Cassandra Superuser Login Exposure Sentinel with Kestra

id: cassandra-superuser-login-sentinel
namespace: company.team
description: |
  Query Cassandra's system_auth.roles on a schedule, flag any role that is
  both is_superuser and can_login (a directly usable, full-privilege
  credential), classify the result as HEALTHY, AT_RISK, or UNREACHABLE,
  log clean audits, and alert Slack the moment a privileged login surface
  is found or the cluster cannot be reached. auto_remediate and dry_run
  independently gate an optional ALTER ROLE that revokes login, never
  SUPERUSER status, from a flagged role.

inputs:
  - id: cassandra_host
    type: STRING
    defaults: "cassandra"
    displayName: "Cassandra Host"
    description: "Hostname or IP of a Cassandra contact point reachable from the
      Kestra Worker."
  - id: cassandra_port
    type: INT
    defaults: 9042
    displayName: "Cassandra CQL Port"
    description: "Native CQL port the contact point listens on, defaults to 9042."
  - id: cassandra_datacenter
    type: STRING
    defaults: "datacenter1"
    displayName: "Local Datacenter"
    description: "Datacenter name the driver's load-balancing policy treats as
      local; the official Cassandra Docker image defaults to datacenter1."
  - id: auto_remediate
    type: SELECT
    displayName: "Auto Remediate"
    defaults: "false"
    values:
      - "false"
      - "true"
    description: If "true" and a superuser role with login enabled is found, run
      ALTER ROLE ... WITH LOGIN = false on it (still gated by dry_run below). If
      "false", the risk is only reported.
  - id: dry_run
    type: SELECT
    displayName: "Dry Run"
    defaults: "true"
    values:
      - "true"
      - "false"
    description: If "true", remediation is only logged, ALTER ROLE never runs. Must
      be explicitly "false", together with auto_remediate "true", for login to
      actually be revoked.

triggers:
  - id: cassandra_superuser_audit_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    description: "Audit superuser login exposure every 6 hours. Shipped disabled;
      enable it once cassandra_host/cassandra_datacenter point at a real cluster
      and a manual run has been verified. Always fires in safe mode
      (auto_remediate false, dry_run true) regardless of this flow's own
      defaults."
    cron: "0 */6 * * *"
    disabled: true
    inputs:
      cassandra_host: "cassandra"
      cassandra_port: 9042
      cassandra_datacenter: "datacenter1"
      auto_remediate: "false"
      dry_run: "true"

tasks:
  - id: query_superuser_roles
    type: io.kestra.plugin.cassandra.standard.Query
    description: "Read role, is_superuser, and can_login from system_auth.roles -
      Cassandra's own internal role table, verified from its documented columns
      (role, can_login, is_superuser, member_of, salted_hash). plugin-cassandra
      has no dedicated role-audit task, so this uses its native CQL query task,
      matching the pattern already proven in this repo's
      cassandra-replication-audit-gate.yaml."
    session:
      endpoints:
        - hostname: "{{ inputs.cassandra_host }}"
          port: "{{ inputs.cassandra_port }}"
      localDatacenter: "{{ inputs.cassandra_datacenter }}"
    cql: "SELECT role, is_superuser, can_login FROM system_auth.roles"
    fetchType: FETCH
    allowFailure: true

  - id: classify_superuser_exposure
    type: io.kestra.plugin.core.debug.Return
    description: "Classify UNREACHABLE when the query produced no rows, AT_RISK when
      at least one role is both is_superuser and can_login, otherwise HEALTHY."
    format: "{{ outputs.query_superuser_roles.rows is defined ?
      ((outputs.query_superuser_roles.rows | jq('[.[] | select(.is_superuser ==
      true and .can_login == true)] | length') | first | default(0)) > 0 ?
      'AT_RISK' : 'HEALTHY') : 'UNREACHABLE' }}"

  - id: route_by_exposure
    type: io.kestra.plugin.core.flow.Switch
    description: "Log a quiet confirmation when healthy, route to the remediation
      gate when a privileged login surface is found, or page Slack when the
      cluster could not be queried."
    value: "{{ outputs.classify_superuser_exposure.value }}"
    cases:
      "HEALTHY":
        - id: log_healthy
          type: io.kestra.plugin.core.log.Log
          message: "No role on {{ inputs.cassandra_host }} is both is_superuser and
            can_login."
      "AT_RISK":
        - id: route_remediation
          type: io.kestra.plugin.core.flow.Switch
          description: "auto_remediate only decides whether remediation is considered at
            all; dry_run, checked separately below, decides whether ALTER ROLE
            actually runs."
          value: "{{ inputs.auto_remediate }}"
          cases:
            "true":
              - id: check_dry_run
                type: io.kestra.plugin.core.flow.If
                condition: "{{ inputs.dry_run == \"false\" }}"
                then:
                  - id: revoke_superuser_login
                    type: io.kestra.plugin.core.flow.Loop
                    description: "Revoke login from each flagged superuser role one at a time, so
                      one failed ALTER ROLE never blocks the rest of the batch."
                    values: "{{ outputs.query_superuser_roles.rows | jq('[.[] | select(.is_superuser
                      == true and .can_login == true) | .role]') | first }}"
                    concurrencyLimit: 4
                    tasks:
                      - id: revoke_role_login
                        type: io.kestra.plugin.cassandra.standard.Query
                        description: "ALTER ROLE ... WITH LOGIN = false is documented CQL syntax that
                          revokes direct login while leaving SUPERUSER status,
                          password, and every other permission untouched - the
                          role still exists and keeps its privileges, it simply
                          cannot be used to authenticate directly."
                        session:
                          endpoints:
                            - hostname: "{{ inputs.cassandra_host }}"
                              port: "{{ inputs.cassandra_port }}"
                          localDatacenter: "{{ inputs.cassandra_datacenter }}"
                        cql: "ALTER ROLE {{ item.value }} WITH LOGIN = false"
                  - id: log_remediation_applied
                    type: io.kestra.plugin.core.log.Log
                    message: "Revoked login from the superuser role(s) flagged on {{
                      inputs.cassandra_host }}."
                else:
                  - id: log_dry_run_remediation
                    type: io.kestra.plugin.core.log.Log
                    message: "DRY RUN: would revoke login from the flagged superuser role(s) on {{
                      inputs.cassandra_host }} (dry_run is true). No change
                      made."
            "false":
              - id: log_remediation_disabled
                type: io.kestra.plugin.core.log.Log
                message: "auto_remediate is false: at least one role on {{ inputs.cassandra_host
                  }} is both is_superuser and can_login, but no ALTER ROLE was
                  attempted."
        - id: alert_at_risk
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          description: "Always alert on AT_RISK, independent of whether it was remediated."
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "Cassandra superuser login sentinel AT_RISK: at least one role on {{ inputs.cassandra_host }}:{{ inputs.cassandra_port }} is both is_superuser and can_login. auto_remediate: {{ inputs.auto_remediate }}. dry_run: {{ inputs.dry_run }}. Execution {{ execution.id }}."
            }
      "UNREACHABLE":
        - id: alert_unreachable
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "Cassandra superuser login sentinel UNREACHABLE: the query against system_auth.roles on {{ inputs.cassandra_host }}:{{ inputs.cassandra_port }} returned no rows (connection failure, authentication failure, or the contact point is down). Execution {{ execution.id }}."
            }
    defaults:
      - id: log_unclassified
        type: io.kestra.plugin.core.log.Log
        message: "Completed Cassandra superuser login audit with status: {{
          outputs.classify_superuser_exposure.value }}"

  - id: log_audit_status
    type: io.kestra.plugin.core.log.Log
    description: "Post-audit status line recorded on every run regardless of branch,
      for a continuous privileged-access trend in the execution history."
    message: "Cassandra superuser login audit: host={{ inputs.cassandra_host }},
      datacenter={{ inputs.cassandra_datacenter }}, status={{
      outputs.classify_superuser_exposure.value }}, auto_remediate={{
      inputs.auto_remediate }}, dry_run={{ inputs.dry_run }}, execution={{
      execution.id }}."

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: "Alert Slack when the sentinel flow itself fails, so a broken audit
      never silently stops monitoring privileged login exposure."
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Cassandra superuser login sentinel flow {{ flow.id }} FAILED (execution {{ execution.id }}). Privileged login exposure status is now unknown; check the task logs and the cluster manually."
      }

A Cassandra role with is_superuser = true and no way to log in is inert - nobody can authenticate as it directly. The same role with can_login = true is a standing, directly usable, full-privilege credential, and nothing in the cluster itself tells you how many of those exist at any given moment. This blueprint queries system_auth.roles, flags any role that is both a superuser and able to log in, alerts on it, and can revoke that role's login capability with ALTER ROLE ... WITH LOGIN = false - leaving its SUPERUSER status, password, and every other permission untouched, so the role still exists for administrative purposes but cannot authenticate directly anymore.

How it works

cassandra_superuser_audit_schedule (io.kestra.plugin.core.trigger.Schedule) runs every 6 hours, always forcing auto_remediate: "false" and dry_run: "true" through its own inputs: override regardless of this flow's defaults. Shipped disabled so you can validate a manual run first.
query_superuser_roles (io.kestra.plugin.cassandra.standard.Query) runs SELECT role, is_superuser, can_login FROM system_auth.roles with fetchType: FETCH and allowFailure: true, so an unreachable cluster produces no rows instead of failing the task outright.
classify_superuser_exposure (io.kestra.plugin.core.debug.Return) classifies the result as UNREACHABLE (no rows), AT_RISK (at least one role with both is_superuser and can_login true), or HEALTHY.
route_by_exposure (io.kestra.plugin.core.flow.Switch) branches on that classification:
- HEALTHY: log_healthy records a clean check.
- AT_RISK: a nested route_remediation (Switch on auto_remediate) either considers remediation ("true", gated again by dry_run through check_dry_run) or only logs that remediation is disabled ("false"). When both gates allow it, revoke_superuser_login (io.kestra.plugin.core.flow.Loop) runs revoke_role_login (ALTER ROLE ... WITH LOGIN = false) for each flagged role. alert_at_risk always fires to Slack regardless of which path ran.
- UNREACHABLE: alert_unreachable pages Slack directly - a broken audit must never read as "no exposure".
log_audit_status always runs last, printing the classification regardless of which branch fired.
The errors block alerts Slack separately if the flow itself fails outside these handled branches.

What you get

A direct answer to "how many logins-capable superusers exist right now", computed from Cassandra's own role table, not inferred from configuration files.
Remediation that only ever flips LOGIN to false; SUPERUSER status, the role's password, and its role memberships are never touched.
Two independent gates (auto_remediate, dry_run) between "exposure detected" and "login actually revoked".
A three-way classification (HEALTHY/AT_RISK/UNREACHABLE) and a final status log every run, so the execution history doubles as a privileged-access trend for the cluster.

Who it's for

Platform and security teams running self-hosted Cassandra who need a standing check on privileged credentials, not a one-time LIST ROLES review.
DBAs auditing a cluster after onboarding or offboarding administrators, to confirm no forgotten superuser login survived the change.
Anyone evaluating the Cassandra plugin who wants a worked example of system_auth.roles auditing alongside this repo's existing system_schema.keyspaces replication sentinel.

Why orchestrate this with Kestra

system_auth.roles is a live, read-only snapshot; querying it by hand with cqlsh answers one moment in time and fixes nothing. Kestra supplies the schedule, the three-way risk classification as a first-class branch, two independent authorization gates before anything is altered, and an execution history that shows exactly when a role became both a superuser and loginable, and whether it was revoked.

Prerequisites

A reachable Cassandra cluster and a role with rights to read system_auth.roles and, if remediation runs, execute ALTER ROLE - note that a role can alter another role's SUPERUSER status only if it is itself a superuser, and cannot alter the SUPERUSER/LOGIN status of the role it is currently authenticated as.
A Slack incoming webhook for alerts.

Local testing: docker run -d --name cassandra-superuser-sentinel -p 9043:9042 cassandra:latest docker network connect YOUR_KESTRA_NETWORK cassandra-superuser-sentinel (only needed if the Kestra Worker runs in a separate Docker network than this container; set cassandra_host to cassandra-superuser-sentinel from inside that network, or localhost with port 9043 from the host). The official image's default cassandra superuser role ships exactly in the audited state - is_superuser and can_login both true - so a first run against it is a guaranteed, realistic breach.

Secrets

SLACK_WEBHOOK_URL: Slack incoming webhook used by alert_at_risk, alert_unreachable, and the errors block.
This blueprint's session connects without a username/password, matching this repo's existing cassandra-replication-audit-gate.yaml pattern against an unauthenticated local instance. For an authenticated cluster, add the credential properties documented on io.kestra.plugin.cassandra.standard.Query's session block from {{ secret(...) }} values rather than hardcoding them.
In Kestra OSS (no Enterprise secrets backend), secrets are supplied as environment variables prefixed SECRET_, base64-encoded, and read back in flows with {{ secret('NAME') }} - for example SECRET_SLACK_WEBHOOK_URL=$(echo -n 'https://hooks.slack.com/...' | base64). This keeps credentials out of the flow YAML but, per Kestra's own documentation, offers no encryption at rest or access control beyond the host environment; use the Enterprise secrets backend for stronger guarantees.

Inputs

cassandra_host (STRING, default cassandra): Cassandra contact point hostname.
cassandra_port (INT, default 9042): native CQL port.
cassandra_datacenter (STRING, default datacenter1): local datacenter for the driver's load-balancing policy.
auto_remediate (SELECT: "false", "true"; default "false"): must be "true" for ALTER ROLE to even be considered.
dry_run (SELECT: "true", "false"; default "true"): must be explicitly "false", together with auto_remediate: "true", for login to actually be revoked.

Outputs

outputs.query_superuser_roles.rows: the raw role/is_superuser/can_login rows for every run (absent when the cluster is unreachable).
outputs.classify_superuser_exposure.value: HEALTHY, AT_RISK, or UNREACHABLE for every run.

Quick start

Start Cassandra locally with the command above - the default cassandra role is already in the audited (exposed) state, no setup required.
Add the SLACK_WEBHOOK_URL secret.
Run the flow manually with the defaults and confirm alert_at_risk fires, and that log_remediation_disabled logs without altering anything.
Run once with auto_remediate: "true" and dry_run: "true" and confirm log_dry_run_remediation describes the revocation without running it.
Run once with auto_remediate: "true" and dry_run: "false" against a non-default role (see Pitfalls - the default cassandra role cannot revoke its own login while authenticated as itself), then confirm with SELECT role, can_login FROM system_auth.roles; that can_login is now false for that role.
Enable cassandra_superuser_audit_schedule once you trust the check; it always runs in the safe auto_remediate: "false" / dry_run: "true" mode regardless of what you leave the flow's own defaults set to.

How to extend

Extend classify_superuser_exposure to also flag roles with a non-empty member_of that transitively inherits superuser status, which this audit's direct is_superuser check does not follow.
Loop over several cassandra_host values with io.kestra.plugin.core.flow.Loop (ForEach is deprecated) to sweep a multi-cluster fleet in one run.
Route the remediation branch through a Pause approval task instead of (or alongside) the static auto_remediate input, for a human-reviewed revocation on production clusters.
Pair this with a separate, manually-triggered flow that re-enables login (ALTER ROLE ... WITH LOGIN = true) for a specific role during a planned maintenance window.

Pitfalls

A role cannot alter the SUPERUSER/LOGIN status of the role it is currently authenticated as. Verified from Cassandra's own documentation: "A role with SUPERUSER status can alter the SUPERUSER status of another role, but not the role currently held." If cassandra_username (or the session's authenticated role) is itself among the flagged rows, revoke_role_login will fail for that specific row even with both gates open; this must be remediated by a different superuser role.
This audits direct superuser flags only, not inherited privilege. member_of role membership can grant superuser-equivalent access transitively; verified from system_auth.roles's own documented columns, this blueprint's AT_RISK check only inspects each row's own is_superuser/can_login, not its membership chain.
allowFailure: true on query_superuser_roles is what lets UNREACHABLE be classified instead of failing the execution outright. Matching this repo's own cassandra-replication-audit-gate.yaml pattern: a connection or authentication failure produces an empty/undefined rows output rather than aborting the flow, which classify_superuser_exposure reads as UNREACHABLE.
auto_remediate and dry_run are independent gates, not a single boolean. Both must be "true"/"false" respectively for the revocation Loop to run; setting only one leaves the other still blocking.
Switch case keys are quoted strings matching the classifier's exact output. "HEALTHY", "AT_RISK", and "UNREACHABLE" must match classify_superuser_exposure.value verbatim; the defaults: block exists specifically to catch any value that does not match one of those three cases.

Cassandra Superuser Login Exposure Sentinel

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Inputs

Outputs

Quick start

How to extend

Pitfalls

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Cassandra Superuser Login Exposure Sentinel

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Inputs

Outputs

Quick start

How to extend

Pitfalls

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

More Data Blueprints

New to Kestra?