Role-Based Access Control (RBAC) is the Snowflake Access Control Framework that allows privileges
to be granted by object owners to roles, and roles, in turn, can be assigned to users to restrict or
allow actions to be performed on objects. A characteristic of RBAC as used in Snowflake is:
Privileges can be granted at the database level and can be inherited by all underlying objects. This
means that a role that has a certain privilege on a database, such as CREATE SCHEMA or USAGE, can
also perform the same action on any schema, table, view, or other object within that database,
unless explicitly revoked. This simplifies the access control management and reduces the number of
grants required.
A user can create managed access schemas to support future grants and ensure only schema owners
can grant privileges to other roles. This means that a user can create a schema with the MANAGED
ACCESS option, which changes the default behavior of object ownership and privilege granting
within the schema. In a managed access schema, object owners lose the ability to grant privileges on
their objects to other roles, and only the schema owner or a role with the MANAGE GRANTS
privilege can do so. This enhances the security and governance of the schema and its objects.
The other options are not characteristics of RBAC as used in Snowflake:
A user can use a “super-user” access along with securityadmin to bypass authorization checks and
access all databases, schemas, and underlying objects. This is not true, as there is no such thing as a
“super-user” access in Snowflake. The securityadmin role is a predefined role that can manage users
and roles, but it does not have any privileges on any database objects by default. To access any
object, the securityadmin role must be explicitly granted the appropriate privilege by the object
owner or another role with the grant option.
A user can create managed access schemas to support current and future grants and ensure only
object owners can grant privileges to other roles. This is not true, as this contradicts the definition of
a managed access schema. In a managed access schema, object owners cannot grant privileges on
their objects to other roles, and only the schema owner or a role with the MANAGE GRANTS
privilege can do so.
Reference:
Overview of Access Control
A Functional Approach For Snowflake’s Role-Based Access Controls
Snowflake Role-Based Access Control simplified
Snowflake RBAC security prefers role inheritance to role composition
Overview of Snowflake Role Based Access Control
