Delineating user management from security and role management

In this recipe, we will be using Snowflake's built-in roles to isolate access for operational teams that create users and roles and security teams that manage and control the access rights. The USERADMIN Snowflake role provides privileges for creating and managing users without requiring a higher privilege as with SECURITYADMIN. Therefore, the USERADMIN role can be granted to the operations team responsible for onboarding and offboarding users to your Snowflake instance.

Getting ready

Before proceeding with this recipe, please ensure that the user you will modify can use the SECURITYADMIN role. Note that this recipe's steps can be run in either the Snowflake web UI or the SnowSQL command-line client.

How to do it…

We will create a new user to whom we will grant the USERADMIN role:

1. Create a new database that will be used to demonstrate privilege management:

   USE ROLE SYSADMIN;
   CREATE DATABASE...