Controlling Access to Keyspaces and Tables

Authorize roles to access DataStax Enterprise (DSE) keyspaces and tables using CQL GRANT and REVOKE commands. Keyspaces, tables, and rows are hierarchical. Roles that have a privilege to access a top level object, such as a keyspace automatically have the permission on the child objects (table and rows).

DSE supports this CQL syntax in cqlsh to revoke permissions:

REVOKE <permission_name> ON <resource_name> FROM <role_name>;

Procedure

Create a role that has all permissions in all keyspaces:

CREATE ROLE keyspace_admin;
GRANT ALL PERMISSIONS ON ALL KEYSPACES TO keyspace_admin;

Create an administrator role for a single keyspace:

CREATE ROLE cycling_admin;
GRANT ALL PERMISSIONS ON KEYSPACE cycling to cycling_admin;

Create a role that can only make data changes, INSERT, UPDATE, DELETE, and TRUNCATE for any table in the keyspace cycling:
```
GRANT MODIFY ON KEYSPACE cycling TO team_manager;
```

Create a role that can only select data and use functions in the cycling keyspace:

CREATE ROLE cyclist_analyst;
GRANT SELECT ON KEYSPACE cycling TO cyclist_analyst;
GRANT EXECUTE ON ALL FUNCTIONS IN KEYSPACE cycling to cyclist_analyst;

Controlling Access to Keyspaces and Tables

Procedure

Was this helpful?

Give Feedback