Astra DB: creating databases through the API needs Organization Administrator, Database Manager is not enough

Astra DB: creating databases through the API needs Organization Administrator, Database Manager is not enough

TL;DR

An Astra DB application token with the Database Manager role can manage databases but cannot create them through the DevOps API. Agents that provision infrastructure with a least-privilege token get permission errors on database creation and often misread it as a malformed request. The terraform-provider-astra docs spell out the minimums: "The Astra provider assumes the token has a minimum permission of either Database Manager for database actions and/or Organization Administrator for the streaming actions." Creating a database is an org-level action, so provisioning code needs a token with Organization Administrator.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

Split your tokens by job: an Organization Administrator token for provisioning databases, and a Database Manager (or narrower) token for runtime data-plane access.

An Astra DB application token with the Database Manager role can manage databases but cannot create them through the DevOps API. Agents that provision infrastructure with a least-privilege token get permission errors on database creation and often misread it as a malformed request. The terraform-provider-astra docs spell out the minimums: "The Astra provider assumes the token has a minimum permission of either Database Manager for database actions and/or Organization Administrator for the streaming actions." Creating a database is an org-level action, so provisioning code needs a token with Organization Administrator. Split your tokens by job: an Organization Administrator token for provisioning databases, and a Database Manager (or narrower) token for runtime data-plane access. Verified answer: An Astra DB application token with the Database Manager role can manage databases but cannot create them through the DevOps API. Agents that provision infrastructure with a least-privilege token get permission errors on database creation and often misread it as a malformed request. The terraform-provider-astra docs spell out the minimums: "The Astra provider assumes the token has a minimum permission of either Database Manager for database actions and/or Organization Administrator for the streaming actions." Creating a database is an org-level action, so provisioning code needs a token with Organization Administrator. Split your tokens by job: an Organization Administrator token for provisioning databases, and a Database Manager (or narrower) token for runtime data-plane access. Source: https://github.com/datastax/terraform-provider-astra/blob/HEAD/docs/index.md