组织账户¶

组织账户可用功能¶

本节介绍组织账户中可用的功能。

有关每项功能的详细信息，请参阅以下部分：

• 优质视图

• 组织用户和用户组

Compliance considerations for hybrid organizations¶

An organization can have accounts in both regulated regions and non-regulated regions. For example, an organization can have one account in a U.S. SnowGov Region and another in a commercial region. These organizations are called hybrid organizations.

Features associated with an organization account might result in metadata moving from one region to another. For example, premium views might move associated metadata from a regular account's region to the region of the organization account. Metadata associated with an organization-level object --- for example, an organization user --- might move from the region of the organization account to the region of an account that imports the object. For hybrid organizations, this means that metadata might move between a regulated region and a non-regulated region.

If you have a hybrid organization, Snowflake recommends the following actions:

• Create your organization account in the regulated region.

• Don't define an organization-level object with sensitive or regulated data.

Compliance standards, such as FedRAMP, and support for different regulated workloads, such as ITAR, might be different or unavailable outside of your U.S. SnowGov Region. Consider your compliance requirements before choosing to move or share data between Snowflake regions.

关于管理员角色和可分配的权限¶

组织管理员在组织账户中使用 GLOBALORGADMIN 角色来执行所有组织级任务，包括管理组织账户本身。

同时，GLOBALORGADMIN 角色可以将权限分配给其他角色，让其他用户执行组织级任务。在组织账户中，GLOBALORGADMIN 角色可以分配以下权限：

• APPLY TAG

• MANAGE ACCOUNTS

• MANAGE LISTING AUTO FULFILLMENT

• MANAGE ORGANIZATION CONTACTS

• MANAGE ORGANIZATION TERMS

• PURCHASE DATA EXCHANGE LISTING

这些权限均是在账户级别设置的。例如，要向 custom_role 角色分配 MANAGE ACCOUNTS 权限，执行以下操作：

USE ROLE GLOBALORGADMIN;

GRANT MANAGE ACCOUNTS ON ACCOUNT TO ROLE custom_role;

有关这些权限的更多信息，请参阅 访问控制权限。

创建组织账户¶

Before create the organization account, consider the following details:

• If your organization includes an account in a U.S. SnowGov Region, Snowflake recommends creating the organization account in this regulated region. For more information about the implication of having an organization with both regulated and non-regulated accounts, see Compliance considerations for hybrid organizations.

• 创建组织账户会导致向 ORGANIZATION_USAGE 架构填充数据，这会为您的组织 产生额外费用。

要创建组织账户，请执行以下操作：

1. 选择一个现有账户，从中创建组织账户。该现有账户的 ORGADMIN 角色已启用。

2. 登录您用于创建组织账户的账户。

3. 切换到 ORGADMIN 角色。例如：

   USE ROLE ORGADMIN;
   

   Copy

4. 执行 CREATE ORGANIZATION ACCOUNT 命令。例如：

   CREATE ORGANIZATION ACCOUNT myorgaccount
       ADMIN_NAME = admin
       ADMIN_PASSWORD = 'TestPassword1'
       EMAIL = 'myemail@myorg.org'
       MUST_CHANGE_PASSWORD = true
       EDITION = enterprise;
   

   Copy

删除组织账户¶

如果您想在多账户组织中删除组织账户，请联系 Snowflake 支持部门。

将组织账户移至其他区域¶

只要区域位于 PUBLIC 区域组或 VPS 区域组，您就可以在区域之间移动组织账户。

Snowflake 使用复制组将对象从源区域的组织账户移动到新区域的组织账户。因此，只有可以复制的对象才能使用组织账户进行移动，并且会产生与移动相关的复制成本。有关可以随组织账户一起移动的对象列表，请参阅 复制对象。

将组织账户移至其他区域，需执行以下两个步骤：

1. 调用组织账户中的 SYSTEM$INITIATE_MOVE_ORGANIZATION_ACCOUNT 函数来启动移动过程。Snowflake 开始将对象复制到新区域。

   该函数接受临时账户名称、新区域和要移动的对象列表作为其实参。例如：

   CALL SYSTEM$INITIATE_MOVE_ORGANIZATION_ACCOUNT(
     'MY_TEMP_NAME',
     'aws_us_west_2',
     'ALL');
   

   Copy

2. 如果已经确认组织账户中的数据已成功复制到新区域，请调用 SYSTEM$COMMIT_MOVE_ORGANIZATION_ACCOUNT 函数来完成移动，并指定一个宽限期，在此宽限期之后将删除原始组织账户。

   例如，调用以下函数完成移动，并指定源区域中原始组织账户将在 14 天后被删除。

   CALL SYSTEM$COMMIT_MOVE_ORGANIZATION_ACCOUNT(14);
   

   Copy

您可以随时通过调用 SYSTEM$SHOW_MOVE_ORGANIZATION_ACCOUNT_STATUS 函数来查看尝试移动组织账户的状态。

限制¶

当前不支持与组织账户之间的双向复制。