUNCTIONS IN KEYSPACE `keyspace_name`	SELECT, INSERT, and UPDATE using any function in specified keyspace and use of any function in a keyspace in CREATE AGGREGATE.
EXECUTE	FUNCTION `function_name`	SELECT, INSERT, and UPDATE using specified function, and use of the function in CREATE AGGREGATE.

JMX resources

The following hierarchy is true for JMX resources, from broadest to narrowest scope:

ALL MBEANS
MBEAN <mbean_name> and MBEANS <pattern>

Resource type: JMX
Privilege	Resource	Permissions
DESCRIBE	ALL MBEANS	Retrieve metadata about any mbean from the platform’s MBeanServer.
DESCRIBE	MBEAN `mbean_name`	Retrieve metadata about a named mbean from the platform’s MBeanServer.
DESCRIBE	MBEANS pattern	Retrieve metadata about any mbean matching a wildcard pattern from the platform’s MBeanServer.
EXECUTE	ALL MBEANS	Execute operations on any mbean.
EXECUTE	MBEAN `mbean_name`	Execute operations on named mbean.
EXECUTE	MBEANS pattern	Execute operations on any mbean matching a wildcard pattern.
MODIFY	ALL MBEANS	Call setter methods on any mbean.
MODIFY	MBEAN `mbean_name`	Call setter methods on named mbean.
MODIFY	MBEANS pattern	Call setter methods on any mbean matching a wildcard pattern.
SELECT	ALL MBEANS	Call getter methods on any mbean.
SELECT	MBEAN `mbean_name`	Call getter methods on named mbean.
SELECT	MBEANS pattern	Call getter methods on any mbean matching a wildcard pattern.

Role management resources

The following hierarchy is true for role management resources, from broadest to narrowest scope:

ALL ROLES
ROLE <role_name>

Resource type: Role management
Privilege	Resource	Permissions
ALTER	ALL ROLES	ALTER ROLE on any role.
ALTER	ROLE `role_name`	ALTER ROLE for specified role.
AUTHORIZE	`resource_name`	GRANT privilege and REVOKE privilege on the resource. Note: Roles are resources. Requires that user has AUTHORIZE on the resource.
CREATE	ALL ROLES	CREATE ROLE.
DESCRIBE	ALL ROLES	LIST privilege on all roles or only roles granted to another specified role.
DROP	ALL ROLES	Drop all roles.
DROP	ROLE `role_name`	Drop the specified role.
PROXY.EXECUTE	ROLE `role_name`	After authenticating issue individual requests as a different user.
PROXY.LOGIN	ROLE `role_name`	After authenticating issue all requests as a different user.
`role_name`	`resource_name`	Grant role (as a set of permissions) to another role. Requires AUTHORIZE permission on the permission role and target role.

Search index resources

The following hierarchy is true for search indexes, from broadest to narrowest scope:

ALL SEARCH INDICES
SEARCH KEYSPACE <keyspace_name>
SEARCH INDICES [<keyspace_name>.]<table_name>
SEARCH INDEX <keyspace_name>.<table_name>

Resource type: Search index
Privilege	Resource	Permissions
ALL PERMISSIONS	ALL SEARCH INDICES	All search index privileges for all search indexes in the system.
ALL PERMISSIONS	SEARCH KEYSPACE `keyspace_name`	All search index privileges for all tables in specified keyspace.
ALL PERMISSIONS	SEARCH INDEX `[keyspace_name.]table_name`	All search index privileges for specified table.
SEARCH.ALTER	ALL SEARCH INDICES	ALTER SEARCH INDEX on all tables in all keyspaces.
SEARCH.ALTER	SEARCH KEYSPACE `keyspace_name`	ALTER SEARCH INDEX on all tables in specified keyspace.
SEARCH.ALTER	SEARCH INDEX `[keyspace_name.]table_name`	ALTER SEARCH INDEX on specified table.
SEARCH.COMMIT	ALL SEARCH INDICES	COMMIT SEARCH INDEX on all tables in all keyspaces.
SEARCH.COMMIT	SEARCH KEYSPACE `keyspace_name`	COMMIT SEARCH INDEX on all tables in specified keyspace.
SEARCH.COMMIT	SEARCH INDEX `[keyspace_name.]table_name`	COMMIT SEARCH INDEX on specified table.
SEARCH.CREATE	ALL SEARCH INDICES	CREATE SEARCH INDEX on all tables in all keyspaces.
SEARCH.CREATE	SEARCH KEYSPACE `keyspace_name`	CREATE SEARCH INDEX on all tables in specified keyspace.
SEARCH.CREATE	SEARCH INDEX `[keyspace_name.]table_name`	CREATE SEARCH INDEX on specified table.
SEARCH.DROP	ALL SEARCH INDICES	DROP SEARCH INDEX on all tables in all keyspaces.
SEARCH.DROP	SEARCH KEYSPACE `keyspace_name`	DROP SEARCH INDEX on all tables in specified keyspace.
SEARCH.DROP	SEARCH INDEX `[keyspace_name.]table_name`	DROP SEARCH INDEX on specified table.
SEARCH.REBUILD	ALL SEARCH INDICES	REBUILD SEARCH INDEX on any table in all keyspaces.
SEARCH.REBUILD	SEARCH KEYSPACE `keyspace_name`	REBUILD SEARCH INDEX on all tables in specified keyspace.
SEARCH.REBUILD	SEARCH INDEX `[keyspace_name.]table_name`	REBUILD SEARCH INDEX on specified table.
SEARCH.RELOAD	ALL SEARCH INDICES	RELOAD SEARCH INDEX on all tables in all keyspaces.
SEARCH.RELOAD	SEARCH KEYSPACE `keyspace_name`	RELOAD SEARCH INDEX on all tables in specified keyspace.
SEARCH.RELOAD	SEARCH INDEX `[keyspace_name.]table_name`	RELOAD SEARCH INDEX on specified table.

Spark application resources

Spark application resource permissions can be granted on workpools or submissions.

The following hierarchy is true for Apache Spark™ application workpools, from broadest to narrowest scope:

ANY WORKPOOL
WORKPOOL <datacenter_name>.*
WORKPOOL <datacenter_name>.<workpool_name>

The following hierarchy is true for Spark application submissions, from broadest to narrowest scope:

ANY SUBMISSION
ANY SUBMISSION IN WORKPOOL <datacenter_name>.*
SUBMISSION <application_ID>

Resource type: Spark applications
Privilege	Resource	Permissions
CREATE	ANY WORKPOOL	Submit an application to the work pool in any datacenter.
CREATE	WORKPOOL `datacenter_name`	Submit an application to the work pool in a specific datacenter.
MODIFY	ANY SUBMISSION	Manage any applications across all datacenters.
MODIFY	ANY SUBMISSION IN WORKPOOL `datacenter_name`	Manage applications in a specified datacenter.
MODIFY	SUBMISSION application_ID IN WORKPOOL `datacenter_name`	Manage a single application in a specified datacenter.

Examples

Grant simple permission on a resource to a role

Grant the ALTER permission on the keyspace cycling to the coach role:
```
GRANT ALTER ON KEYSPACE cycling TO coach;
```
Grant the SELECT permission on all keyspaces to the team_manager role:
```
GRANT SELECT ON ALL KEYSPACES TO team_manager;
```

Grant EXECUTE on functions to the team_manager role:

GRANT EXECUTE ON FUNCTION cycling.fLog(double) TO team_manager;

Grant all permissions on a resource to a role

Grant all permissions on the keyspace cycling to the cycling_admin role:

GRANT ALL PERMISSIONS ON KEYSPACE cycling TO cycling_admin;

Grant multiple permissions on a resource to a role

Grant the SELECT, TRUNCATE, and UPDATE permissions on the keyspace cycling to the coach role:

GRANT SELECT, TRUNCATE, UPDATE ON KEYSPACE cycling TO coach;

Grant `AUTHORIZE` to allow a role to manage access to specific resources

The AUTHORIZE permission allows a role to control access to specific resources. The role can grant permissions to other roles on the specified resources.

Grant the AUTHORIZE permission on all keyspaces to the sys_admin role. This allows the sys_admin role to manage permissions for all keyspaces in the cluster.
```
GRANT AUTHORIZE ON ALL KEYSPACES TO sys_admin;
```
This makes the role a superuser in the cluster because roles can modify their own permissions as well as roles that they inherit permissions from.
Grant the AUTHORIZE permission on the cycling keyspace to the cycling_admin role. This allows the cycling_admin role to grant permissions to other roles on resources in the cycling keyspace, but not in any other keyspace.
```
GRANT AUTHORIZE ON KEYSPACE cycling TO cycling_admin;
```
This makes the role a superuser in the cycling keyspace because roles can modify their own permissions as well as roles that they inherit permissions from.
Grant the AUTHORIZE permission on the cycling.birthday_list table to the sam role. This allows the sam role to grant permissions to query (SELECT) and modify (e.g. INSERT, UPDATE, DELETE) data in the cycling.birthday_list table, but not on any other table.
```
GRANT AUTHORIZE ON TABLE cycling.birthday_list TO sam;
```