snowflake-enterprise-rbac

name	snowflake-enterprise-rbac
description	Configure Snowflake enterprise RBAC with system roles, custom role hierarchies, SSO/SCIM integration, and least-privilege access patterns. Use when implementing role-based access control, configuring SSO with SAML/OIDC, or setting up organization-level governance in Snowflake. Trigger with phrases like "snowflake RBAC", "snowflake roles", "snowflake SSO", "snowflake SCIM", "snowflake permissions", "snowflake access control".
allowed-tools	Read, Write, Edit
version	1.5.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","data-warehouse","analytics","snowflake"]
compatibility	Designed for Claude Code

Snowflake Enterprise RBAC

Overview

Configure enterprise-grade access control using Snowflake's system-defined roles, custom role hierarchies, SSO via SAML/OIDC, and SCIM for automated user provisioning.

Snowflake System Roles

Role	Purpose	Use For
ACCOUNTADMIN	Top-level admin	Billing, resource monitors, replication
SECURITYADMIN	Security management	Users, roles, grants, network policies
SYSADMIN	Object management	Databases, warehouses, schemas, tables
USERADMIN	User management	Create users and roles
PUBLIC	Default for all users	Minimal access, applied automatically

Best Practice: Never use ACCOUNTADMIN as a default role. Create custom roles and grant them to SYSADMIN.

Instructions

Step 1: Design Custom Role Hierarchy

-- Functional roles (what people do)
CREATE ROLE DATA_ENGINEER;
CREATE ROLE DATA_ANALYST;
CREATE ROLE DATA_SCIENTIST;
CREATE ROLE BI_VIEWER;
CREATE ROLE APP_SERVICE;         -- Service accounts

-- Access roles (what they can access)
CREATE ROLE RAW_DATA_READER;
CREATE ROLE CURATED_DATA_READER;
CREATE ROLE CURATED_DATA_WRITER;
CREATE ROLE GOLD_DATA_READER;

-- Role hierarchy (bottom-up)
--   BI_VIEWER → GOLD_DATA_READER
--   DATA_ANALYST → CURATED_DATA_READER + GOLD_DATA_READER
--   DATA_SCIENTIST → DATA_ANALYST + RAW_DATA_READER
--   DATA_ENGINEER → all access roles
--   All custom roles → SYSADMIN

GRANT ROLE GOLD_DATA_READER TO ROLE BI_VIEWER;
GRANT ROLE CURATED_DATA_READER TO ROLE DATA_ANALYST;
 ROLE GOLD_DATA_READER  ROLE DATA_ANALYST;
 ROLE DATA_ANALYST  ROLE DATA_SCIENTIST;
 ROLE RAW_DATA_READER  ROLE DATA_SCIENTIST;
 ROLE RAW_DATA_READER  ROLE DATA_ENGINEER;
 ROLE CURATED_DATA_READER  ROLE DATA_ENGINEER;
 ROLE CURATED_DATA_WRITER  ROLE DATA_ENGINEER;
 ROLE GOLD_DATA_READER  ROLE DATA_ENGINEER;


 ROLE DATA_ENGINEER  ROLE SYSADMIN;
 ROLE DATA_ANALYST  ROLE SYSADMIN;
 ROLE DATA_SCIENTIST  ROLE SYSADMIN;
 ROLE BI_VIEWER  ROLE SYSADMIN;
 ROLE APP_SERVICE  ROLE SYSADMIN;