GRANT OWNERSHIP: Transferring ownership of owner-executed objects requires the target role to be active in the current session or the executing role to have MANAGE GRANTS (Disabled by default)¶

When you transfer ownership of an object using GRANT OWNERSHIP, Snowflake now enforces an additional authorization check on the target role.

This change applies only to ownership transfers of owner-executed objects, such as views, procedures, functions, tasks, and policies. For the complete list of affected object types, see Stricter authorization for ownership transfer of owner-executed objects. GRANT OWNERSHIP on other object types, such as tables, schemas, databases, sequences, and stages, is not affected.

Before the change:

GRANT OWNERSHIP ON <object_type> <object_name> TO ROLE <target_role> succeeded regardless of whether <target_role> was activated in the current session.

After the change:

GRANT OWNERSHIP on an affected object type succeeds only if one of the following conditions is met:

• The target role is activated in the current session (that is, it appears in the output of CURRENT_AVAILABLE_ROLES).
• The executing role has account-level MANAGE GRANTS privilege.

If neither condition is met, Snowflake returns the following error:

SQL compilation error: <object_domain> ownership can only be transferred to a role
that is activated in the current session or by a role with account-level MANAGE GRANTS.

This change is being made to prevent unintended privilege escalation by restricting ownership transfers to roles that the executing user is authorized to act on behalf of.

Ref: 2395