Snowflake RBAC 101 – Episode 2: Role Hierarchies & Least Privilege

Goal: Avoid giving ACCOUNTADMIN to everyone and build clean role structures.

---

Why Role Hierarchy Matters

Snowflake RBAC is designed so privileges flow downward from higher-level roles to lower-level roles.

By creating a clear hierarchy, you:

• Reduce the risk of privilege overreach.
• Make it easier to audit and manage.
• Follow the principle of least privilege.

---

Recommended Role Hierarchy

ACCOUNTADMIN
↓
SECURITYADMIN
↓
SYSADMIN
↓
Custom Business Roles

• ACCOUNTADMIN – Full control, rarely used.
• SECURITYADMIN – Manages users and roles.
• SYSADMIN – Manages objects (databases, warehouses, etc.).
• Custom Business Roles – Specific access for departments or use cases.

---

🚀 Copy & Paste: Role Hierarchy Setup

sql
-- Create business roles
CREATE ROLE reporting;
CREATE ROLE data_engineering;

-- Assign privileges to roles
GRANT USAGE ON WAREHOUSE wh_analytics TO ROLE reporting;
GRANT SELECT ON ALL TABLES IN SCHEMA sales.public TO ROLE reporting;

GRANT USAGE ON WAREHOUSE wh_etl TO ROLE data_engineering;
GRANT CREATE TABLE ON SCHEMA raw.public TO ROLE data_engineering;

-- Link roles into the hierarchy
GRANT ROLE reporting TO ROLE sysadmin;
GRANT ROLE data_engineering TO ROLE sysadmin;