Creating Credentials to Access Amazon Keyspaces (for Apache Cassandra) Programmatically

To provide users and applications with credentials for programmatic access to Amazon Keyspaces resources, you can do either of the following:

• Create service-specific credentials that are associated with a specific AWS Identity and Access Management (IAM) user.

• Use an authentication plugin for temporary credentials. This plugin enables IAM users, roles, and federated identities to add authentication information to Amazon Keyspaces (for Apache Cassandra) API requests using the AWS Signature Version 4 Process (SigV4). For code samples that show how to connect using the SigV4 authentication plugin, see Using a Cassandra Client Driver to Access Amazon Keyspaces Programmatically.

Generate Service-Specific Credentials

Service-specific credentials enable IAM users to access a specific AWS service. The credentials cannot be used to access other AWS services. They are associated with a specific IAM user and cannot be used by other IAM users.

Important

Service-specific credentials can only be used by IAM users. To give IAM roles or federated identities permissions to access your resources, you should use the authentication plugin to create temporary credentials.

Use one of the following procedures to generate a service-specific credential.

Generate Service-Specific Credentials Using the AWS Management Console

To generate service-specific credentials using the console

1. Sign in to the AWS Management Console and open the AWS Identity and Access Management console at https://console.aws.amazon.com/iam/home.

2. In the navigation pane, choose Users, and then choose the user that you created earlier that has Amazon Keyspaces permissions (policy attached).

3. Choose Security Credentials. Under Credentials for Amazon Keyspaces, choose Generate credentials to generate the service-specific credentials.

   Your service-specific credentials are now available. This is the only time you can download or view the password. You cannot recover it later. However, you can reset your password at any time. Save the user and password in a secure location, because you'll need them later.

Generate Service-Specific Credentials Using the AWS CLI

To generate service-specific credentials using the AWS CLI

Before generating service-specific credentials, you need to download, install, and configure the AWS Command Line Interface (AWS CLI):

1. Download the AWS CLI at http://aws.amazon.com/cli.

   Note

   The AWS CLI runs on Windows, macOS, or Linux.

2. Follow the instructions for Installing the AWS CLI and Configuring the AWS CLI in the AWS Command Line Interface User Guide.

3. Using the AWS CLI, run the following command to generate service-specific credentials for the user alice, so that she can access Amazon Keyspaces.

   aws iam create-service-specific-credential \
       --user-name alice \
       --service-name cassandra.amazonaws.com
   

The output looks like the following.

{
    "ServiceSpecificCredential": {
        "CreateDate": "2019-10-09T16:12:04Z",
        "ServiceName": "cassandra.amazonaws.com",
        "ServiceUserName": "alice-at-111122223333",
        "ServicePassword": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
        "ServiceSpecificCredentialId": "ACCAYFI33SINPGJEBYESF",
        "UserName": "alice",
        "Status": "Active"
    }
}

In the output, note the values for ServiceUserName and ServicePassword. Save these values in a secure location, because you'll need them later.

Important

This is the only time that the ServicePassword will be available to you.