liveBook · Manning

Functional role

As explained in Snowflake Data Engineering

A functional role is an access-control role representing the privileges required for a particular job function or business responsibility.

A functional role represents the privileges a person needs for a job function or business responsibility. In Snowflake RBAC, grant access roles to functional roles, then grant functional roles to users. Keep access roles focused on common privilege sets, while functional roles express who needs those sets: for example, data engineer or data analyst. section 10.1.3

Design functional roles around operational responsibility rather than individual objects:

  • Start with job functions, then refine broad roles by business unit when their access needs differ, such as separate Bread and Pastry analyst roles. section 10.1.3 section 10.2
  • Grant access roles such as full-access or read-only roles to functional roles; avoid granting access roles to other access roles. section 10.1.3
  • Grant functional roles to other functional roles sparingly so the hierarchy remains maintainable. section 10.1.3
  • Use managed access schemas and future grants so access-role privileges are governed centrally and extend to newly created objects. section 10.1.3
Figure 10.1 Role-based access control configuration of the environment used in the example in this chapter. The environment includes two functional roles, DATA_ENGINEER and DATA ANALYST, and two access roles, BAKERY_FULL and BAKERY_READ. Access roles are granted to functional roles, and functional roles are granted to the SYSADMIN role.
figure

The role layout separates job-facing functional roles from privilege-bearing access roles: DATA_ENGINEER receives BAKERY_FULL, while DATA_ANALYST receives BAKERY_READ. section 10.1.3

Business-unit analyst roles with row filtering

DATA_ANALYST_BREAD and DATA_ANALYST_PASTRY can both inherit BAKERY_READ for the RPT schema. A row access policy then checks the active functional role and returns only Bread or Pastry employee rows, respectively. This combines shared object privileges with role-specific row visibility. section 10.2

Functional roles fit into a custom role hierarchy whose top custom role can be granted to SYSADMIN. Privileges remain assigned to roles rather than directly to users, allowing administrators to control permitted actions on securable objects through role assignment. section 10.4

How Snowflake Data Engineering covers it

How deep it goes
Builds a functional-role hierarchy with grants, then applies role checks in a row access policy.
Examples
Uses DATA_ENGINEER, DATA_ANALYST, and business-unit analyst roles against RAW and RPT employee data.
What it assumes
Introduces RBAC design through executable Snowflake role and grant commands without stating prior knowledge requirements.
What you can do after
Build it from scratch by creating functional roles, assigning access roles, and filtering rows by active role.
How it connects
Connects functional roles to RBAC, access roles, managed access schemas, future grants, and row access policies.
Cover of Snowflake Data Engineering
liveBookmanning.com
Read Snowflake Data Engineering on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Snowflake Data Engineering. The section links point to the parts of the book it draws on.