A GRANT statement assigns permissions on a resource to a role, or grants one role to another. In ScyllaDB, it is central to role-based access control. section 10.6.2 section 10.7
Use the form GRANT (permission | "ALL PERMISSIONS") ON resource TO role.
- Permissions include CREATE, ALTER, DROP, SELECT, MODIFY, AUTHORIZE, and DESCRIBE. section 10.6.2
- Resources can be a keyspace, a table such as reviews.articles, a specific role, all keyspaces, or all roles. section 10.6.2
- Scope access to the minimum necessary resource; for example, a keyspace-level DROP permission affects every table in that keyspace. section 10.6.2
Granting application access
After creating the application role, grant it permissions for the reviews keyspace: GRANT SELECT ON KEYSPACE reviews TO application; and GRANT MODIFY ON KEYSPACE reviews TO application;. A login role can then inherit these permissions with GRANT application TO reviews_api;. section 10.6.2
Listing 10.29 Granting SELECT and MODIFY to the application role
cassandra@cqlsh> GRANT SELECT ON KEYSPACE reviews TO application; cassandra@cqlsh> GRANT MODIFY ON KEYSPACE reviews TO application;
Shows executable CQL statements for granting SELECT and MODIFY on the reviews keyspace. section 10.6.2
