SNOWFLAKE 数据库角色¶

ACCOUNT_USAGE 架构¶

ACCOUNT_USAGE 架构有四个已定义的 SNOWFLAKE 数据库角色，每个角色均被授予特定视图的 SELECT 权限。

READER_ACCOUNT_USAGE 架构¶

READER_USAGE_VIEWER SNOWFLAKE 数据库角色已被授予所有 READER_ACCOUNT_USAGE 视图的 SELECT 权限。由于阅读者账户由客户创建，READER_USAGE_VIEWER 角色预计会被授予那些用于监控阅读者账户使用情况的角色。

ORGANIZATION_USAGE 架构¶

ORGANIZATION_USAGE_VIEWER、ORGANIZATION_BILLING_VIEWER 和 ORGANIZATION_ACCOUNTS_VIEWER SNOWFLAKE 数据库角色被授予共享 SNOWFLAKE 数据库中 Organization Usage 视图的 SELECT 权限。

CORE 架构¶

CORE_VIEWER SNOWFLAKE 数据库角色被授予包含共享 SNOWFLAKE 数据库的所有 Snowflake 账户中的 PUBLIC 角色。USAGE 权限被授予所有 Snowflake 定义的函数和 CORE 架构中的捆绑包。

ALERT 架构¶

ALERT_VIEWER SNOWFLAKE 数据库角色被授予在此架构中定义的函数的 USAGE 权限。

ML 架构¶

The ML_USER SNOWFLAKE database role is granted to the PUBLIC role in all Snowflake accounts that contain a shared SNOWFLAKE database and allows customers to access and use ML functions. Users must also have the USAGE privilege on the ML schema to call these functions.

MONITORING 架构¶

MONITORING_VIEWER 数据库角色具有 MONITORING 架构中所有视图的 SELECT 权限。

MONITORING_VIEWER 数据库角色被授予包含共享 SNOWFLAKE 数据库的所有 Snowflake 账户中的 PUBLIC 角色。

SNOWFLAKE.CLASSIFICATION_ADMIN 数据库角色¶

The SNOWFLAKE.CLASSIFICATION_ADMIN database role allows a data engineer or steward to create an instance of the CLASSIFICATION_PROFILE class. A classification profile is used to implement automatic sensitive data classification.

SNOWFLAKE.CORTEX_EMBED_USER database role¶

This SNOWFLAKE.CORTEX_USER database role is used to grant customers access to Snowflake Cortex embedding functions AI_EMBED, SNOWFLAKE.CORTEX.EMBED_768, and SNOWFLAKE.CORTEX_EMBED_TEXT_1024 without granting access to other Cortex features. Calling these embedding functions requires either the SNOWFLAKE.CORTEX_USER database role or the SNOWFLAKE.CORTEX_EMBED_USER database role. This role is not granted to any roles by default.

By default, this role is not granted to any roles. If you want users to have access to the embedding functions, grant this database role to appropriate roles. For details, see Cortex LLM Functions required privileges

SNOWFLAKE.CORTEX_USER database role¶

This SNOWFLAKE.CORTEX_USER database role is used to grant customers access to Snowflake Cortex features. By default, this role is granted to the PUBLIC role. The PUBLIC role is automatically granted to all users and roles, so this allows all users in your account to use Snowflake Cortex LLM functions.

If you don't want all users to have this privilege, you can revoke access from the PUBLIC role and grant access to specific roles. For details, see Cortex LLM Functions required privileges.

SNOWFLAKE.COPILOT_USER 数据库角色¶

The SNOWFLAKE.COPILOT_USER database role allows customers to access Snowflake Copilot features. Initially, this database role is granted to the PUBLIC role. The PUBLIC role is automatically granted to all users and roles, so this allows all users in your account to use Snowflake Copilot. If you want to limit access to Snowflake Copilot features, you can revoke access from the PUBLIC role and grant access to specific roles. For details, see 访问控制要求.

使用 SNOWFLAKE 数据库角色¶

管理员可以使用 GRANT DATABASE ROLE 将一个 SNOWFLAKE 数据库角色分配给另一个角色，然后可以将其授予用户。这将允许用户访问 SNOWFLAKE 数据库中的视图的特定子集。

In the following example a role is created which can be used to view SNOWFLAKE database object metadata, and does the following:

1. 创建自定义角色。

2. 将 OBJECT_VIEWER 角色授予自定义角色。

3. 将自定义角色授予用户。

要创建并授予自定义角色，请执行以下操作：

1. 使用将用于授予对对象元数据的访问权限的 CREATE ROLE，来创建 CAN_VIEWMD 角色。

   只有拥有 USERADMIN 系统角色或更高角色的用户或拥有账户 CREATE ROLE 权限的其他角色才能创建角色。

   CREATE ROLE CAN_VIEWMD COMMENT = 'This role can view metadata per SNOWFLAKE database role definitions';
   

   Copy

2. 将 OBJECT_VIEWER 角色授予 CAN_VIEWMD 角色。

   只有拥有 OWNERSHIP 角色的用户可以授予 SNOWFLAKE 数据库角色。有关更多信息，请参阅 GRANT DATABASE ROLE。

   GRANT DATABASE ROLE OBJECT_VIEWER TO ROLE CAN_VIEWMD;
   

   Copy

3. 将 CAN_VIEWMD 角色分配给用户 smith。

   只有拥有 SECURITYADMIN 角色的用户可以将角色授予用户。有关其他选项，请参阅 GRANT ROLE。

   GRANT ROLE CAN_VIEWMD TO USER smith;
   

   Copy