Getting Started

Overview

This guide walks you through configuring the Britive Access Broker to manage just-in-time access to Apache Cassandra or Amazon Keyspaces — creating a temporary user with target role grants at checkout and revoking everything at checkin.

What you’ll accomplish:

Deploy and configure the Britive Access Broker with connectivity to your Cassandra cluster or Keyspaces endpoint
Configure checkout and checkin routines from the access-broker-examples repository
Register Cassandra as a Resource Manager resource in Britive
Create a Resource Manager access profile
Check out database access and verify end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
A running Britive Access Broker with network access to Cassandra (port 9042) or Keyspaces
A Cassandra superuser account with CREATE ROLE and GRANT privileges
cqlsh available on the broker host

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

The Access Broker runs CQL commands via cqlsh to manage roles and permissions. At checkout, Britive creates a temporary Cassandra role with the target permissions and returns credentials. At checkin (or on expiry), the role is dropped — no standing access remains.

User → Britive Console → Access Broker → cqlsh → CREATE ROLE / GRANT → DROP ROLE

Onboarding the Application

Configure the broker for Cassandra access management. This is a one-time setup performed by an administrator.

Reference scripts are available in the britive/access-broker-examples repository under Cassandra/permissions/. The same scripts support both self-hosted Apache Cassandra and Amazon Keyspaces.

Using the Britive Console

Deploy the Access Broker

Follow the Britive Access Broker deployment guide to install and register a broker with your Britive tenant.

Configure the broker scripts

git clone https://github.com/britive/access-broker-examples.git
# Copy Cassandra/permissions/ scripts to your broker's scripts directory

Create a superuser for the broker

CREATE ROLE britive_admin WITH PASSWORD = 'StrongPassword!' AND LOGIN = true AND SUPERUSER = true;

Store the credentials in the Britive Secrets Store.

Register Cassandra in Resource Manager

Navigate to Resource Manager → Resources → Add Resource. Enter the contact points, port, datacenter, and admin credentials.

Using Shell

Key environment variables used by the broker scripts:

CASSANDRA_HOST=cassandra.example.com
CASSANDRA_PORT=9042
CASSANDRA_DATACENTER=datacenter1
CASSANDRA_ADMIN_USER=britive_admin
CASSANDRA_ADMIN_PASSWORD=...   # From Britive Secrets Store
CASSANDRA_TARGET_KEYSPACE=myapp
BRITIVE_USER_EMAIL=user@example.com

# For Amazon Keyspaces (service-specific endpoint)
# CASSANDRA_HOST=cassandra.us-east-1.amazonaws.com
# CASSANDRA_PORT=9142   # TLS required for Keyspaces

Refer to the britive/access-broker-examples Cassandra/ directory for the full script set, including Keyspaces variants.

Using Terraform

resource "britive_resource_manager_resource_type" "cassandra" {
  name        = "CassandraCluster"
  description = "Apache Cassandra or Amazon Keyspaces cluster"

  parameters {
    param_name   = "hostname"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "port"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "datacenter"
    param_type   = "string"
    is_mandatory = true
  }
}

resource "britive_resource_manager_resource" "cassandra_prod" {
  name          = "cassandra-prod"
  resource_type = britive_resource_manager_resource_type.cassandra.name

  parameter_values = {
    hostname   = "cassandra.example.com"
    port       = "9042"
    datacenter = "datacenter1"
  }

  resource_labels = {
    environment = "Production"
  }
}

Create Your First Access Profile

Using the Britive Console

Open Resource Manager

Navigate to Resource Manager → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `Cassandra-ReadOnly`)
Expiration	Set a max session duration (e.g., `2h`)

Associate resources

Under Associations, select the Cassandra cluster resource.

Add a permission

Under Permissions, select the checkout/checkin routine for the target access level.

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

resource "britive_resource_manager_profile" "cassandra_readonly" {
  name                = "Cassandra-ReadOnly"
  expiration_duration = 7200000

  associations {
    label_key = "environment"
    values    = ["Production"]
  }
}

resource "britive_resource_manager_profile_permission" "cassandra_perm" {
  profile_id = britive_resource_manager_profile.cassandra_readonly.id
  name       = "Cassandra-ReadOnly-Access"
  version    = "latest"
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out. Britive returns temporary Cassandra credentials.

Connect to Cassandra

cqlsh cassandra.example.com 9042 -u <temp-role> -p <temp-password>

Confirm access

DESCRIBE KEYSPACES;
SELECT * FROM system.local;

Check in

Return to My Access → click Check In. Connecting with the same credentials should fail with Provided username/password are incorrect.

Troubleshoot

Symptom	Likely Cause	Fix
Checkout fails	Broker cannot reach Cassandra	Check firewall rules on port 9042 (or 9142 for Keyspaces TLS)
`Unauthorized` when creating role	`britive_admin` lacks `SUPERUSER`	Re-create the admin role with `SUPERUSER = true`
Role not dropped after checkin	cqlsh timeout or network error	Check broker logs; manually drop the role if needed

Next Steps

Britive documentation

Last updated on July 8, 2026

Temporary User Access