Control access to DataStax Studio

In your DataStax Studio connections, the specified role (username) must have the required permissions to execute the commands in your DataStax Studio notebooks. Use GRANT and REVOKE statements to assign and remove permissions for DataStax Studio.

Synopsis

GRANT

GRANT <permission_name>
ON <keyspace_name>.<table_name>
TO <role_name>;

REVOKE

REVOKE <permission_name>
ON <keyspace_name>.<table_name>
FROM <role_name>;

Options

keyspace_name

The name of the keyspace on which the permission is granted or revoked.

table_name

The name of the table on which the permission is granted or revoked.

role_name

The name of the role to which the permission is granted or revoked.

permission_name

The name of the permission being granted or revoked. Specific permissions are required for different actions in DataStax Studio:

SELECT: Run SELECT statements in DataStax Studio notebooks.
EXECUTE: Perform execute operations for REMOTE OBJECT DseClientTool.
PROXY.EXECUTE: Allows running AlwaysOn Spark SQL (AOSS) in DataStax Studio.

For more information, see Required DataStax Studio permissions.

Eligibility to manage DataStax Studio permissions

Roles with SUPERUSER status can perform any action and don’t require explicit AUTHORIZE permissions on DataStax Studio resources.

Non-SUPERUSER roles that manage DataStax Studio permissions must have AUTHORIZE on DataStax Studio resources.

You can grant AUTHORIZE on all tables in a keyspace or specific tables:

Manage permissions for all tables in a keyspace:

GRANT AUTHORIZE FOR <permission_name>
ON KEYSPACE <required_keyspaces>
TO <role_name>;

Manage permissions for specific tables:

GRANT AUTHORIZE FOR <permission_name>
ON <required_tables>
TO <role_name>;

Required DataStax Studio permissions

A DataStax Studio role must have SELECT permissions on system_auth.roles:
```
GRANT SELECT ON system_auth.roles to <studio_role>;
```
This permission allows validation of the CQL role settings for the DataStax Studio role.
If DSE Search is used for any data accessed through DataStax Studio, the following permission is required to access Search resources and indexes:
```
GRANT SELECT ON solr_admin.solr_resources to <studio_role>;
```
To use AlwaysOn Spark SQL (AOSS) in DataStax Studio, determine AOSS status, and show Spark SQL cached tables in the schema view the following permissions are required:
```
GRANT SELECT ON dse_analytics.alwayson_sql_info to <studio_role>;
GRANT SELECT ON dse_analytics.alwayson_cache_table to <studio_role>;
GRANT SELECT ON system.local to <studio_role>;
```
Permissions to system.local are available by default, but the role might need specific permissions granted.
If AOSS is used, the following permission is required to identify the current datacenter for the Spark SQL cached tables and the AOSS host server:
```
GRANT EXECUTE ON REMOTE OBJECT DseClientTool to <studio_role>;
```
To run Spark SQL queries the following permission is required:
```
GRANT PROXY.EXECUTE ON ROLE <studio_role> TO alwayson_sql;
```
If this permission isn’t set, Spark SQL queries are silently rejected.

Control access to DataStax Studio

Synopsis

Options

Eligibility to manage DataStax Studio permissions

Required DataStax Studio permissions

Was this helpful?

Give Feedback