Access control for cost anomalies¶

A cost anomaly occurs when daily consumption is above or below the expected range of consumption for the day. This topic describes the access control requirements for viewing and configuring cost anomalies, including anomaly monitors.

How access to cost anomalies works¶

Access works the same way for account-level anomalies, organization-level anomalies, and anomaly monitors. Two application roles set the baseline, and a third role controls access to consumption data in a currency.

Viewing anomalies and consumption

Either APP_USAGE_ADMIN or APP_USAGE_VIEWER lets a user view cost anomalies and investigate the consumption behind them, with credits as the unit of measure. Both roles grant the same viewing access.

Changing configuration

APP_USAGE_ADMIN adds the ability to change configuration in the account. That includes setting the account notification list, and creating, changing, and deleting anomaly monitors. A user with APP_USAGE_ADMIN doesn’t also need APP_USAGE_VIEWER.

Viewing consumption in a currency

Consumption data in a currency is more sensitive than credits, so it requires an additional role granted alongside APP_USAGE_ADMIN or APP_USAGE_VIEWER. The same role also controls the organization notification list, because those notifications can contain currency amounts.

Anomaly monitors always report credits or AI credits, never a currency, so this role doesn’t affect them.

The role that grants currency access depends on the type of account the user signs in to:

• In the organization account, grant ORGANIZATION_BILLING_VIEWER.
• In an ORGADMIN-enabled account, grant APP_ORGANIZATION_BILLING_VIEWER.

Regular accounts have access to neither the ORGANIZATION_USAGE schema nor a currency role, so users in a regular account always see consumption in credits.

Administrators with system roles¶

Administrators with the following system roles can perform all tasks related to identifying and investigating cost anomalies, both in Snowsight and by using the ANOMALY_INSIGHTS class. They don’t need any of the application roles described in this topic:

• ACCOUNTADMIN role in an ORGADMIN-enabled account or a regular account.
• GLOBALORGADMIN role in the organization account.

Application roles¶

You can let other users work with cost anomalies by granting the following application roles, which are within the SNOWFLAKE application.

Application roles for ANOMALY_INSIGHTS methods¶

The following table shows which application role lets a user call each method of the ANOMALY_INSIGHTS class. A user needs only one of the roles marked ✔ for a given method. An empty cell means the role can’t call the method. Methods marked (preview) belong to anomaly monitors.

In an ORGADMIN-enabled account, grant APP_ORGANIZATION_BILLING_VIEWER wherever this table lists ORGANIZATION_BILLING_VIEWER.

Note the following about how these roles apply:

• ADD_NOTIFICATION_INTEGRATION and REMOVE_NOTIFICATION_INTEGRATION require APP_USAGE_ADMIN to manage an integration for account-level anomalies, and a currency role to manage one for organization-level anomalies. Both also require privileges on the notification integration itself. For more information, see the method reference pages.
• Every anomaly monitor in an account is visible to anyone with APP_USAGE_VIEWER or APP_USAGE_ADMIN in that account. Monitors aren’t filtered per user, because a monitor’s results are aggregate cost data that these roles can already see.

Grant access to users¶

The following sections show how to combine these application roles for common cases.

Grant the ability to view cost anomalies in a specific account¶

If you want users to be able to view account-level cost anomalies in a specific account, but not act as an administrator, grant them the APP_USAGE_VIEWER application role.

For example, if you want user joe to be able to view cost anomalies for a specific account, sign in to the account, and then run the following commands:

USE ROLE ACCOUNTADMIN;

CREATE ROLE anomaly_viewer_role;
GRANT APPLICATION ROLE SNOWFLAKE.APP_USAGE_VIEWER TO ROLE anomaly_viewer_role;
GRANT ROLE anomaly_viewer_role TO USER joe;

Grant the ability to view cost anomalies for all accounts¶

To let a user view account-level cost anomalies for all accounts in the organization and to view organization-level anomalies, grant the APP_USAGE_VIEWER role and one of the following roles:

• If the user signs in to the organization account to view cost anomalies, also grant the ORGANIZATION_BILLING_VIEWER application role.
• If the user signs in to an ORGADMIN-enabled account to view cost anomalies, also grant the APP_ORGANIZATION_BILLING_VIEWER application role.

A user who is granted these roles can see consumption data with a currency as the unit of measure instead of credits.

For example, if the user ralph signs in to the organization account to view cost anomalies that are related to the entire organization, run the following commands:

USE ROLE ACCOUNTADMIN;

CREATE ROLE anomaly_viewer_role;
GRANT APPLICATION ROLE SNOWFLAKE.APP_USAGE_VIEWER TO ROLE anomaly_viewer_role;
GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_BILLING_VIEWER TO ROLE anomaly_viewer_role;
GRANT ROLE anomaly_viewer_role TO USER ralph;

Grant the ability to configure cost anomalies in a specific account¶

If you want users to be able to view and configure account-level cost anomalies within a specific account, grant them the APP_USAGE_ADMIN application role. A user with this role doesn’t need the APP_USAGE_VIEWER role to view the cost anomalies. Configuring cost anomalies includes adding the email addresses where notifications are sent when there is an anomaly in the account, and managing anomaly monitors.

For example, if you want user judy to be able to view and configure account-level cost anomalies for a specific account, sign in to the account, and then run the following commands:

USE ROLE ACCOUNTADMIN;

CREATE ROLE anomaly_admin_role;
GRANT APPLICATION ROLE SNOWFLAKE.APP_USAGE_ADMIN TO ROLE anomaly_admin_role;
GRANT ROLE anomaly_admin_role TO USER judy;

Grant the ability to configure organization-level cost anomalies¶

To let a user configure organization-level cost anomalies, grant the APP_USAGE_ADMIN role and one of the following roles:

• If the user signs in to the organization account to configure and view cost anomalies, also grant the ORGANIZATION_BILLING_VIEWER application role.
• If the user signs in to an ORGADMIN-enabled account to configure and view cost anomalies, also grant the APP_ORGANIZATION_BILLING_VIEWER application role.

An administrator with one of these role combinations can perform the following tasks:

• Set and view the email addresses where notifications are sent for organization-level anomalies.
• View account-level cost anomalies in all accounts in the organization.
• View organization-level cost anomalies.
• View consumption data that uses a currency as the unit of measure.

For example, if the user steven signs in to the organization account to work with cost anomalies related to the entire organization, run the following commands:

USE ROLE ACCOUNTADMIN;

CREATE ROLE anomaly_admin_role;
GRANT APPLICATION ROLE SNOWFLAKE.APP_USAGE_ADMIN TO ROLE anomaly_admin_role;
GRANT APPLICATION ROLE SNOWFLAKE.ORGANIZATION_BILLING_VIEWER TO ROLE anomaly_admin_role;
GRANT ROLE anomaly_admin_role TO USER steven;

Grant the ability to scope an anomaly monitor with tags¶

Defining an anomaly monitor requires APP_USAGE_ADMIN, plus the APPLYBUDGET privilege on each tag used in the monitor’s scope. APPLYBUDGET is the same privilege that budgets require, and Snowflake doesn’t define a separate privilege for anomaly monitors.

For example, to let the role anomaly_admin_role use the cost_center tag when defining a monitor:

USE ROLE ACCOUNTADMIN;

GRANT APPLYBUDGET ON TAG it.warehouse_management.cost_center TO ROLE anomaly_admin_role;

Note the following about how APPLYBUDGET interacts with the application roles:

• APPLYBUDGET only grants the authority to name a tag in a monitor’s scope. It doesn’t grant access to consumption data for the resources that carry the tag.
• Access to a monitor’s results is always evaluated against the application role of the user reading them, not the privileges of the user who created the monitor.
• The privilege is checked when you create the tag reference. If you don’t hold APPLYBUDGET on a tag, SYSTEM$REFERENCE fails before the monitor method runs.
• APPLYBUDGET applies only to saving a monitor. ANOMALY_INSIGHTS!ADHOC_CALCULATE_ANOMALIES_FROM_CONFIG, which tests a configuration without saving it, names tags directly and doesn’t require the privilege.

Access to cost anomaly views¶

The application roles in this topic control the ANOMALY_INSIGHTS class methods and Snowsight. Querying the cost anomaly views directly requires database roles instead:

• ANOMALIES_DAILY view requires a database role with read access to the ACCOUNT_USAGE schema, such as USAGE_VIEWER.
• ANOMALIES_IN_CURRENCY_DAILY view contains currency data and requires ORGANIZATION_BILLING_VIEWER.

Anomaly monitor results aren’t available in either schema. To retrieve them, use ANOMALY_INSIGHTS!GET_MONITOR_ANOMALIES.