# AWS Identity and Access Management for Amazon Keyspaces AWS Identity and Access Management (IAM) is an AWS service that helps an administrator securely control access to AWS resources. IAM administrators control who can be *authenticated* (signed in) and *authorized* (have permissions) to use Amazon Keyspaces resources. IAM is an AWS service that you can use with no additional charge. **Topics** + [Audience](#security_iam_audience) + [Authenticating with identities](#security_iam_authentication) + [Managing access using policies](#security_iam_access-manage) + [How Amazon Keyspaces works with IAM](security_iam_service-with-iam.md) + [Amazon Keyspaces identity-based policy examples](security_iam_id-based-policy-examples.md) + [AWS managed policies for Amazon Keyspaces](security-iam-awsmanpol.md) + [Troubleshooting Amazon Keyspaces identity and access](security_iam_troubleshoot.md) + [Using service-linked roles for Amazon Keyspaces](using-service-linked-roles.md) ## Audience How you use AWS Identity and Access Management (IAM) differs based on your role: + **Service user** - request permissions from your administrator if you cannot access features (see [Troubleshooting Amazon Keyspaces identity and access](security_iam_troubleshoot.md)) + **Service administrator** - determine user access and submit permission requests (see [How Amazon Keyspaces works with IAM](security_iam_service-with-iam.md)) + **IAM administrator** - write policies to manage access (see [Amazon Keyspaces identity-based policy examples](security_iam_id-based-policy-examples.md)) ## Authenticating with identities Authentication is how you sign in to AWS using your identity credentials. You must be authenticated as the AWS account root user, an IAM user, or by assuming an IAM role. You can sign in as a federated identity using credentials from an identity source like AWS IAM Identity Center (IAM Identity Center), single sign-on authentication, or Google/Facebook credentials. For more information about signing in, see [How to sign in to your AWS account](https://docs.aws.amazon.com/signin/latest/userguide/how-to-sign-in.html) in the *AWS Sign-In User Guide*. For programmatic access, AWS provides an SDK and CLI to cryptographically sign requests. For more information, see [AWS Signature Version 4 for API requests](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html) in the *IAM User Guide*. ### AWS account root user When you create an AWS account, you begin with one sign-in identity called the AWS account *root user* that has complete access to all AWS services and resources. We strongly recommend that you don't use the root user for everyday tasks. For tasks that require root user credentials, see [Tasks that require root user credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html#root-user-tasks) in the *IAM User Guide*. ### IAM users and groups An *[IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html)* is an identity with specific permissions for a single person or application. We recommend using temporary credentials instead of IAM users with long-term credentials. For more information, see [Require human users to use federation with an identity provider to access AWS using temporary credentials](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-users-federation-idp) in the *IAM User Guide*. An [https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html) specifies a collection of IAM users and makes permissions easier to manage for large sets of users. For more information, see [Use cases for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/gs-identities-iam-users.html) in the *IAM User Guide*. ### IAM roles An *[IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)* is an identity with specific permissions that provides temporary credentials. You can assume a role by [switching from a user to an IAM role (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html) or by calling an AWS CLI or AWS API operation. For more information, see [Methods to assume a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage-assume.html) in the *IAM User Guide*. IAM roles are useful for federated user access, temporary IAM user permissions, cross-account access, cross-service access, and applications running on Amazon EC2. For more information, see [Cross account resource access in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the *IAM User Guide*. ## Managing access using policies You control access in AWS by creating policies and attaching them to AWS identities or resources. A policy defines permissions when associated with an identity or resource. AWS evaluates these policies when a principal makes a request. Most policies are stored in AWS as JSON documents. For more information about JSON policy documents, see [Overview of JSON policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#access_policies-json) in the *IAM User Guide*. Using policies, administrators specify who has access to what by defining which **principal** can perform **actions** on what **resources**, and under what **conditions**. By default, users and roles have no permissions. An IAM administrator creates IAM policies and adds them to roles, which users can then assume. IAM policies define permissions regardless of the method used to perform the operation. ### Identity-based policies Identity-based policies are JSON permissions policy documents that you attach to an identity (user, group, or role). These policies control what actions identities can perform, on which resources, and under what conditions. To learn how to create an identity-based policy, see [Define custom IAM permissions with customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the *IAM User Guide*. Identity-based policies can be *inline policies* (embedded directly into a single identity) or *managed policies* (standalone policies attached to multiple identities). To learn how to choose between managed and inline policies, see [Choose between managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-choosing-managed-or-inline.html) in the *IAM User Guide*. ### Resource-based policies Resource-based policies are JSON policy documents that you attach to a resource. Examples include IAM *role trust policies* and Amazon S3 *bucket policies*. In services that support resource-based policies, service administrators can use them to control access to a specific resource. You must [specify a principal](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html) in a resource-based policy. Resource-based policies are inline policies that are located in that service. You can't use AWS managed policies from IAM in a resource-based policy. ### Access control lists (ACLs) Access control lists (ACLs) control which principals (account members, users, or roles) have permissions to access a resource. ACLs are similar to resource-based policies, although they do not use the JSON policy document format. Amazon S3, AWS WAF, and Amazon VPC are examples of services that support ACLs. To learn more about ACLs, see [Access control list (ACL) overview](https://docs.aws.amazon.com/AmazonS3/latest/userguide/acl-overview.html) in the *Amazon Simple Storage Service Developer Guide*. ### Other policy types AWS supports additional policy types that can set the maximum permissions granted by more common policy types: + **Permissions boundaries** – Set the maximum permissions that an identity-based policy can grant to an IAM entity. For more information, see [Permissions boundaries for IAM entities](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) in the *IAM User Guide*. + **Service control policies (SCPs)** – Specify the maximum permissions for an organization or organizational unit in AWS Organizations. For more information, see [Service control policies](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) in the *AWS Organizations User Guide*. + **Resource control policies (RCPs)** – Set the maximum available permissions for resources in your accounts. For more information, see [Resource control policies (RCPs)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_rcps.html) in the *AWS Organizations User Guide*. + **Session policies** – Advanced policies passed as a parameter when creating a temporary session for a role or federated user. For more information, see [Session policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session) in the *IAM User Guide*. ### Multiple policy types When multiple types of policies apply to a request, the resulting permissions are more complicated to understand. To learn how AWS determines whether to allow a request when multiple policy types are involved, see [Policy evaluation logic](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html) in the *IAM User Guide*. # How Amazon Keyspaces works with IAM Before you use IAM to manage access to Amazon Keyspaces, you should understand what IAM features are available to use with Amazon Keyspaces. To get a high-level view of how Amazon Keyspaces and other AWS services work with IAM, see [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) in the *IAM User Guide*. **Topics** + [Amazon Keyspaces identity-based policies](#security_iam_service-with-iam-id-based-policies) + [Amazon Keyspaces resource-based policies](#security_iam_service-with-iam-resource-based-policies) + [Authorization based on Amazon Keyspaces tags](#security_iam_service-with-iam-tags) + [Amazon Keyspaces IAM roles](#security_iam_service-with-iam-roles) ## Amazon Keyspaces identity-based policies With IAM identity-based policies, you can specify allowed or denied actions and resources as well as the conditions under which actions are allowed or denied. Amazon Keyspaces supports specific actions and resources, and condition keys. To learn about all of the elements that you use in a JSON policy, see [IAM JSON policy elements reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html) in the *IAM User Guide*. To see the Amazon Keyspaces service-specific resources and actions, and condition context keys that can be used for IAM permissions policies, see the [Actions, resources, and condition keys for Amazon Keyspaces (for Apache Cassandra)](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkeyspacesforapachecassandra.html) in the *Service Authorization Reference*. ### Actions Administrators can use AWS JSON policies to specify who has access to what. That is, which **principal** can perform **actions** on what **resources**, and under what **conditions**. The `Action` element of a JSON policy describes the actions that you can use to allow or deny access in a policy. Include actions in a policy to grant permissions to perform the associated operation. Policy actions in Amazon Keyspaces use the following prefix before the action: `cassandra:`. For example, to grant someone permission to create an Amazon Keyspaces keyspace with the Amazon Keyspaces `CREATE` CQL statement, you include the `cassandra:Create` action in their policy. Policy statements must include either an `Action` or `NotAction` element. Amazon Keyspaces defines its own set of actions that describe tasks that you can perform with this service. To specify multiple actions in a single statement, separate them with commas as follows: ``` "Action": [ "cassandra:CREATE", "cassandra:MODIFY" ] ``` To see a list of Amazon Keyspaces actions, see [Actions Defined by Amazon Keyspaces (for Apache Cassandra)](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkeyspacesforapachecassandra.html#amazonkeyspacesforapachecassandra-actions-as-permissions) in the *Service Authorization Reference*. ### Resources Administrators can use AWS JSON policies to specify who has access to what. That is, which **principal** can perform **actions** on what **resources**, and under what **conditions**. The `Resource` JSON policy element specifies the object or objects to which the action applies. As a best practice, specify a resource using its [Amazon Resource Name (ARN)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html). For actions that don't support resource-level permissions, use a wildcard (\$1) to indicate that the statement applies to all resources. ``` "Resource": "*" ``` In Amazon Keyspaces, keyspaces, tables, and streams can be used in the `Resource` element of IAM permissions. **Note** To access user keyspaces and tables in Amazon Keyspaces, your IAM policy must include `cassandra:Select` permissions on system tables: ``` arn:${Partition}:cassandra:${Region}:${Account}:/keyspace/system* ``` This applies to the following scenarios: AWS Management Console access SDK resource operations, for example `GetKeyspace`, `GetTable`, `ListKeyspaces`, and `ListTables` Standard Apache Cassandra client driver connections, because drivers automatically read system tables during connection initialization System tables are read-only and cannot be modified. The Amazon Keyspaces keyspace resource has the following ARN: ``` arn:${Partition}:cassandra:${Region}:${Account}:/keyspace/${keyspaceName}/ ``` The Amazon Keyspaces table resource has the following ARN: ``` arn:${Partition}:cassandra:${Region}:${Account}:/keyspace/${keyspaceName}/table/${tableName} ``` The Amazon Keyspaces stream resource has the following ARN: ``` arn:${Partition}:cassandra:{Region}:${Account}:/keyspace/${keyspaceName}/table/${tableName}/stream/${streamLabel} ``` For more information about the format of ARNs, see [Amazon Resource Names (ARNs) and AWS service namespaces](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html). For example, to specify the `mykeyspace` keyspace in your statement, use the following ARN: ``` "Resource": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/" ``` To specify all keyspaces that belong to a specific account, use the wildcard (\$1): ``` "Resource": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/*" ``` Some Amazon Keyspaces actions, such as those for creating resources, cannot be performed on a specific resource. In those cases, you must use the wildcard (\$1). ``` "Resource": "*" ``` For example, to grant `SELECT` permissions to an IAM principal for `mytable` in `mykeyspace`, the principal must have permissions to read both, `mytable` and `keyspace/system*`. To specify multiple resources in a single statement, separate the ARNs with commas. ``` "Resource": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/table/mytable", "arn:aws:cassandra:us-east-1:111122223333:/keyspace/system*" ``` To see a list of Amazon Keyspaces resource types and their ARNs, see [Resources Defined by Amazon Keyspaces (for Apache Cassandra)](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkeyspacesforapachecassandra.html#amazonkeyspacesforapachecassandra-resources-for-iam-policies) in the *Service Authorization Reference*. To learn with which actions you can specify the ARN of each resource, see [Actions Defined by Amazon Keyspaces (for Apache Cassandra)](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkeyspacesforapachecassandra.html#amazonkeyspacesforapachecassandra-actions-as-permissions). ### Condition keys Administrators can use AWS JSON policies to specify who has access to what. That is, which **principal** can perform **actions** on what **resources**, and under what **conditions**. The `Condition` element specifies when statements execute based on defined criteria. You can create conditional expressions that use [condition operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html), such as equals or less than, to match the condition in the policy with values in the request. To see all AWS global condition keys, see [AWS global condition context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) in the *IAM User Guide*. Amazon Keyspaces defines its own set of condition keys and also supports using some global condition keys. To see all AWS global condition keys, see [AWS global condition context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) in the *IAM User Guide*. All Amazon Keyspaces actions support the `aws:RequestTag/${TagKey}`, the `aws:ResourceTag/${TagKey}`, and the `aws:TagKeys` condition keys. For more information, see [Amazon Keyspaces resource access based on tags](security_iam_id-based-policy-examples.md#security_iam_id-based-policy-examples-tags). To see a list of Amazon Keyspaces condition keys, see [Condition Keys for Amazon Keyspaces (for Apache Cassandra)](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkeyspacesforapachecassandra.html#amazonkeyspacesforapachecassandra-policy-keys) in the *Service Authorization Reference*. To learn with which actions and resources you can use a condition key, see [Actions Defined by Amazon Keyspaces (for Apache Cassandra)](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonkeyspacesforapachecassandra.html#amazonkeyspacesforapachecassandra-actions-as-permissions). ### Examples To view examples of Amazon Keyspaces identity-based policies, see [Amazon Keyspaces identity-based policy examples](security_iam_id-based-policy-examples.md). ## Amazon Keyspaces resource-based policies Amazon Keyspaces does not support resource-based policies. To view an example of a detailed resource-based policy page, see [https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html](https://docs.aws.amazon.com/lambda/latest/dg/access-control-resource-based.html). ## Authorization based on Amazon Keyspaces tags You can manage access to your Amazon Keyspaces resources by using tags. To manage resource access based on tags, you provide tag information in the [condition element](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) of a policy using the `cassandra:ResourceTag/key-name`, `aws:RequestTag/key-name`, or `aws:TagKeys` condition keys. For more information about tagging Amazon Keyspaces resources, see [Working with tags and labels for Amazon Keyspaces resources](tagging-keyspaces.md). To view example identity-based policies for limiting access to a resource based on the tags on that resource, see [Amazon Keyspaces resource access based on tags](security_iam_id-based-policy-examples.md#security_iam_id-based-policy-examples-tags). ## Amazon Keyspaces IAM roles An [IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) is an entity within your AWS account that has specific permissions. ### Using temporary credentials with Amazon Keyspaces You can use temporary credentials to sign in with federation, to assume an IAM role, or to assume a cross-account role. You obtain temporary security credentials by calling AWS STS API operations such as [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) or [GetFederationToken](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html). Amazon Keyspaces supports using temporary credentials with the AWS Signature Version 4 (SigV4) authentication plugin available from the Github repo for the following languages: + Java: [https://github.com/aws/aws-sigv4-auth-cassandra-java-driver-plugin](https://github.com/aws/aws-sigv4-auth-cassandra-java-driver-plugin). + Node.js: [https://github.com/aws/aws-sigv4-auth-cassandra-nodejs-driver-plugin](https://github.com/aws/aws-sigv4-auth-cassandra-nodejs-driver-plugin). + Python: [https://github.com/aws/aws-sigv4-auth-cassandra-python-driver-plugin](https://github.com/aws/aws-sigv4-auth-cassandra-python-driver-plugin). + Go: [https://github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin](https://github.com/aws/aws-sigv4-auth-cassandra-gocql-driver-plugin). For examples and tutorials that implement the authentication plugin to access Amazon Keyspaces programmatically, see [Using a Cassandra client driver to access Amazon Keyspaces programmatically](programmatic.drivers.md). ### Service-linked roles [Service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role) allow AWS services to access resources in other services to complete an action on your behalf. Service-linked roles appear in your IAM account and are owned by the service. An IAM administrator can view but not edit the permissions for service-linked roles. For details about creating or managing Amazon Keyspaces service-linked roles, see **[Using service-linked roles for Amazon Keyspaces](using-service-linked-roles.md)**. ### Service roles Amazon Keyspaces does not support service roles. # Amazon Keyspaces identity-based policy examples By default, IAM users and roles don't have permission to create or modify Amazon Keyspaces resources. They also can't perform tasks using the console, CQLSH, AWS CLI, or AWS API. An IAM administrator must create IAM policies that grant users and roles permission to perform specific API operations on the specified resources they need. The administrator must then attach those policies to the IAM users or groups that require those permissions. To learn how to create an IAM identity-based policy using these example JSON policy documents, see [Creating policies on the JSON tab](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html#access_policies_create-json-editor) in the *IAM User Guide*. **Topics** + [Policy best practices](#security_iam_service-with-iam-policy-best-practices) + [Using the Amazon Keyspaces console](#security_iam_id-based-policy-examples-console) + [Allow users to view their own permissions](#security_iam_id-based-policy-examples-view-own-permissions) + [Accessing Amazon Keyspaces tables](#security_iam_id-based-policy-examples-access-one-table) + [Amazon Keyspaces resource access based on tags](#security_iam_id-based-policy-examples-tags) ## Policy best practices Identity-based policies determine whether someone can create, access, or delete Amazon Keyspaces resources in your account. These actions can incur costs for your AWS account. When you create or edit identity-based policies, follow these guidelines and recommendations: + **Get started with AWS managed policies and move toward least-privilege permissions** – To get started granting permissions to your users and workloads, use the *AWS managed policies* that grant permissions for many common use cases. They are available in your AWS account. We recommend that you reduce permissions further by defining AWS customer managed policies that are specific to your use cases. For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) or [AWS managed policies for job functions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html) in the *IAM User Guide*. + **Apply least-privilege permissions** – When you set permissions with IAM policies, grant only the permissions required to perform a task. You do this by defining the actions that can be taken on specific resources under specific conditions, also known as *least-privilege permissions*. For more information about using IAM to apply permissions, see [ Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *IAM User Guide*. + **Use conditions in IAM policies to further restrict access** – You can add a condition to your policies to limit access to actions and resources. For example, you can write a policy condition to specify that all requests must be sent using SSL. You can also use conditions to grant access to service actions if they are used through a specific AWS service, such as CloudFormation. For more information, see [ IAM JSON policy elements: Condition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) in the *IAM User Guide*. + **Use IAM Access Analyzer to validate your IAM policies to ensure secure and functional permissions** – IAM Access Analyzer validates new and existing policies so that the policies adhere to the IAM policy language (JSON) and IAM best practices. IAM Access Analyzer provides more than 100 policy checks and actionable recommendations to help you author secure and functional policies. For more information, see [Validate policies with IAM Access Analyzer](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-validation.html) in the *IAM User Guide*. + **Require multi-factor authentication (MFA)** – If you have a scenario that requires IAM users or a root user in your AWS account, turn on MFA for additional security. To require MFA when API operations are called, add MFA conditions to your policies. For more information, see [ Secure API access with MFA](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html) in the *IAM User Guide*. For more information about best practices in IAM, see [Security best practices in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html) in the *IAM User Guide*. ## Using the Amazon Keyspaces console Amazon Keyspaces doesn't require specific permissions to access the Amazon Keyspaces console. You need at least read-only permissions to list and view details about the Amazon Keyspaces resources in your AWS account. If you create an identity-based policy that is more restrictive than the minimum required permissions, the console won't function as intended for entities (IAM users or roles) with that policy. Two AWS managed policies are available to the entities for Amazon Keyspaces console access. + [AmazonKeyspacesReadOnlyAccess\$1v2](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKeyspacesReadOnlyAccess_v2.html) – This policy grants read-only access to Amazon Keyspaces. + [AmazonKeyspacesFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKeyspacesFullAccess.html) – This policy grants permissions to use Amazon Keyspaces with full access to all features. For more information about Amazon Keyspaces managed policies, see [AWS managed policies for Amazon Keyspaces](security-iam-awsmanpol.md). ## Allow users to view their own permissions This example shows how you might create a policy that allows IAM users to view the inline and managed policies that are attached to their user identity. This policy includes permissions to complete this action on the console or programmatically using the AWS CLI or AWS API. ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "ViewOwnUserInfo", "Effect": "Allow", "Action": [ "iam:GetUserPolicy", "iam:ListGroupsForUser", "iam:ListAttachedUserPolicies", "iam:ListUserPolicies", "iam:GetUser" ], "Resource": ["arn:aws:iam::*:user/${aws:username}"] }, { "Sid": "NavigateInConsole", "Effect": "Allow", "Action": [ "iam:GetGroupPolicy", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:ListAttachedGroupPolicies", "iam:ListGroupPolicies", "iam:ListPolicyVersions", "iam:ListPolicies", "iam:ListUsers" ], "Resource": "*" } ] } ``` ## Accessing Amazon Keyspaces tables **Note** To access user keyspaces and tables in Amazon Keyspaces, your IAM policy must include `cassandra:Select` permissions on system tables: ``` arn:${Partition}:cassandra:${Region}:${Account}:/keyspace/system* ``` This applies to the following scenarios: AWS Management Console access SDK resource operations, for example `GetKeyspace`, `GetTable`, `ListKeyspaces`, and `ListTables` Standard Apache Cassandra client driver connections, because drivers automatically read system tables during connection initialization System tables are read-only and cannot be modified. The following is a sample policy that grants read-only (`SELECT`) access to the Amazon Keyspaces system tables. For all samples, replace the Region and account ID in the Amazon Resource Name (ARN) with your own. ``` { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "cassandra:Select" ], "Resource":[ "arn:aws:cassandra:us-east-1:111122223333:/keyspace/system*" ] } ] } ``` The following sample policy adds read-only access to the user table `mytable` in the keyspace `mykeyspace`. ``` { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "cassandra:Select" ], "Resource":[ "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/table/mytable", "arn:aws:cassandra:us-east-1:111122223333:/keyspace/system*" ] } ] } ``` The following sample policy assigns read/write access to a user table and read access to the system tables. ``` { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "cassandra:Select", "cassandra:Modify" ], "Resource":[ "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/table/mytable", "arn:aws:cassandra:us-east-1:111122223333:/keyspace/system*" ] } ] } ``` The following sample policy allows a user to create tables in keyspace `mykeyspace`. ``` { "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "cassandra:Create", "cassandra:Select" ], "Resource":[ "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/*", "arn:aws:cassandra:us-east-1:111122223333:/keyspace/system*" ] } ] } ``` The following sample policy assigns read access to the system tables, but restricts `SELECT` (read) and `MODIFY` (write) access to the user table `mytable`. ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cassandra:Select" ], "Resource": [ "arn:aws:cassandra:us-east-1:111122223333:/keyspace/system*" ] }, { "Effect": "Deny", "Action": [ "cassandra:Select", "cassandra:Modify" ], "Resource": [ "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/table/mytable" ] } ] } ``` ## Amazon Keyspaces resource access based on tags You can use conditions in your identity-based policy to control access to Amazon Keyspaces resources based on tags. These policies control visibility of the keyspaces and tables in the account. Note that tag-based permissions for system tables behave differently when requests are made using the AWS SDK compared to Cassandra Query Language (CQL) API calls via Cassandra drivers and developer tools. + To make `List` and `Get` resource requests with the AWS SDK when using tag-based access, the caller needs to have read access to system tables. For example, `Select` action permissions are required to read data from system tables via the `GetTable` operation. If the caller has only tag-based access to a specific table, an operation that requires additional access to a system table will fail. + For compatibility with established Cassandra driver behavior, tag-based authorization policies are not enforced when performing operations on system tables using Cassandra Query Language (CQL) API calls via Cassandra drivers and developer tools. The following example shows how you can create a policy that grants permissions to a user to view a table if the table's `Owner` contains the value of that user's user name. In this example you also give read access to the system tables. ``` { "Version":"2012-10-17", "Statement":[ { "Sid":"ReadOnlyAccessTaggedTables", "Effect":"Allow", "Action":"cassandra:Select", "Resource":[ "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/table/*", "arn:aws:cassandra:us-east-1:111122223333:/keyspace/system*" ], "Condition":{ "StringEquals":{ "aws:ResourceTag/Owner":"${aws:username}" } } } ] } ``` You can attach this policy to the IAM users in your account. If a user named `richard-roe` attempts to view an Amazon Keyspaces table, the table must be tagged `Owner=richard-roe` or `owner=richard-roe`. Otherwise, he is denied access. The condition tag key `Owner` matches both `Owner` and `owner` because condition key names are not case-sensitive. For more information, see [IAM JSON policy elements: Condition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html) in the *IAM User Guide*. The following policy grants permissions to a user to create tables with tags if the table's `Owner` contains the value of that user's user name. ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTagTableUser", "Effect": "Allow", "Action": [ "cassandra:Create", "cassandra:TagResource" ], "Resource": "arn:aws:cassandra:us-east-1:111122223333:/keyspace/mykeyspace/table/*", "Condition":{ "StringEquals":{ "aws:RequestTag/Owner":"${aws:username}" } } } ] } ``` # AWS managed policies for Amazon Keyspaces An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles. Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining [ customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#customer-managed-policies) that are specific to your use cases. You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services. For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) in the *IAM User Guide*. ## AWS managed policy: AmazonKeyspacesReadOnlyAccess\$1v2 You can attach the `AmazonKeyspacesReadOnlyAccess_v2` policy to your IAM identities. This policy grants read-only access to Amazon Keyspaces and includes the required permissions when connecting through private VPC endpoints. **Permissions details** This policy includes the following permissions. + `Amazon Keyspaces` – Provides read-only access to Amazon Keyspaces. + `Amazon Keyspaces CDC streams` – Allows principals to view Amazon Keyspaces CDC streams. + `Application Auto Scaling` – Allows principals to view configurations from Application Auto Scaling. This is required so that users can view automatic scaling policies that are attached to a table. + `CloudWatch` – Allows principals to view metric data and alarms configured in CloudWatch. This is required so users can view the billable table size and CloudWatch alarms that have been configured for a table. + `AWS KMS` – Allows principals to view keys configured in AWS KMS. This is required so users can view AWS KMS keys that they create and manage in their account to confirm that the key assigned to Amazon Keyspaces is a symmetric encryption key that is enabled. + `Amazon EC2` – Allows principals connecting to Amazon Keyspaces through VPC endpoints to query the VPC on your Amazon EC2 instance for endpoint and network interface information. This read-only access to the Amazon EC2 instance is required so Amazon Keyspaces can look up and store available interface VPC endpoints in the `system.peers` table used for connection load balancing. To review the policy in `JSON` format, see [AmazonKeyspacesReadOnlyAccess\$1v2](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKeyspacesReadOnlyAccess_v2.html). ## AWS managed policy: AmazonKeyspacesReadOnlyAccess You can attach the `AmazonKeyspacesReadOnlyAccess` policy to your IAM identities. This policy grants read-only access to Amazon Keyspaces. **Permissions details** This policy includes the following permissions. + `Amazon Keyspaces` – Provides read-only access to Amazon Keyspaces. + `Amazon Keyspaces CDC streams` – Allows principals to view Amazon Keyspaces CDC streams. + `Application Auto Scaling` – Allows principals to view configurations from Application Auto Scaling. This is required so that users can view automatic scaling policies that are attached to a table. + `CloudWatch` – Allows principals to view metric data and alarms configured in CloudWatch. This is required so users can view the billable table size and CloudWatch alarms that have been configured for a table. + `AWS KMS` – Allows principals to view keys configured in AWS KMS. This is required so users can view AWS KMS keys that they create and manage in their account to confirm that the key assigned to Amazon Keyspaces is a symmetric encryption key that is enabled. To review the policy in `JSON` format, see [AmazonKeyspacesReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKeyspacesReadOnlyAccess.html). ## AWS managed policy: AmazonKeyspacesFullAccess You can attach the `AmazonKeyspacesFullAccess` policy to your IAM identities. This policy grants administrative permissions that allow your administrators unrestricted access to Amazon Keyspaces. **Permissions details** This policy includes the following permissions. + `Amazon Keyspaces` – Allows principals to access any Amazon Keyspaces resource and perform all actions. + `Application Auto Scaling` – Allows principals to create, view, and delete automatic scaling policies for Amazon Keyspaces tables. This is required so that administrators can manage automatic scaling policies for Amazon Keyspaces tables. + `CloudWatch` – Allows principals to see the billable table size as well as create, view, and delete CloudWatch alarms for Amazon Keyspaces automatic scaling policies. This is required so that administrators can view the billable table size and create a CloudWatch dashboard. + `IAM` – Allows Amazon Keyspaces to create service-linked roles with IAM automatically when the following features are turned on: + `Amazon Keyspaces CDC streams` – When an administrator enables a stream for a table, Amazon Keyspaces creates the service-linked role [AWSServiceRoleForAmazonKeyspacesCDC](using-service-linked-roles-CDC-streams.md#service-linked-role-permissions-CDC-streams) to publish CloudWatch metrics into your account on your behalf. + `Application Auto Scaling` – When an administrator enables Application Auto Scaling for a table, Amazon Keyspaces creates the service-linked role [AWSServiceRoleForApplicationAutoScaling\$1CassandraTable](using-service-linked-roles-app-auto-scaling.md#service-linked-role-permissions-app-auto-scaling) to perform automatic scaling actions on your behalf. + `Amazon Keyspaces multi-Region replication` – When an administrator creates a new multi-Region keyspace, or adds a new AWS Region to an existing single-Region keyspace, Amazon Keyspaces creates the service-linked role [AWSServiceRoleForAmazonKeyspacesReplication](using-service-linked-roles-multi-region-replication.md#service-linked-role-permissions-multi-region-replication) to perform replication of tables, data, and metadata to the selected Regions on your behalf. + `AWS KMS` – Allows principals to view keys configured in AWS KMS. This is required so that users can view AWS KMS keys that they create and manage in their account to confirm that the key assigned to Amazon Keyspaces is a symmetric encryption key that is enabled. + `Amazon EC2` – Allows principals connecting to Amazon Keyspaces through VPC endpoints to query the VPC on your Amazon EC2 instance for endpoint and network interface information. This read-only access to the Amazon EC2 instance is required so Amazon Keyspaces can look up and store available interface VPC endpoints in the `system.peers` table used for connection load balancing. To review the policy in `JSON` format, see [AmazonKeyspacesFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonKeyspacesFullAccess.html). ## AWS managed policy: KeyspacesCDCServiceRolePolicy You can't attach `KeyspacesCDCServiceRolePolicy` to your IAM entities. This policy is attached to a service-linked role that allows Amazon Keyspaces to perform actions on your behalf. For more information, see [Using roles for Amazon Keyspaces CDC streams](using-service-linked-roles-CDC-streams.md). This policy grants the required permissions to the service-linked role `AWSServiceRoleForAmazonKeyspacesCDC` to publish Amazon Keyspaces CDC stream metrics data to CloudWatch on your behalf. **Permissions details** This policy includes the following permissions. + `CloudWatch` – Allows the service-linked-role [AWSServiceRoleForAmazonKeyspacesCDC](using-service-linked-roles-CDC-streams.md#service-linked-role-permissions-CDC-streams) to publish metric data from Amazon Keyspaces CDC streams into the `"cloudwatch:namespace": "AWS/Cassandra"` in your CloudWatch account on your behalf. To review the policy in `JSON` format, see [KeyspacesCDCServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/KeyspacesCDCServiceRolePolicy.html). ## Amazon Keyspaces updates to AWS managed policies View details about updates to AWS managed policies for Amazon Keyspaces since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the [Document history for Amazon Keyspaces (for Apache Cassandra)](doc-history.md) page. | Change | Description | Date | | --- | --- | --- | | [KeyspacesCDCServiceRolePolicy](#security-iam-awsmanpol-KeyspacesCDCServiceRolePolicy) – New policy | Amazon Keyspaces added a new managed policy `KeyspacesCDCServiceRolePolicy` which grants the required permissions to the service-linked role `AWSServiceRoleForAmazonKeyspacesCDC` to publish Amazon Keyspaces CDC stream metrics data to CloudWatch on your behalf. For more information, see [Using roles for Amazon Keyspaces CDC streams](using-service-linked-roles-CDC-streams.md). | July 02, 2025 | | [AmazonKeyspacesReadOnlyAccess\$1v2](#security-iam-awsmanpol-AmazonKeyspacesReadOnlyAccess_v2) – Update to an existing policy | Amazon Keyspaces added new permissions to allow IAM principals to view Amazon Keyspaces CDC streams. For more information, see [View CDC streams in Amazon Keyspaces](keyspaces-view-cdc.md). | July 02, 2025 | | [AmazonKeyspacesReadOnlyAccess](#security-iam-awsmanpol-AmazonKeyspacesReadOnlyAccess) – Update to an existing policy | Amazon Keyspaces added new permissions to allow IAM principals to view Amazon Keyspaces CDC streams. For more information, see [View CDC streams in Amazon Keyspaces](keyspaces-view-cdc.md). | July 02, 2025 | | [AmazonKeyspacesFullAccess](#security-iam-awsmanpol-AmazonKeyspacesFullAccess) – Update to an existing policy | Amazon Keyspaces created the `KeyspacesCDCServiceRolePolicy` managed policy for the service linked role [AWSServiceRoleForAmazonKeyspacesCDC](using-service-linked-roles-CDC-streams.md#service-linked-role-permissions-CDC-streams) to add the permissions that are required when an administrator enables a stream for a table. Amazon Keyspaces uses the service-linked role `AWSServiceRoleForAmazonKeyspacesCDC` to publish CloudWatch metrics into your account on your behalf. For more information, see [Using roles for Amazon Keyspaces CDC streams](using-service-linked-roles-CDC-streams.md). | July 02, 2025 | | [AmazonKeyspacesFullAccess](#security-iam-awsmanpol-AmazonKeyspacesFullAccess) – Update to an existing policy | Amazon Keyspaces updated the `KeyspacesReplicationServiceRolePolicy` of the service linked role [AWSServiceRoleForAmazonKeyspacesReplication](using-service-linked-roles-multi-region-replication.md#service-linked-role-permissions-multi-region-replication) to add the permissions that are required when an administrator adds a new AWS Region to a single or multi-Region keyspace. Amazon Keyspaces uses the service-linked role `AWSServiceRoleForAmazonKeyspacesReplication` to replicate tables, their settings, and data on your behalf. For more information, see [Using roles for Amazon Keyspaces Multi-Region Replication](using-service-linked-roles-multi-region-replication.md). | November 19, 2024 | | [AmazonKeyspacesFullAccess](#security-iam-awsmanpol-AmazonKeyspacesFullAccess) – Update to an existing policy | Amazon Keyspaces added new permissions to allow Amazon Keyspaces to create a service-linked role when an administrator adds a new Region to a single or multi-Region keyspace. Amazon Keyspaces uses the service-linked role to perform data replication tasks on your behalf. For more information, see [Using roles for Amazon Keyspaces Multi-Region Replication](using-service-linked-roles-multi-region-replication.md). | October 3, 2023 | | [AmazonKeyspacesReadOnlyAccess\$1v2](#security-iam-awsmanpol-AmazonKeyspacesReadOnlyAccess) – New policy | Amazon Keyspaces created a new policy to add read-only permissions for clients connecting to Amazon Keyspaces through interface VPC endpoints to access the Amazon EC2 instance to look up network information. Amazon Keyspaces stores available interface VPC endpoints in the `system.peers` table for connection load balancing. For more information, see [Using Amazon Keyspaces with interface VPC endpoints](vpc-endpoints.md). | September 12, 2023 | | [AmazonKeyspacesFullAccess](#security-iam-awsmanpol-AmazonKeyspacesFullAccess) – Update to an existing policy | Amazon Keyspaces added new permissions to allow Amazon Keyspaces to create a service-linked role when an administrator creates a multi-Region keyspace. Amazon Keyspaces uses the service-linked role `AWSServiceRoleForAmazonKeyspacesReplication` to perform data replication tasks on your behalf. For more information, see [Using roles for Amazon Keyspaces Multi-Region Replication](using-service-linked-roles-multi-region-replication.md). | June 5, 2023 | | [AmazonKeyspacesReadOnlyAccess](#security-iam-awsmanpol-AmazonKeyspacesReadOnlyAccess) – Update to an existing policy | Amazon Keyspaces added new permissions to allow users to view the billable size of a table using CloudWatch. Amazon Keyspaces integrates with Amazon CloudWatch to allow you to monitor the billable table size. For more information, see [Amazon Keyspaces metrics](metrics-dimensions.md#keyspaces-metrics-dimensions). | July 7, 2022 | | [AmazonKeyspacesFullAccess](#security-iam-awsmanpol-AmazonKeyspacesFullAccess) – Update to an existing policy | Amazon Keyspaces added new permissions to allow users to view the billable size of a table using CloudWatch. Amazon Keyspaces integrates with Amazon CloudWatch to allow you to monitor the billable table size. For more information, see [Amazon Keyspaces metrics](metrics-dimensions.md#keyspaces-metrics-dimensions). | July 7, 2022 | | [AmazonKeyspacesReadOnlyAccess](#security-iam-awsmanpol-AmazonKeyspacesReadOnlyAccess) – Update to an existing policy | Amazon Keyspaces added new permissions to allow users to view AWS KMS keys that have been configured for Amazon Keyspaces encryption at rest. Amazon Keyspaces encryption at rest integrates with AWS KMS for protecting and managing the encryption keys used to encrypt data at rest. To view the AWS KMS key configured for Amazon Keyspaces, read-only permissions have been added. | June 1, 2021 | | [AmazonKeyspacesFullAccess](#security-iam-awsmanpol-AmazonKeyspacesFullAccess) – Update to an existing policy | Amazon Keyspaces added new permissions to allow users to view AWS KMS keys that have been configured for Amazon Keyspaces encryption at rest. Amazon Keyspaces encryption at rest integrates with AWS KMS for protecting and managing the encryption keys used to encrypt data at rest. To view the AWS KMS key configured for Amazon Keyspaces, read-only permissions have been added. | June 1, 2021 | | Amazon Keyspaces started tracking changes | Amazon Keyspaces started tracking changes for its AWS managed policies. | June 1, 2021 | # Troubleshooting Amazon Keyspaces identity and access Use the following information to help you diagnose and fix common issues that you might encounter when working with Amazon Keyspaces and IAM. **Topics** + [I'm not authorized to perform an action in Amazon Keyspaces](#security_iam_troubleshoot-no-permissions) + [I modified an IAM user or role and the changes did not take effect immediately](#security_iam_troubleshoot-effect) + [I can't restore a table using Amazon Keyspaces point-in-time recovery (PITR)](#security_iam_troubleshoot-pitr) + [I'm not authorized to perform iam:PassRole](#security_iam_troubleshoot-passrole) + [I'm an administrator and want to allow others to access Amazon Keyspaces](#security_iam_troubleshoot-admin-delegate) + [I want to allow people outside of my AWS account to access my Amazon Keyspaces resources](#security_iam_troubleshoot-cross-account-access) ## I'm not authorized to perform an action in Amazon Keyspaces If the AWS Management Console tells you that you're not authorized to perform an action, then you must contact your administrator for assistance. Your administrator is the person that provided you with your user name and password. The following example error occurs when the `mateojackson` IAM user tries to use the console to view details about a *table* but does not have `cassandra:Select` permissions for the table. ``` User: arn:aws:iam::123456789012:user/mateojackson is not authorized to perform: cassandra:Select on resource: mytable ``` In this case, Mateo asks his administrator to update his policies to allow him to access the `mytable` resource using the `cassandra:Select` action. ## I modified an IAM user or role and the changes did not take effect immediately IAM policy changes may take up to 10 minutes to take effect for applications with existing, established connections to Amazon Keyspaces. IAM policy changes take effect immediately when applications establish a new connection. If you have made modifications to an existing IAM user or role, and it has not taken immediate effect, either wait for 10 minutes or disconnect and reconnect to Amazon Keyspaces. ## I can't restore a table using Amazon Keyspaces point-in-time recovery (PITR) If you are trying to restore an Amazon Keyspaces table with point-in-time recovery (PITR), and you see the restore process begin, but not complete successfully, you might not have configured all of the required permissions that are needed by the restore process. You must contact your administrator for assistance and ask that person to update your policies to allow you to restore a table in Amazon Keyspaces. In addition to user permissions, Amazon Keyspaces may require permissions to perform actions during the restore process on your principal's behalf. This is the case if the table is encrypted with a customer-managed key, or if you are using IAM policies that restrict incoming traffic. For example, if you are using condition keys in your IAM policy to restrict source traffic to specific endpoints or IP ranges, the restore operation fails. To allow Amazon Keyspaces to perform the table restore operation on your principal's behalf, you must add an `aws:ViaAWSService` global condition key in the IAM policy. For more information about permissions to restore tables, see [Configure restore table IAM permissions for Amazon Keyspaces PITR](howitworks_restore_permissions.md). ## I'm not authorized to perform iam:PassRole If you receive an error that you're not authorized to perform the `iam:PassRole` action, your policies must be updated to allow you to pass a role to Amazon Keyspaces. Some AWS services allow you to pass an existing role to that service instead of creating a new service role or service-linked role. To do this, you must have permissions to pass the role to the service. The following example error occurs when an IAM user named `marymajor` tries to use the console to perform an action in Amazon Keyspaces. However, the action requires the service to have permissions that are granted by a service role. Mary does not have permissions to pass the role to the service. ``` User: arn:aws:iam::123456789012:user/marymajor is not authorized to perform: iam:PassRole ``` In this case, Mary's policies must be updated to allow her to perform the `iam:PassRole` action. If you need help, contact your AWS administrator. Your administrator is the person who provided you with your sign-in credentials. ## I'm an administrator and want to allow others to access Amazon Keyspaces To allow others to access Amazon Keyspaces, you must grant permission to the people or applications that need access. If you are using AWS IAM Identity Center to manage people and applications, you assign permission sets to users or groups to define their level of access. Permission sets automatically create and assign IAM policies to IAM roles that are associated with the person or application. For more information, see [Permission sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html) in the *AWS IAM Identity Center User Guide*. If you are not using IAM Identity Center, you must create IAM entities (users or roles) for the people or applications that need access. You must then attach a policy to the entity that grants them the correct permissions in Amazon Keyspaces. After the permissions are granted, provide the credentials to the user or application developer. They will use those credentials to access AWS. To learn more about creating IAM users, groups, policies, and permissions, see [IAM Identities](https://docs.aws.amazon.com/IAM/latest/UserGuide/id.html) and [Policies and permissions in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) in the *IAM User Guide*. ## I want to allow people outside of my AWS account to access my Amazon Keyspaces resources You can create a role that users in other accounts or people outside of your organization can use to access your resources. You can specify who is trusted to assume the role. For services that support resource-based policies or access control lists (ACLs), you can use those policies to grant people access to your resources. To learn more, consult the following: + To learn whether Amazon Keyspaces supports these features, see [How Amazon Keyspaces works with IAM](security_iam_service-with-iam.md). + To learn how to provide access to your resources across AWS accounts that you own, see [Providing access to an IAM user in another AWS account that you own](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html) in the *IAM User Guide*. + To learn how to provide access to your resources to third-party AWS accounts, see [Providing access to AWS accounts owned by third parties](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html) in the *IAM User Guide*. + To learn how to provide access through identity federation, see [Providing access to externally authenticated users (identity federation)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html) in the *IAM User Guide*. + To learn the difference between using roles and resource-based policies for cross-account access, see [Cross account resource access in IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies-cross-account-resource-access.html) in the *IAM User Guide*. # Using service-linked roles for Amazon Keyspaces Amazon Keyspaces (for Apache Cassandra) uses AWS Identity and Access Management (IAM) [ service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role). A service-linked role is a unique type of IAM role that is linked directly to Amazon Keyspaces. Service-linked roles are predefined by Amazon Keyspaces and include all the permissions that the service requires to call other AWS services on your behalf. For information about other services that support service-linked roles, see [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) and look for the services that have **Yes** in the **Service-linked roles** column. Choose a **Yes** with a link to view the service-linked role documentation for that service. **Topics** + [Using roles for Amazon Keyspaces application auto scaling](using-service-linked-roles-app-auto-scaling.md) + [Using roles for Amazon Keyspaces Multi-Region Replication](using-service-linked-roles-multi-region-replication.md) + [Using roles for Amazon Keyspaces CDC streams](using-service-linked-roles-CDC-streams.md) # Using roles for Amazon Keyspaces application auto scaling Amazon Keyspaces (for Apache Cassandra) uses AWS Identity and Access Management (IAM) [service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role). A service-linked role is a unique type of IAM role that is linked directly to Amazon Keyspaces. Service-linked roles are predefined by Amazon Keyspaces and include all the permissions that the service requires to call other AWS services on your behalf. A service-linked role makes setting up Amazon Keyspaces easier because you don’t have to manually add the necessary permissions. Amazon Keyspaces defines the permissions of its service-linked roles, and unless defined otherwise, only Amazon Keyspaces can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity. You can delete a service-linked role only after first deleting its related resources. This protects your Amazon Keyspaces resources because you can't inadvertently remove permission to access the resources. ## Service-linked role permissions for Amazon Keyspaces Amazon Keyspaces uses the service-linked role named **AWSServiceRoleForApplicationAutoScaling\$1CassandraTable** to allow Application Auto Scaling to call Amazon Keyspaces and Amazon CloudWatch on your behalf. The AWSServiceRoleForApplicationAutoScaling\$1CassandraTable service-linked role trusts the following services to assume the role: + `cassandra.application-autoscaling.amazonaws.com` The role permissions policy allows Application Auto Scaling to complete the following actions on the specified Amazon Keyspaces resources: + Action: `cassandra:Select` on `arn:*:cassandra:*:*:/keyspace/system/table/*` + Action: `cassandra:Select` on the resource `arn:*:cassandra:*:*:/keyspace/system_schema/table/*` + Action: `cassandra:Select` on the resource `arn:*:cassandra:*:*:/keyspace/system_schema_mcs/table/*` + Action: `cassandra:Alter` on the resource `arn:*:cassandra:*:*:"*"` ## Creating a service-linked role for Amazon Keyspaces You don't need to manually create a service-linked role for Amazon Keyspaces automatic scaling. When you enable Amazon Keyspaces auto scaling on a table with the AWS Management Console, CQL, the AWS CLI, or the AWS API, Application Auto Scaling creates the service-linked role for you. If you delete this service-linked role, and then need to create it again, you can use the same process to recreate the role in your account. When you enable Amazon Keyspaces auto scaling for a table, Application Auto Scaling creates the service-linked role for you again. **Important** This service-linked role can appear in your account if you completed an action in another service that uses the features supported by this role. To learn more, see [A new role appeared in my AWS account](https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html#troubleshoot_roles_new-role-appeared). ## Editing a service-linked role for Amazon Keyspaces Amazon Keyspaces does not allow you to edit the AWSServiceRoleForApplicationAutoScaling\$1CassandraTable service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the *IAM User Guide*. ## Deleting a service-linked role for Amazon Keyspaces If you no longer need to use a feature or service that requires a service-linked role, we recommend that you delete that role. That way you don’t have an unused entity that isn't actively monitored or maintained. However, you must first disable automatic scaling on all tables in the account across all AWS Regions before you can delete the service-linked role manually. To disable automatic scaling on Amazon Keyspaces tables, see [Turn off Amazon Keyspaces auto scaling for a table](autoscaling.turnoff.md). **Note** If Amazon Keyspaces automatic scaling is using the role when you try to modify the resources, then the deregistration might fail. If that happens, wait for a few minutes and try the operation again. **To manually delete the service-linked role using IAM** Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleForApplicationAutoScaling\$1CassandraTable service-linked role. For more information, see [Deleting a Service-Linked Role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the *IAM User Guide*. **Note** To delete the service-linked role used by Amazon Keyspaces automatic scaling, you must first disable automatic scaling on all tables in the account. ## Supported Regions for Amazon Keyspaces service-linked roles Amazon Keyspaces supports using service-linked roles in all of the Regions where the service is available. For more information, see [Service endpoints for Amazon Keyspaces](https://docs.aws.amazon.com/keyspaces/latest/devguide/programmatic.endpoints.html). # Using roles for Amazon Keyspaces Multi-Region Replication Amazon Keyspaces (for Apache Cassandra) uses AWS Identity and Access Management (IAM) [service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role). A service-linked role is a unique type of IAM role that is linked directly to Amazon Keyspaces. Service-linked roles are predefined by Amazon Keyspaces and include all the permissions that the service requires to call other AWS services on your behalf. A service-linked role makes setting up Amazon Keyspaces easier because you don’t have to manually add the necessary permissions. Amazon Keyspaces defines the permissions of its service-linked roles, and unless defined otherwise, only Amazon Keyspaces can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity. You can delete a service-linked role only after first deleting its related resources. This protects your Amazon Keyspaces resources because you can't inadvertently remove permission to access the resources. ## Service-linked role permissions for Amazon Keyspaces Amazon Keyspaces uses the service-linked role named **AWSServiceRoleForAmazonKeyspacesReplication** to allow Amazon Keyspaces to add new AWS Regions to a keyspace on your behalf, and replicate tables and all their data and settings to the new Region. The role also allows Amazon Keyspaces to replicate writes to tables in all Regions on your behalf. The AWSServiceRoleForAmazonKeyspacesReplication service-linked role trusts the following services to assume the role: + `replication.cassandra.amazonaws.com` The role permissions policy named KeyspacesReplicationServiceRolePolicy allows Amazon Keyspaces to complete the following actions: + Action: `cassandra:Select` + Action: `cassandra:SelectMultiRegionResource` + Action: `cassandra:Modify` + Action: `cassandra:ModifyMultiRegionResource` + Action: `cassandra:AlterMultiRegionResource` + Action: `application-autoscaling:RegisterScalableTarget` – Amazon Keyspaces uses the application auto scaling permissions when you add a replica to a single Region table in provisioned mode with auto scaling enabled. + Action: `application-autoscaling:DeregisterScalableTarget` + Action: `application-autoscaling:DescribeScalableTargets` + Action: `application-autoscaling:PutScalingPolicy` + Action: `application-autoscaling:DescribeScalingPolicies` + Action: `cassandra:Alter` + Action: `cloudwatch:DeleteAlarms` + Action: `cloudwatch:DescribeAlarms` + Action: `cloudwatch:PutMetricAlarm` Although the Amazon Keyspaces service-linked role AWSServiceRoleForAmazonKeyspacesReplication provides the permissions: "Action:" for the specified Amazon Resource Name (ARN) "arn:\$1" in the policy, Amazon Keyspaces supplies the ARN of your account. Permissions to create the service-linked role AWSServiceRoleForAmazonKeyspacesReplication are included in the `AmazonKeyspacesFullAccess` managed policy. For more information, see [AWS managed policy: AmazonKeyspacesFullAccess](security-iam-awsmanpol.md#security-iam-awsmanpol-AmazonKeyspacesFullAccess). You must configure permissions to allow your users, groups, or roles to create, edit, or delete a service-linked role. For more information, see [Service-linked role permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions) in the *IAM User Guide*. ## Creating a service-linked role for Amazon Keyspaces You can't manually create a service-linked role. When you create a multi-Region keyspace in the AWS Management Console, the AWS CLI, or the AWS API, Amazon Keyspaces creates the service-linked role for you. If you delete this service-linked role, and then need to create it again, you can use the same process to recreate the role in your account. When you create a multi-Region keyspace, Amazon Keyspaces creates the service-linked role for you again. ## Editing a service-linked role for Amazon Keyspaces Amazon Keyspaces does not allow you to edit the AWSServiceRoleForAmazonKeyspacesReplication service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the *IAM User Guide*. ## Deleting a service-linked role for Amazon Keyspaces If you no longer need to use a feature or service that requires a service-linked role, we recommend that you delete that role. That way you don’t have an unused entity that is not actively monitored or maintained. However, you must first delete all multi-Region keyspaces in the account across all AWS Regions before you can delete the service-linked role manually. ### Cleaning up a service-linked role Before you can use IAM to delete a service-linked role, you must first delete any multi-Region keyspaces and tables used by the role. **Note** If the Amazon Keyspaces service is using the role when you try to delete the resources, then the deletion might fail. If that happens, wait for a few minutes and try the operation again. **To delete Amazon Keyspaces resources used by the AWSServiceRoleForAmazonKeyspacesReplication (console)** 1. Sign in to the AWS Management Console, and open the Amazon Keyspaces console at [https://console.aws.amazon.com/keyspaces/home](https://console.aws.amazon.com/keyspaces/home). 1. Choose **Keyspaces** from the left-side panel. 1. Select all multi-Region keyspaces from the list. 1. Choose **Delete** confirm the deletion and choose **Delete keyspaces**. You can also delete multi-Region keyspaces programmatically using any of the following methods. + The Cassandra Query Language (CQL) [DROP KEYSPACE](cql.ddl.keyspace.md#cql.ddl.keyspace.drop) statement. + The [delete-keyspace](https://docs.aws.amazon.com/cli/latest/reference/keyspaces/delete-keyspace.html) operation of the AWS CLI. + The [DeleteKeyspace](https://docs.aws.amazon.com/keyspaces/latest/APIReference/API_DeleteKeyspace.html) operation of the Amazon Keyspaces API. ### Manually delete the service-linked role Use the IAM console, the AWS CLI, or the AWS API to delete the AWSServiceRoleForAmazonKeyspacesReplication service-linked role. For more information, see [Deleting a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role) in the *IAM User Guide*. ## Supported Regions for Amazon Keyspaces service-linked roles Amazon Keyspaces does not support using service-linked roles in every Region where the service is available. You can use the AWSServiceRoleForAmazonKeyspacesReplication role in the following Regions. **** | Region name | Region identity | Support in Amazon Keyspaces | | --- | --- | --- | | US East (N. Virginia) | us-east-1 | Yes | | US East (Ohio) | us-east-2 | Yes | | US West (N. California) | us-west-1 | Yes | | US West (Oregon) | us-west-2 | Yes | | Asia Pacific (Mumbai) | ap-south-1 | Yes | | Asia Pacific (Osaka) | ap-northeast-3 | Yes | | Asia Pacific (Seoul) | ap-northeast-2 | Yes | | Asia Pacific (Singapore) | ap-southeast-1 | Yes | | Asia Pacific (Sydney) | ap-southeast-2 | Yes | | Asia Pacific (Tokyo) | ap-northeast-1 | Yes | | Canada (Central) | ca-central-1 | Yes | | Europe (Frankfurt) | eu-central-1 | Yes | | Europe (Ireland) | eu-west-1 | Yes | | Europe (London) | eu-west-2 | Yes | | Europe (Paris) | eu-west-3 | Yes | | Africa (Cape Town) | af-south-1 | Yes | | South America (São Paulo) | sa-east-1 | Yes | | AWS GovCloud (US-East) | us-gov-east-1 | No | | AWS GovCloud (US-West) | us-gov-west-1 | No | # Using roles for Amazon Keyspaces CDC streams Amazon Keyspaces (for Apache Cassandra) uses AWS Identity and Access Management (IAM) [service-linked roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role). A service-linked role is a unique type of IAM role that is linked directly to Amazon Keyspaces. Service-linked roles are predefined by Amazon Keyspaces and include all the permissions that the service requires to call other AWS services on your behalf. A service-linked role makes setting up Amazon Keyspaces easier because you don’t have to manually add the necessary permissions. Amazon Keyspaces defines the permissions of its service-linked roles, and unless defined otherwise, only Amazon Keyspaces can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity. You can't delete the service-linked role. ## Service-linked role permissions for Amazon Keyspaces Amazon Keyspaces uses the service-linked role named **AWSServiceRoleForAmazonKeyspacesCDC** to allow Amazon Keyspaces CDC streams to publish CloudWatch metrics into your account on your behalf. The AWSServiceRoleForAmazonKeyspacesCDC service-linked role trusts the following service to assume the role: + `cassandra-streams.amazonaws.com` The role permissions policy named [KeyspacesCDCServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/KeyspacesCDCServiceRolePolicy.html) allows Amazon Keyspaces to complete the following action on resources in the CloudWatch namespace `AWS/Cassandra`: + Action: `cloudwatch:PutMetricData` on `*` The AWSServiceRoleForAmazonKeyspacesCDC provides the permissions: Action: cloudwatch:PutMetricData on all resources that match the following condition: `"cloudwatch:namespace": "AWS/Cassandra"`. For more information about KeyspacesCDCServiceRolePolicy, see [AWS managed policy: KeyspacesCDCServiceRolePolicy](security-iam-awsmanpol.md#security-iam-awsmanpol-KeyspacesCDCServiceRolePolicy). To enable CDC streams for a table, which automatically creates the service-linked role AWSServiceRoleForAmazonKeyspacesCDC, the IAM principal needs the following permissions. ``` { "Sid": "KeyspacesCDCServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::*:role/aws-service-role/cassandra-streams.amazonaws.com/AWSServiceRoleForAmazonKeyspacesCDC", "Condition": { "StringLike": { "iam:AWSServiceName": "cassandra-streams.amazonaws.com" } } ``` Permissions to create the service-linked role AWSServiceRoleForAmazonKeyspacesCDC are included in the `AmazonKeyspacesFullAccess` managed policy. For more information, see [AWS managed policy: AmazonKeyspacesFullAccess](security-iam-awsmanpol.md#security-iam-awsmanpol-AmazonKeyspacesFullAccess). ## Creating a service-linked role for Amazon Keyspaces You don't need to manually create a service-linked role for Amazon Keyspaces CDC streams. When you enable Amazon Keyspaces CDC streams on a table with the AWS Management Console, CQL, the AWS CLI, or the AWS API, Amazon Keyspaces creates the service-linked role for you. If you delete this service-linked role, and then need to create it again, you can use the same process to recreate the role in your account. When you enable Amazon Keyspaces CDC streams for a table, Amazon Keyspaces creates the service-linked role for you again. ## Editing a service-linked role for Amazon Keyspaces Amazon Keyspaces doesn’t allow you to edit the AWSServiceRoleForAmazonKeyspacesCDC service-linked role. After you create a service-linked role, you cannot change the name of the role because various entities might reference the role. However, you can edit the description of the role using IAM. For more information, see [Editing a service-linked role](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role) in the *IAM User Guide*. ## Supported Regions for Amazon Keyspaces service-linked roles Amazon Keyspaces supports using service-linked roles in all of the Regions where the service is available. For more information, see [AWS Regions and endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html).