Role-based access control (RBAC) controls access to Snowflake securable objects by granting privileges to roles and assigning those roles to users. Rather than letting individual object owners manage grants independently, RBAC centralizes grant management. A role hierarchy can grant roles to other roles, allowing higher roles to inherit lower-level privileges. section 10.1 section 10.4
Use RBAC when designing data pipelines so each user can access only the layers and objects required for their work. This separates data-engineering write access from analyst reporting access and supports governance alongside row access and masking policies for sensitive data. section 10.0 section 11.0
Design a maintainable role structure by separating job functions from privileges:
- Define functional roles that match job functions, such as data engineer, data analyst, or data scientist; refine generic roles where business functions require separate access. section 10.1.3
- Define access roles for common privilege sets, such as full access, read-only access, or read/write access. section 10.1.3
- Grant access roles to functional roles, then grant functional roles to users. Avoid granting access roles to other access roles, and keep functional-role inheritance limited. section 10.1.3
- Create managed access schemas to prevent object owners from granting object access at their discretion, and define future grants for objects created later. section 10.1.3
Full-access engineer and reporting analyst
A RAW schema stores source data and an RPT schema stores reporting data. BAKERY_FULL receives database and schema usage plus full schema privileges, then is granted to DATA_ENGINEER. BAKERY_READ receives usage and SELECT on RPT tables and views, including future objects, then is granted to DATA_ANALYST. The analyst cannot select RAW.EMPLOYEE but can query the RPT.EMPLOYEE view. section 10.1.3
Figure 10.1 Role-based access control configuration of the environment used in the example in this chapter. The environment includes two functional roles, DATA_ENGINEER and DATA ANALYST, and two access roles, BAKERY_FULL and BAKERY_READ. Access roles are granted to functional roles, and functional roles are granted to the SYSADMIN role.
The role graph distinguishes access roles from functional roles and shows privileges flowing through role grants to the administrative hierarchy. section 10.1.3
Apply the same pattern when adding pipeline infrastructure. An ORCHESTRATION schema can use managed access, receive full privileges through an existing access role, and thereby give an already-associated functional role inherited access without an additional direct grant. section 13.1.1
