A role hierarchy is an access-control structure in which roles are granted to other roles. Higher-level roles inherit privileges granted to lower-level roles, while users receive permissions through assigned roles. section 10.1
Snowflake uses role-based access control to centralize privilege management: privileges are granted to roles, and roles are assigned to users. A maintainable design separates access roles from functional roles. section 10.1 section 10.4
Build a practical hierarchy by:
- Creating access roles that represent common privilege sets, such as full access or read-only access. section 10.1.3
- Granting access roles to functional roles, then granting functional roles to users or SYSADMIN. section 10.1.2 section 10.1.3
- Using managed access schemas and future grants to centralize ownership and automatically privilege newly created objects. section 10.4
- Avoiding grants between access roles and limiting grants between functional roles so the hierarchy remains maintainable. section 10.1.3
Bakery access hierarchy
Create BAKERY_FULL and BAKERY_READ access roles, grant them respectively to DATA_ENGINEER and DATA_ANALYST, then grant both functional roles to SYSADMIN. DATA_ENGINEER inherits full access, while DATA_ANALYST inherits read access to reporting data. section 10.1.3
Figure 10.1 Role-based access control configuration of the environment used in the example in this chapter. The environment includes two functional roles, DATA_ENGINEER and DATA ANALYST, and two access roles, BAKERY_FULL and BAKERY_READ. Access roles are granted to functional roles, and functional roles are granted to the SYSADMIN role.
Figure 10.1 maps the hierarchy from BAKERY_FULL and BAKERY_READ through DATA_ENGINEER and DATA_ANALYST to SYSADMIN. section 10.1.3
