A comprehensive guide to implementing Snowflake's 3-Tier Role-Based Access Control (RBAC) architecture. Covers core governance principles (least privilege, separation of duties, mandatory hierarchy rollup), the distinction between Access Roles (AR_) and Functional Roles (FR_), Database Roles, service account hardening with RSA key auth and IP network policies, and governing Snowflake Cortex AI function access. Includes SQL examples for each pattern, 14 critical security pitfalls to avoid, and a hybrid IaC strategy using Terraform for foundational infrastructure and Snowflake DCM Projects for rapidly evolving objects, both automated via GitHub Actions.
Table of contents
Core Principles of Snowflake GovernanceThe 3-Tier Role Architecture PatternAccess Roles vs. Functional Roles in SQLWhat About Database Roles ( DR_ )?Hardening Non-Human Identities (Service Roles)Managing AI & Cortex Access via Roles14 Critical Snowflake Security Pitfalls to AvoidManaging Governance as Code: SQL vs. Terraform vs. DCM ProjectsGet Eylon Steiner’s stories in your inboxImplementation Checklist40 Impressions