A database permission authorizes a role to perform specified operations on database resources. Roles may receive permissions directly or inherit them from other roles. section 9.1.5 section 10.6.2
ScyllaDB permissions cover these actions:
- CREATE, ALTER, and DROP apply to tables or keyspaces. section 10.6.2
- SELECT reads table data; MODIFY permits inserts, updates, deletes, and truncates. section 10.6.2
- AUTHORIZE grants or revokes permissions; DESCRIBE lists roles. section 10.6.2
Restricting the reviews application
Create an application role, grant it SELECT and MODIFY on the reviews keyspace, then create a login role and grant the application role to it. The login role inherits the application permissions without becoming a superuser. section 10.6.2
# Authorization backend, implementing IAuthorizer; used to limit
# access/provide permissions
# Out of the box, Scylla provides org.apache.cassandra.auth.{
# AllowAllAuthorizer,CassandraAuthorizer}.
#
# - AllowAllAuthorizer allows any action to any user - set it to
# disable authorization.
# - CassandraAuthorizer stores permissions in system_auth.permissions
# table. Please increase system_auth keyspace replication factor if
# you use this authorizer.
# - com.scylladb.auth.TransitionalAuthorizer wraps around the
# CassandraAuthorizer, using it for authorizing permission
# management. Otherwise, it allows all. Use for upgrading clusters'
# auth.
# authorizer: AllowAllAuthorizer
Compare authorization backends: AllowAllAuthorizer permits every action, TransitionalAuthorizer supports migration, and CassandraAuthorizer enforces stored permissions. section 9.1.5
