Functions and aggregate resources

The function syntax applies to user defined functions and aggregates. Although user defined functions and aggregates are located in a keyspace, function permissions are distinct and must be applied separately. Access is controlled using modelled hierarchy. Granting and revoking a privilege on a top level object automatically allows the same permission on all ancestors.

Use the following syntax to control access to functions:

• ALL FUNCTIONS syntax:

  GRANT privilege_list 
  ON ALL FUNCTIONS 
  TO role_name;

  where the privileges are ALL PERMISSIONS, ALTER, CREATE, DROP, and EXECUTE
• ALL FUNCTIONS IN KEYSPACE syntax:

  GRANT privilege_list 
  ON ALL FUNCTIONS IN KEYSPACE keyspace_name 
  TO role_name;

  where the privileges are ALL PERMISSIONS, ALTER, CREATE, DROP, and EXECUTE
• FUNCTION syntax:

  GRANT privilege_list 
  ON FUNCTION function_name ( argument_types ) 
  TO role_name;

  where the function name is fully qualified and the privileges are ALL PERMISSIONS, ALTER, DROP, and EXECUTE

Revoke permission syntax:

REVOKE permission_list 
ON resource 
FROM role_name; 

When a permission is granted to a role, users are able to perform the corresponding operations.

privilege_name	resource_name	Permissions
ALL PERMISSIONS	ALL FUNCTIONS	All operations (ALTER, CREATE, DROP, and EXECUTE permissions) on all functions in all keyspaces.
ALL PERMISSIONS	ALL FUNCTIONS IN KEYSPACE	All operations (ALTER, CREATE, DROP, and EXECUTE) on all functions in the selected keyspace.
ALL PERMISSIONS	FUNCTION	All operations (ALTER, DROP, and EXECUTE) on the selected function.
ALTER	ALL FUNCTIONS	CREATE OR REPLACE FUNCTION and CREATE OR REPLACE AGGREGATE on existing functions in all keyspaces.
ALTER	ALL FUNCTIONS IN KEYSPACE keyspace_name	CREATE OR REPLACE FUNCTION and CREATE OR REPLACE AGGREGATE on existing functions in a specific keyspace.
ALTER	FUNCTION function_name	CREATE OR REPLACE FUNCTION and CREATE OR REPLACE AGGREGATE on an existing function.
CREATE	ALL FUNCTIONS	CREATE FUNCTION and CREATE AGGREGATE in all keyspaces.
CREATE	ALL FUNCTIONS IN KEYSPACE keyspace_name	CREATE FUNCTION and CREATE AGGREGATE in specified keyspace.
DROP	ALL FUNCTIONS	DROP FUNCTION and DROP AGGREGATE in all keyspaces.
DROP	ALL FUNCTIONS IN KEYSPACE keyspace_name	DROP FUNCTION and DROP AGGREGATE in specified keyspace.
DROP	FUNCTION function_name	DROP FUNCTION or DROP AGGREGATE specified function.
EXECUTE	ALL FUNCTIONS	Use a function or aggregate in SELECT, INSERT, and UPDATE in all keyspaces. Create an aggregate that contains a function.
EXECUTE	ALL FUNCTIONS IN KEYSPACE keyspace_name	Use a function or aggregate in SELECT, INSERT, and UPDATE in a keypsace. Create an aggregate that contains a function in the keyspace.
EXECUTE	FUNCTION function_name	SELECT, INSERT and UPDATE using specified function and use of the function in CREATE AGGREGATE.