A role is a database identity that receives permissions. Clients connect as roles, while authorization determines which database actions those roles may perform. section 10.6.2 section 10.7
A newly created role has no permissions by default and is not necessarily allowed to log in. Separate administrative and application roles to limit what each client can do. section 10.6.2
Use roles to structure access:
- Create a role with CREATE ROLE. section 10.6.2
- Grant permissions with GRANT, including SELECT, MODIFY, CREATE, ALTER, DROP, AUTHORIZE, and DESCRIBE. section 10.6.2
- Scope permissions to a keyspace, table, or another role. section 10.7
- Grant one role to another so the recipient inherits its permissions. section 10.6.2
- Enable login and set credentials only for roles that applications or users must authenticate as. section 10.6.2
Restaurant-review application
Create an application role, grant it access to the reviews keyspace, then create a login role for the API and grant the application role to it: CREATE ROLE application; GRANT SELECT ON KEYSPACE reviews TO application; GRANT MODIFY ON KEYSPACE reviews TO application; CREATE ROLE reviews_api WITH PASSWORD = 'password' AND LOGIN = true; GRANT application TO reviews_api. The driver authenticates as reviews_api, allowing the API to read and write reviews without allowing it to drop the keyspace. section 10.6.3
