Restrict access to data

The RESTRICT command denies permission on a resource to the role. The user is denied access even if the privilege has been granted directly to the role or if it was inherited.

The UNRESTRICT command removes any restrictions the role has on a database resource.

Regardless of how you use RESTRICT, a role with the SUPERUSER option has full read/write access to the database. If you want to restrict certain database administrators from reading or modifying certain resources, don’t include the SUPERUSER option for those roles. Instead, create non-SUPERUSER roles, and then use RESTRICT to limit access to certain resources.

The GRANT and REVOKE commands only allow access to database resources that are unrestricted (UNRESTRICT).

The following example uses the RESTRICT command:

Start a cqlsh session using a SUPERUSER role:

cqlsh -u <username>

Using the default cassandra role can degrade performance because all requests, including login, are executed with consistency QUORUM.

When you install HCD, it creates a cassandra superuser role in the database, and HCD runs as this user. Don’t use the default cassandra role in production because it is a security risk. Instead, create a new superuser role for running HCD.

Create a role with the LOGIN option enabled and the SUPERUSER option disabled:
```
CREATE ROLE IF NOT EXISTS db_admin
WITH superuser = false
AND login = true
AND password = 'anypasswordwilldo';
```
A password is required for internally authenticated roles, but not for roles using LDAP or OIDC authentication.

Restrict the role from accessing the data in the cycling keyspace:

RESTRICT TRUNCATE, UPDATE, SELECT
ON KEYSPACE cycling
TO db_admin;

Verify the restriction:

SELECT role, resource, restricted
FROM system_auth.role_permissions
WHERE role = 'db_admin';

The results show the permissions denied to the role:

 role     | resource     | restricted
----------+--------------+----------------------
 db_admin | data/cycling | {'MODIFY', 'SELECT'}

(1 rows)

Restrict access to data

Was this helpful?

Give Feedback