1. Managing Custom Roles When a custom role is first created, it exists in isolation. The role must be assigned to any users who will use the object privileges associated with the role. The custom role must also be granted to any roles that will manage the objects created by the custom role. Important By default, not even the ACCOUNTADMIN role can modify or drop objects created by a custom role. The custom role must be granted to the ACCOUNTADMIN role directly or, preferably, to another role in a hierarchy with the SYSADMIN role as the parent. The SYSADMIN role is managed by the ACCOUNTADMIN role. Aligning Object Access with Business Functions Consider taking advantage of role hierarchies to align access to database objects with business functions in your organization. In a role hierarchy, roles are granted to other roles to form an inheritance relationship. Permissions granted to roles at a lower level are inherited by roles at a higher level. For optimal flexibility in controlling access to database objects, create a combination of object access roles with different permissions on objects and assign them as appropriate to functional roles: Grant permissions on database objects or account objects (such as warehouses) to access roles. Grant access roles to functional roles to create a role hierarchy. These roles correspond to the business functions of your organization and serve as a catch-all for any access roles required for these functions. When appropriate, grant lower-level functional roles to higher-level functional roles in a parent-child relationship where the parent roles map to business functions that should subsume the permissions of the child roles.

2. Example As a simple example, suppose two databases in an account, fin and hr, contain payroll and employee data, respectively. Accountants and analysts in your organization require different permissions on the objects in these databases to perform their business functions. Accountants should have read-write access to fin but might only require read-only access to hr because human resources personnel maintain the data in this database. Analysts could require read-only access to both databases. Contact us +91-9989971070. Register now for Snowflake Online Training Visit: https://www.visualpath.in/snowflake-online-training.html