question

@sebastien.fouquette_160564 If I understood correctly, your requirements are:

• not allow ALTER KEYSPACE
• allow CREATE, MODIFY, DROP for tables in a given keyspace

EDIT: Apologies that I didn't completely understand your requirements previously. I've edited my answer now to fit your needs.

You only need to grant the CREATE permission on the keyspace to achieve the above requirements. To illustrate, here is an example keyspace:

admin@cqlsh> CREATE KEYSPACE playground WITH replication = {'class': 'SimpleStrategy', 'replication_factor': 1 } ;

I granted the CREATE permission to the role sebastien:

admin@cqlsh> GRANT CREATE ON KEYSPACE playground TO sebastien ;

To verify that the permission has been granted:

admin@cqlsh:playground> LIST ALL PERMISSIONS OF sebastien ;

 role      | username  | resource              | permission | granted | restricted | grantable
-----------+-----------+-----------------------+------------+---------+------------+-----------
 sebastien | sebastien | <keyspace playground> |     CREATE |    True |      False |     False

This should allow me to login as the role sebastien and create a new table:

$ cqlsh -u sebastien
sebastien@cqlsh> USE playground ;
sebastien@cqlsh:playground> CREATE TABLE users (name text PRIMARY KEY, col_text text);

NOTE: A role which creates a resource (a table in this example) is automatically granted all the permissions to manage it.

Since the role sebastien created the table users, it will automatically inherit all the permissions on the table:

admin@cqlsh:playground> LIST ALL PERMISSIONS OF sebastien ;

 role      | username  | resource                 | permission | granted | restricted | grantable
-----------+-----------+--------------------------+------------+---------+------------+-----------
 sebastien | sebastien |    <keyspace playground> |     CREATE |    True |      False |     False
 sebastien | sebastien | <table playground.users> |      ALTER |    True |      False |     False
 sebastien | sebastien | <table playground.users> |       DROP |    True |      False |     False
 sebastien | sebastien | <table playground.users> |     SELECT |    True |      False |     False
 sebastien | sebastien | <table playground.users> |     MODIFY |    True |      False |     False
 sebastien | sebastien | <table playground.users> |  AUTHORIZE |    True |      False |     False

If the sebastien role attempts to alter the keyspace, it will result in an unauthorized error:

sebastien@cqlsh:playground> ALTER KEYSPACE playground WITH replication = {'class': 'NetworkTopologyStrategy', 'Cassandra' : 1 } ;
Unauthorized: Error from server: code=2100 [Unauthorized] message="User sebastien has no ALTER permission on <keyspace playground> or any of its parents"

Let me know if this isn't what you're after. Cheers!