Cassandra - Database - Secrets Engines - Vault by HashiCorp

Cassandra is one of the supported plugins for the database secrets engine. Thisplugin generates database credentials dynamically based on configured roles forthe Cassandra database.See the database secrets engine docs formore information about setting up the database secrets engine. » SetupEnable the database secrets engine if it is not already enabled:$ vault secrets enable databaseSuccess! Enabled the database secrets engine at: database/By default, the secrets engine will enable at the name of the engine. Toenable the secrets engine at a different path, use the -path argument.Configure Vault with the proper plugin and connection information:$ vault write database/config/my-cassandra-database \ plugin_name="cassandra-database-plugin" \ hosts=127.0.0.1 \ protocol_version=4 \ username=cassandra \ password=cassandra \ allowed_roles=my-roleConfigure a role that maps a name in Vault to an SQL statement to execute tocreate the database credential:$ vault write database/roles/my-role \ db_name=my-cassandra-database \ creation_statements="CREATE USER '{{username}}' WITH PASSWORD '{{password}}' NOSUPERUSER; \ GRANT SELECT ON ALL KEYSPACES TO {{username}};" \ default_ttl="1h" \ max_ttl="24h"Success! Data written to: database/roles/my-role » UsageAfter the secrets engine is configured and a user/machine has a Vault token withthe proper permission, it can generate credentials.Generate a new credential by reading from the /creds endpoint with the nameof the role:$ vault read database/creds/my-roleKey Value--- -----lease_id database/creds/my-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6lease_duration 1hlease_renewable truepassword 8cab931c-d62e-a73d-60d3-5ee85139cd66username v-root-e2978cd0- » APIThe full list of configurable options can be seen in the Cassandra databaseplugin API page.For more information on the database secrets engine's HTTP API please see the Database secretsecrets engine API page.