Controlling Access to DataStax Studio

Allow access for DataStax Studio use:

GRANT <permission_name>
ON <keyspace_name>.<table_name>
TO <role_name>;

Remove access to DataStax Studio use:

REVOKE <permission_name>
ON <keyspace_name>.<table_name>
FROM <role_name>;

Manage permissions for all search indexes:

GRANT AUTHORIZE FOR <permission_name>
ON KEYSPACE <required_keyspaces>
TO <role_name>;

Limit permissions to manage permissions to individual tables:

GRANT AUTHORIZE FOR <permission_name>
ON <required_keyspaces>
TO <role_name>;

A Studio user must have the following SELECT permissions:

GRANT SELECT ON system_auth.roles to <studio_role>;

A Studio user must have the following SELECT permissions to access DataStax Graph schema views:

GRANT SELECT ON system_schema.vertices to <studio_role>;
GRANT SELECT ON system_schema.edges to <studio_role>;

If DSE Search is used for any data in Studio, the following permission is required to access the search resources and display search indexes:

GRANT SELECT ON solr_admin.solr_resources to <studio_role>;

The following permissions are required if AlwaysOn SparkSQL is used in Studio, to determine AOSS status, display SparkSQL cached tables in the schema view, identify the current datacenter for the SparkSQL-cached tables, and identify DataStax Graph and AOSS host servers:

GRANT SELECT ON dse_analytics.alwayson_sql_info to <studio_role>;
GRANT SELECT ON dse_analytics.alwayson_cache_table to <studio_role>;
GRANT SELECT ON system.local to <studio_role>;

Additional permissions required if AlwaysOn Spark SQL is used in Studio identify the current datacenter for the SparkSQL-cached tables, and identify DataStax Graph and AOSS host servers:

GRANT EXECUTE ON REMOTE OBJECT DseClientTool to <studio_role>;

Lastly, SparkSQL queries do not execute and no error is displayed if this last permission is not set:

GRANT PROXY.EXECUTE ON ROLE <studio_role> TO alwayson_sql;