Role-based access control assigns permissions to roles, then lets clients connect and act through those roles. In ScyllaDB, this separates application access from the cassandra superuser. section 10.6.2
A practical setup separates login identity from granted capabilities:
- Create an application role; it initially has no login and no permissions. section 10.6.2
- Grant SELECT and MODIFY on the reviews keyspace for reading and changing review data. section 10.6.2
- Create a login-enabled reviews_api role and grant it the application role. section 10.6.2
Application role hierarchy
CREATE ROLE reviews_api WITH PASSWORD = 'password' AND LOGIN = true; then GRANT application TO reviews_api. The API logs in through reviews_api while inheriting the application role’s reviews permissions. section 10.6.2
Table 10.1 Scylla’s permissions enable you to grant access to specific actions on resources.
|
Permissions
|
Allowed actions
|
|---|---|
CREATE
|
Create a table or a keyspace.
|
ALTER
|
Alter a table or a keyspace.
|
DROP
|
Drop a table or a keyspace.
|
SELECT
|
Select data from a table.
|
MODIFY
|
Insert, update, delete, or truncate on a table.
|
AUTHORIZE
|
Grant and revoke permissions.
|
DESCRIBE
|
List roles.
|
Use the permissions table to distinguish data access from schema changes, authorization, and role inspection. section 10.6.2
