A CREATE ROLE statement is a CQL command that creates a named authorization role. A newly created role has no permissions by default, and it is not necessarily allowed to log in. Use GRANT separately to assign permissions or inherit another role’s permissions. section 10.6.2
Create an application role
After connecting to cqlsh as an administrative user, run CREATE ROLE application;. LIST ROLES shows application alongside the existing cassandra role, with super set to False and login set to False. Grant access explicitly, for example with GRANT SELECT ON KEYSPACE reviews TO application; and GRANT MODIFY ON KEYSPACE reviews TO application;. section 10.6.2
Create a login role
CREATE ROLE reviews_api WITH PASSWORD = 'password' AND LOGIN = true; creates a role intended for authenticated application access. GRANT application TO reviews_api; gives it the permissions inherited from application. section 10.6.2
cassandra@cqlsh> LIST ROLES;
@ Row 1
---------+-------------
role | application
super | False
login | False
options | {}
@ Row 2
---------+-------------
role | cassandra
super | True
login | True
options | {}
(2 rows)
Inspect the resulting role metadata, including superuser and login status. section 10.6.2
