Roles & Access Control in Snowflake: Complete Guide with Easy Definitions
What is Access Control in Snowflake?
Access control in Snowflake defines who can access what data and what actions they are allowed
to perform.
Snowflake uses a role-based access control (RBAC) model to manage security.
Simple Definition:
Access control in Snowflake is the system that manages user permissions using roles to
secure data and resources.
What are Roles in Snowflake?
A role in Snowflake is a collection of privileges that can be assigned to users or other roles.
Roles determine: - What data a user can see - What operations a user can perform
Simple Definition:
A Snowflake role is a security object that groups permissions and controls access to data
and system objects.
Why Roles & Access Control are Important
Roles and access control help to: 1. Protect sensitive data 2. Enforce least-privilege access 3. Enable
secure multi-user environments 4. Support compliance and auditing 5. Prevent unauthorized changes
Snowflake RBAC Model
Snowflake follows a hierarchical RBAC model.
Key Principles:
• Privileges are granted to roles
• Roles are assigned to users
• Roles can inherit privileges from other roles
1
Core Access Control Entities
1. Users
• Individual login accounts
• Assigned one or more roles
2. Roles
• Define permissions
• Can be nested (role hierarchy)
3. Privileges
• Specific permissions like SELECT, INSERT, CREATE
4. Secure Objects
• Databases
• Schemas
• Tables
• Views
• Warehouses
Built-in System Roles in Snowflake
1. ACCOUNTADMIN
• Full access to all objects
• Reserved for account-level administration
2. SYSADMIN
• Manages databases and schemas
• Performs data engineering tasks
3. SECURITYADMIN
• Manages users and roles
• Grants privileges
4. USERADMIN
• Creates and manages users
2
5. PUBLIC
• Default role for all users
Role Hierarchy Example
ACCOUNTADMIN
└── SYSADMIN
└── ANALYST_ROLE
• Higher roles inherit permissions from lower roles
Privileges in Snowflake
Object-Level Privileges
• SELECT
• INSERT
• UPDATE
• DELETE
Account-Level Privileges
• CREATE USER
• CREATE ROLE
• MONITOR USAGE
Granting Privileges (Examples)
GRANT SELECT ON TABLE sales TO ROLE analyst_role;
GRANT USAGE ON DATABASE analytics TO ROLE analyst_role;
Assigning Roles to Users
GRANT ROLE analyst_role TO USER john_doe;
3
Role-Based Access Control Flow (Step by Step)
1. Admin creates roles
2. Privileges granted to roles
3. Roles assigned to users
4. Users activate roles during sessions
5. Access enforced automatically
Using Warehouses with Roles
• Warehouses require USAGE privilege
• Roles control warehouse access
GRANT USAGE ON WAREHOUSE compute_wh TO ROLE analyst_role;
Best Practices for Roles & Access Control
1. Use role hierarchy
2. Follow least privilege principle
3. Avoid using ACCOUNTADMIN for daily work
4. Separate admin, developer, and analyst roles
5. Audit privileges regularly
Common Mistakes
• Granting privileges directly to users
• Overusing ACCOUNTADMIN role
• Not using role hierarchy
• Poor role naming conventions
Snowflake Access Control in Real-Time Projects
Typical roles: - ETL_ROLE – data ingestion - TRANSFORM_ROLE – dbt transformations - ANALYST_ROLE –
reporting - ADMIN_ROLE – administration
Summary
• Snowflake uses RBAC for security
• Roles group permissions
• Privileges are granted to roles, not users
• Role hierarchy simplifies management
• Ensures secure and scalable access control
4
One-Line Definition:
Roles and access control in Snowflake provide a secure, role-based framework to manage
user permissions and protect data resources.