Apache Cassandra

​

Prerequisites

• A Cassandra cluster reachable from CloudThinker on its CQL native transport port, 9042 by default.
• Permission to create a login role, or a role someone created for you.
• Two or three node addresses from the same datacenter. The driver discovers the rest of the ring from them.

​

Setup

CREATE ROLE cloudthinker WITH LOGIN = true AND PASSWORD = 'your-secure-password';

GRANT SELECT ON KEYSPACE your_keyspace TO cloudthinker;

GRANT MODIFY ON KEYSPACE your_keyspace TO cloudthinker;  -- single-row insert, update, delete
GRANT ALTER  ON KEYSPACE your_keyspace TO cloudthinker;  -- table TTL, gc_grace, secondary indexes

​

Connection details

​

Required permissions

​

Minimum

​

Row reads

GRANT SELECT ON KEYSPACE your_keyspace TO cloudthinker;

​

Changes

GRANT MODIFY ON KEYSPACE your_keyspace TO cloudthinker;
GRANT ALTER  ON KEYSPACE your_keyspace TO cloudthinker;

​

Agent capabilities

​

Verify the connection

@tony #report list the Cassandra keyspaces and the tables in each one

​

Example prompts

@tony #report audit replication factor and TTL for the events keyspace
@tony #report show the row in ct_demo.sessions where session_id = 'abc-123'
@tony #recommend which tables in the events keyspace have no automatic expiry configured

​

Approved changes

• Every change reports what it measured. The agent shows the value it read before the change, the outcome, and the exact command that reverses it. Running that reversal is a second change and needs its own approval.
• TRUNCATE, DROP TABLE, DROP KEYSPACE, ALTER KEYSPACE, GRANT, and ALTER ROLE are absent. They are refusals, not approvals waiting to be granted. Ask the agent and it names the operation and what an operator would run instead.
• A table setting change cannot be made conditional. Cassandra has no conditional ALTER TABLE, so the agent reads the current value, changes it, then re-reads it and reports whether its own value survived. A writer inside that gap is overwritten without detection, and the output says so.
• Nothing rolls back. Cassandra has no transaction. A delete writes a tombstone, so the row reads as absent at once and the space returns only after gc_grace_seconds and compaction. A new TTL applies to rows written after the change, never to rows already stored.

​

Troubleshooting

​

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• TLS carries the password — this connection sends the role name and password over the same socket as the query. Keep Use TLS on for anything outside a private network.
• Least-privilege role — a login role with no grant already answers inventory, schema, and health questions. Add SELECT, MODIFY, and ALTER per keyspace only when you need them, and never on the default cassandra superuser.

​

Related