User & Security DDL¶

User Management¶

Each user with access to Snowflake is represented by a user object. A user object stores all of the information about the user, including their login name, password, and defaults (role, virtual warehouse, and namespace). Use the following DDL commands to manage users in the system:

• CREATE USER

• ALTER USER

• DROP USER

• DESCRIBE USER

• SHOW USERS

Role Management¶

Snowflake uses roles to control access to objects in the system:

• Roles are granted access privileges for objects in the system (databases, tables, etc.).

• Roles are granted to users to enable them to create, modify, and use the objects for which the roles have privileges.

• Roles can be granted to other roles to support defining hierarchical access privileges.

Use the following DDL commands to manage roles in the system:

• CREATE ROLE

• ALTER ROLE

• DROP ROLE

• SHOW ROLES

Use the following DDL commands to manage database roles in the system:

• CREATE DATABASE ROLE

• ALTER DATABASE ROLE

• DROP DATABASE ROLE

• SHOW DATABASE ROLES

Use the following command to activate a primary role or secondary roles within a user session:

• USE ROLE

• USE SECONDARY ROLES

Object Tagging Management¶

Snowflake supports the following DDL to create and manage tags:

• CREATE TAG

• ALTER TAG

• ALTER <object> (to set a tag on a Snowflake object)

• SHOW TAGS

• DROP TAG

• UNDROP TAG

Note that Snowflake does not support the describe operation for the tag object.

Access Control Management¶

Use the following commands to manage access control for objects by granting (and revoking) object privileges to roles and granting roles to users and other roles:

• GRANT <privileges>

• REVOKE <privileges>

• GRANT <privilege> … TO SHARE

• REVOKE <privilege> … FROM SHARE

• GRANT DATABASE ROLE … TO SHARE

• REVOKE DATABASE ROLE … FROM SHARE

• GRANT OWNERSHIP

• GRANT ROLE

• GRANT DATABASE ROLE

• REVOKE ROLE

• REVOKE DATABASE ROLE

• SHOW GRANTS

Network Policy Management¶

A network policy supports restricting access to your account based on user IP address. Use the following commands to create, alter, or drop network policies:

• ALTER NETWORK POLICY

• CREATE NETWORK POLICY

• DESCRIBE NETWORK POLICY

• DROP NETWORK POLICY

• SHOW NETWORK POLICIES

Secret Management¶

Snowflake supports the following DDL commands and operations to manage secrets:

• CREATE SECRET

• ALTER SECRET

• DROP SECRET

• SHOW SECRETS

• DESCRIBE SECRET

Password Policy Management¶

Snowflake provides the following DDL commands to manage password policy objects:

• CREATE PASSWORD POLICY

• ALTER PASSWORD POLICY

• DROP PASSWORD POLICY

• SHOW PASSWORD POLICIES

• DESCRIBE PASSWORD POLICY

Session Policy Management¶

Snowflake provides the following DDL commands to manage session policy objects:

• CREATE SESSION POLICY

• ALTER SESSION POLICY

• DROP SESSION POLICY

• SHOW SESSION POLICIES

• DESCRIBE SESSION POLICY

Third-Party Integrations¶

An integration is a Snowflake object that provides an interface between Snowflake and third-party services. Use the following commands to create, alter, or drop integrations: