Skip to content

Role

Snowflake Docs - CREATE ROLE

Snowflake Docs - ALTER ROLE

Usage

  • Role name = file name of role yml config

Limiations

  • Currently does not support the REMOVAL of child roles. If a child role is removed from the list, the deployer will NOT automatically remove relationship in Snowflake. Future roadmap item.

Environment Config

  • Use the ENV_ROLE_PREFIX in the environment config file to specify a prefix for ALL roles within an environment.
  • If the role filename is INGEST.yml and the ENV_ROLE_PREFIX is "PROD_", the role name will compile to "PROD_INGEST"
  • See Setup/Config for additional details & examples

Snowflake Attributes

Parameter
 Description
COMMENT (String) - Optional
OWNER (String) - Optional
  • If HANDLE_OWNERSHIP=ERROR, be careful not to set OWNER to a role that the deployer does not have access to as it will no longer have access to manage
CHILD_ROLES (String) - Optional
  • List of child roles that should be granted to this role.
TAGS ({KEY:VALUE}) - Optional
GRANTS ({KEY:VALUE}) - Optional

Optional Parameter Defaults - if omitted, Snowflake defaults for parameters are used, just like creating an object manually.

Deployment attributes

Parameter
 Description
DEPLOY_ENV (List) - Optional
  • Default = []
  • List of the deployment environments to deploy to
  • Deployment environment set in the environment config yaml using the DEPLOY_ENV parameter. See Setup/Config for docs.
  • When empty or not included, deployed to all environments
DEPLOY_LOCK (Bool) - Optional
  • Default = False
  • Locks the config file to being over written by reverse engineer process.
  • Use if source code should always be source of truth and any changes pulled from database should be ignored

Folder Structure

snowflake/instance/roles/[role name].yml

Example Structure

snowflake/instance/roles/ANALYST.yml

snowflake/instance/roles/ADMIN.yml

This creates 2 roles named "ANALYST" and "ADMIN" each with their own yml file.

Samples

Basic 

OWNER: INSTANCEADMIN
COMMENT: Test compute resources
CHILD_ROLES: 
- {{role('CHILD_ROLE')}}
- CUSTOMROLE
TAGS:
- {{ref('CONTROL__GOVERNANCE__ENV')}}: PROD

With a deploy lock & restricted deployment environments.

OWNER: INSTANCEADMIN
COMMENT: Test compute resources
CHILD_ROLES: 
- {{role('CHILD_ROLE')}}
- CUSTOMROLE
TAGS:
- {{ref('CONTROL__GOVERNANCE__ENV')}}: PROD
DEPLOY_LOCK: true
DEPLOY_ENV:
- PROD
- TEST