About database objects permissions

RBAC in Hyper-Converged Database (HCD)

RBAC in HCD follows a hierarchical model where permissions cascade from parent objects to child objects. Granting a permission on a keyspace automatically grants the same permission on all tables within that keyspace, unless explicitly overridden.

Key concepts

Roles: Users and other roles that can be assigned permissions
Resources: Database objects like keyspaces, tables, functions, etc.
Privileges: Specific actions that can be performed (SELECT, INSERT, MODIFY, etc.)
Permissions: The combination of a privilege and a resource

Permission hierarchy

The permission hierarchy in Hyper-Converged Database (HCD) follows this structure:

Cluster-level permissions: Affect the entire database cluster
Keyspace-level permissions: Apply to all objects within a keyspace
Table-level permissions: Grant access to individual tables
Row-level permissions: Provide fine-grained access control within tables
Function and aggregate permissions: Give access to user-defined functions
Role management permissions: Control role creation and modification

Manage permissions

After creating a role, use the following CQL commands to manage permissions:

GRANT allows access
REVOKE removes access that has been granted
RESTRICT explicitly denies access even if permission is granted directly or inherited
UNRESTRICT removes a restriction

RESTRICT always takes precedence over GRANT, including access that is inherited or automatically granted to a superuser role. Only superusers can restrict access.

Permission inheritance

Permissions in HCD follow an inheritance model:

Granting a permission on a parent object automatically grants the same permission on all child objects
Child object permissions can override inherited permissions
The most restrictive permission always takes precedence
Permissions can be granted directly or inherited from role hierarchies

Common permission patterns

Read-only access: Grant SELECT on specific tables or keyspaces
Data modification: Grant INSERT, UPDATE, DELETE as needed
Schema management: Grant CREATE, ALTER, DROP for structural changes
Administrative access: Grant ALL PERMISSIONS for full control

Resource types and permissions

HCD RBAC uses a modeled hierarchy where different resource types have specific permission requirements. Granting a privilege to a top-level object gives the role the same permission to all child objects.

Permissions vary depending on the object type:

Data resources: Keyspaces, tables, rows, and types
Functions and aggregates: User-defined functions and aggregate functions
Search indexes: Full-text search capabilities
Roles: User and role management
Authentication schemes: Login and authentication methods
JMX resources: Monitoring and management tools
Remote procedures: Custom business logic execution