open-vault/website/content/docs/secrets/databases/cassandra.mdx

---
layout: docs
page_title: Cassandra - Database - Secrets Engines
description: |-
  Cassandra is one of the supported plugins for the database secrets engine.
  This plugin generates database credentials dynamically based on configured
  roles for the Cassandra database.
---

# Cassandra Database Secrets Engine

@include 'x509-sha1-deprecation.mdx'

Cassandra is one of the supported plugins for the database secrets engine. This
plugin generates database credentials dynamically based on configured roles for
the Cassandra database.

See the [database secrets engine](/vault/docs/secrets/databases) docs for
more information about setting up the database secrets engine.

## Capabilities

| Plugin Name                 | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization |
| --------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |
| `cassandra-database-plugin` | Yes                      | Yes           | Yes (1.6+)   | Yes (1.7+)             |

## Setup

1. Vault will need a Cassandra user with the following permissions:
   ```text
   GRANT CREATE ON ALL ROLES to '<YOUR USER>';
   GRANT ALTER ON ALL ROLES to '<YOUR USER>';
   GRANT DROP ON ALL ROLES to '<YOUR USER>';
   GRANT AUTHORIZE ON ALL ROLES to '<YOUR USER>';
   ```

1.  Enable the database secrets engine if it is not already enabled:

    ```text
    $ vault secrets enable database
    Success! Enabled the database secrets engine at: database/
    ```

    By default, the secrets engine will enable at the name of the engine. To
    enable the secrets engine at a different path, use the `-path` argument.

1.  Configure Vault with the proper plugin and connection information:

    ```text
    $ vault write database/config/my-cassandra-database \
        plugin_name="cassandra-database-plugin" \
        hosts=127.0.0.1 \
        protocol_version=4 \
        username=vaultuser \
        password=vaultpass \
        allowed_roles=my-role
    ```

1.  Configure a role that maps a name in Vault to an SQL statement to execute to
    create the database credential:

    ```text
    $ vault write database/roles/my-role \
        db_name=my-cassandra-database \
        creation_statements="CREATE USER '{{username}}' WITH PASSWORD '{{password}}' NOSUPERUSER; \
              GRANT SELECT ON ALL KEYSPACES TO {{username}};" \
        default_ttl="1h" \
        max_ttl="24h"
    Success! Data written to: database/roles/my-role
    ```

## Usage

After the secrets engine is configured and a user/machine has a Vault token with
the proper permission, it can generate credentials.

1.  Generate a new credential by reading from the `/creds` endpoint with the name
    of the role:

    ```text
    $ vault read database/creds/my-role
    Key                Value
    ---                -----
    lease_id           database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
    lease_duration     1h
    lease_renewable    true
    password           7iO-FxlVCdj8szsgGgsL
    username           v_vaultuser_my_role_6zjahr4mjn5c9prgucy1_1602541475
    ```

## API

The full list of configurable options can be seen in the [Cassandra database plugin API](/vault/api-docs/secret/databases/cassandra) page.

For more information on the database secrets engine's HTTP API please see the [Database secret secrets engine API](/vault/api-docs/secret/databases) page.