Create a new role or replace an existing role in the system.
After creating roles, you can grant object privileges to the role and then grant the role to other roles or individual users to enable access control security for objects in the system.
- See also:
GRANT <privileges>, GRANT ROLE , GRANT OWNERSHIP , DROP ROLE , ALTER ROLE , SHOW ROLES
CREATE [ OR REPLACE ] ROLE [ IF NOT EXISTS ] <name> [ [ WITH ] TAG ( <tag_name> = '<tag_value>' [ , <tag_name> = '<tag_value>' , ... ] ) ] [ COMMENT = '<string_literal>' ]
Identifier for the role; must be unique for your account.
The identifier must start with an alphabetic character and cannot contain spaces or special characters unless the entire identifier string is enclosed in double quotes (e.g.
"My object"). Identifiers enclosed in double quotes are also case-sensitive.
For more details, see Identifier Requirements.
TAG tag_name = 'tag_value' [ , tag_name = 'tag_value' , ... ]
Specifies the tag name and the tag string value.
The tag value is always a string, and the maximum number of characters for the tag value is 256.
For details about specifying tags in a statement, refer to Tag Quotas for Objects & Columns.
COMMENT = 'string_literal'
Specifies a comment for the role.
Default: No value
Access Control Requirements¶
A role used to execute this SQL command must have the following privileges at a minimum:
Only the USERADMIN role, or a higher role, has this privilege by default. The privilege can be granted to additional roles as needed.
For instructions on creating a custom role with a specified set of privileges, see Creating Custom Roles.
For general information about roles and privilege grants for performing SQL actions on securable objects, see Overview of Access Control.
Customers should ensure that no personal data (other than for a User object), sensitive data, export-controlled data, or other regulated data is entered as metadata when using the Snowflake service. For more information, see Metadata Fields in Snowflake.
CREATE OR REPLACE <object> statements are atomic. That is, when the object is replaced, the old object deletion and the new object creation are processed in a single transaction.
CREATE ROLE myrole;