System-defined roles (ACCOUNTADMIN, SYSADMIN, etc.) in Snowflake - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the ACCOUNTADMIN role in Snowflake?

ACCOUNTADMIN is the highest-level system-defined role in Snowflake. It has full control over all objects and operations in the account, including managing users, roles, and billing.

beginner

What permissions does the SYSADMIN role have in Snowflake?

SYSADMIN can create and manage databases, schemas, and warehouses. It has full control over data objects but cannot manage users or roles unless granted additional privileges.

beginner

Which Snowflake system-defined role is responsible for managing users and roles?

The SECURITYADMIN role manages users, roles, and grants. It controls access and security policies but does not manage data objects directly.

beginner

True or False: The PUBLIC role in Snowflake has no privileges by default.

False. The PUBLIC role has some default privileges granted by Snowflake, such as USAGE on the SNOWFLAKE database and certain schemas. It is assigned to every user by default and can have additional privileges granted to it, which all users inherit.

intermediate

Why should the ACCOUNTADMIN role be used sparingly?

Because ACCOUNTADMIN has full control over the entire Snowflake account, using it sparingly reduces the risk of accidental or malicious changes that could affect security or operations.

Which Snowflake role can create warehouses and databases but cannot manage users by default?

A SECURITYADMIN

B ACCOUNTADMIN

C SYSADMIN

D PUBLIC

SYSADMIN manages data objects like warehouses and databases but does not manage users or roles unless granted extra privileges.

Who has the highest level of control in a Snowflake account?

A ACCOUNTADMIN

B SECURITYADMIN

C PUBLIC

D SYSADMIN

ACCOUNTADMIN is the top-level role with full control over all account operations.

Which role manages user access and role grants in Snowflake?

A PUBLIC

B SYSADMIN

C ACCOUNTADMIN

D SECURITYADMIN

SECURITYADMIN manages users, roles, and grants to control access.

What is true about the PUBLIC role in Snowflake?

A It is assigned to every user by default.

B It can manage warehouses.

C It has no privileges and cannot be assigned.

D It is the highest privilege role.

PUBLIC is assigned to all users by default and can have privileges granted to it.

Why is it important to limit use of ACCOUNTADMIN role?

A It has limited privileges.

B It has full control and misuse can cause serious issues.

C It can only view data.

D It cannot manage users.

ACCOUNTADMIN has full control, so limiting its use helps protect the account from mistakes or attacks.

Explain the main responsibilities of the ACCOUNTADMIN, SYSADMIN, and SECURITYADMIN roles in Snowflake.

Think about who controls data, who controls users, and who controls everything.

Why should the PUBLIC role be carefully managed even though it is assigned to all users by default?

Consider the impact of privileges given to everyone.