Temporary Admin Access

Overview

At checkout the broker grants elevated permissions (e.g. SELECT and MODIFY, or superuser role) to the requesting Cassandra user; at checkin it revokes them. Use this for temporary administrative escalation on top of an existing or freshly created role.

Before You Begin

The Access Broker is deployed and connected
cqlsh on the broker host and connectivity to the cluster
An admin role able to GRANT/REVOKE permissions; credentials in AWS Secrets Manager (KMS-encrypted) per the source kit

Environment Variables

Variable	Notes
`username`	Injected — target role
`permissions`	Permissions to grant/revoke (e.g. `SELECT MODIFY`)

Checkout / Checkin

Full scripts: Cassandra/permission/tempAdmin (and the kit’s grant_revoke_permissions.sh).

Cassandra/README.md

# checkout — grant
./grant_revoke_permissions.sh --username "$username" --permissions "SELECT MODIFY" --action grant

# checkin — revoke
./grant_revoke_permissions.sh --username "$username" --permissions "SELECT MODIFY" --action revoke

Configure in Britive

Create the permission

Resource Manager → Resource Type Permissions → New Permission. Language = Shell. Paste the grant (checkout) and revoke (checkin) logic. Declare permissions and connection variables (username is system-defined).

Create a profile and policy

Create a profile with a short expiration, add the permission, and add a policy with approval. Assign members by tag.

Verify

-- during checkout, as admin
LIST ALL PERMISSIONS OF '<user>';   -- elevated grants appear
-- after checkin
LIST ALL PERMISSIONS OF '<user>';   -- grants removed

Troubleshoot

Symptom	Cause	Fix
`Unauthorized` on GRANT	Admin role can’t grant the permission	Admin must hold the permission `WITH GRANT OPTION` (`AUTHORIZE`)
Keyspaces: no effect	IAM-managed	For Keyspaces, manage permissions via IAM policies, not cqlsh

Next Steps

Last updated on July 3, 2026

Temporary User Access