Temporary User Access

Overview

At checkout the broker creates a temporary Cassandra user (role) with a password; at checkin it drops the user. For self-hosted Cassandra this uses cqlsh; for Amazon Keyspaces, access is governed via IAM/SigV4. Use this for scoped, time-bound database logins.

Before You Begin

The Access Broker is deployed and connected
cqlsh on the broker host and connectivity to the Cassandra cluster
An admin role able to CREATE ROLE / DROP ROLE; admin password stored in AWS Secrets Manager (KMS-encrypted) per the source kit

Environment Variables

Variable	Notes
`username`	Injected — the role to create/drop
`password`	Generated or supplied for the new role

Checkout / Checkin

Full scripts: tempUser/create_user.sh · tempUser/drop_user.sh

Cassandra/permission/tempUser/create_user.sh

# checkout — create login role
cqlsh -e "CREATE ROLE '$username' WITH PASSWORD = '$password' AND LOGIN = true;"

# checkin — drop it
cqlsh -e "DROP ROLE '$username';"

Configure in Britive

Create the permission

Resource Manager → Resource Type Permissions → New Permission. Language = Shell. Paste both scripts. Declare the connection/credential variables (username is system-defined).

Create a profile and policy

Create a profile (e.g. 2h), add the permission, and add a policy assigning members by tag.

Verify

-- during checkout, in cqlsh as admin
LIST ROLES;          -- the temp role appears
-- after checkin
LIST ROLES;          -- it's gone

Troubleshoot

Symptom	Cause	Fix
`Unauthorized: ... CREATE`	Admin role lacks role-management permission	Grant the admin role `CREATE`/`DROP` on roles
Keyspaces: auth fails	Using cqlsh password auth on Keyspaces	Keyspaces uses IAM/SigV4 — manage access via IAM, not cqlsh users

Next Steps

Last updated on July 3, 2026

Getting Started Temporary Admin Access