Manage access

Set up roles that can manage permissions on objects without access permission.

Procedure

Create a role. For example securty_admin.
```
CREATE ROLE security_admin;
```

Allow the role to manage roles:

GRANT ALTER, CREATE, DROP, DESCRIBE
ON ALL ROLES
TO <security_admin>;

Allow authorization for all permissions with no access privileges.
- Data resources
  GRANT AUTHORIZE FOR ALL PERMISSIONS ON ALL KEYSPACES TO <security_admin>;
  which allows the role to grant AUTHORIZE, CREATE, ALTER, DROP, SELECT, MODIFY, and DESCRIBE permission to other roles.
- Functions and aggregate resources
  GRANT AUTHORIZE FOR ALL PERMISSIONS ON ALL FUNCTIONS TO <security_admin>;
  which allows the role to grant AUTHORIZE, CREATE, ALTER, DROP, and EXECUTE permission to other roles.
  GRANT AUTHORIZE FOR ALL PERMISSIONS ON ALL SEARCH INDICES TO <security_admin>;
  which allows the role to grant AUTHORIZE, SEARCH.CREATE, SEARCH.ALTER, SEARCH.DROP, SEARCH.RELOAD, SEARCH.REBUILD, and SEARCH.COMMIT to other roles.
- Roles
  GRANT AUTHORIZE FOR ALL PERMISSIONS ON ALL ROLES TO <security_admin>;
  which allows the role to grant AUTHORIZE, CREATE, ALTER, DROP, and DESCRIBE permission to other roles.
- Authentication scheme resources
  GRANT AUTHORIZE FOR ALL PERMISSIONS ON ALL AUTHENTICATION SCHEMES TO <security_admin>;
  which allows the role to grant AUTHORIZE and EXECUTE permission to other roles.
- JMX resources (MBeans) for HCD utilities
  GRANT AUTHORIZE FOR ALL PERMISSIONS ON ALL MBEANS TO <security_admin>;
  which allows the role to grant SELECT, MODIFY, AUTHORIZE, DESCRIBE, and EXECUTE permission to other roles.
- WORKPOOLS
  GRANT AUTHORIZE FOR ALL PERMISSIONS ON ANY WORKPOOL TO <security_admin>;
  which allows the role to grant CREATE, DESCRIBE, and AUTHORIZE permission to other roles.
  - SUBMISSIONS
    
    GRANT AUTHORIZE FOR ALL PERMISSIONS ON ANY SUBMISSION TO <security_admin>;
    
    which allows the role to grant MODIFY, DESCRIBE, and AUTHORIZE permission to other roles.
- Remote procedure calls
  GRANT AUTHORIZE FOR ALL PERMISSIONS ON ALL REMOTE CALLS TO <security_admin>;
Assign the role depending on the role management mode:
- Internal: Use the GRANT command to assign the role to a login or another group role.
  GRANT security_admin TO <login_role_name>;
- LDAP: Create a group object with a matching Common Name (CN) (security_admin) on your LDAP server and assign users as members of the group.

To grant all permissions on a resource to a role in a single statement, use ALL PERMISSIONS. This grants every applicable permission for the resource type in a single operation, which simplifies provisioning administrative roles.

GRANT ALL PERMISSIONS ON ALL KEYSPACES TO ROLE_NAME;

GRANT ALL PERMISSIONS ON KEYSPACE KEYSPACE_NAME TO ROLE_NAME;

GRANT ALL PERMISSIONS ON ALL ROLES TO ROLE_NAME;

Replace the following:

ROLE_NAME: The role to grant permissions to.
KEYSPACE_NAME: The keyspace to grant permissions on.

Manage access

Procedure

Grant bulk permissions

Was this helpful?

Give Feedback