Inherited grants and container-level MANAGE GRANTS in Snowflake (GA)

Inherited grants and container-level grant administration are now generally available. These features allow you to define privileges on current and future objects with a single command and delegate grant administration for specific databases or schemas without requiring account-wide access.

Use cases

Imagine you need to ensure an analyst role can read all current and future tables in a schema, without manually maintaining individual rules or future grants. With this feature, you define access once at the container level, and it propagates automatically.

• Grant uniform privileges across all current and future objects of a type in a container automatically.
• Delegate grant administration for a database or schema to a specific role.
• Reduce grant record proliferation and simplify role hierarchies.

How to use

Both features are opt-in and must be enabled at the account level. You can turn them on by running the account alteration command:

ALTER ACCOUNT SET FEATURE_RBAC_INHERITED_GRANTS = 'ENABLED';

What happens in this code:

1. The account parameter FEATURE_RBAC_INHERITED_GRANTS is set to enabled.
2. The command enables both inherited grants and container-level MANAGE GRANTS.

To apply an inherited grant on all tables in a schema to a role:

GRANT INHERITED SELECT ON ALL TABLES
  IN SCHEMA prod.analytics
  TO ROLE analyst_role;

What happens in this code:

1. The INHERITED keyword specifies that the rule applies to both existing and future objects.
2. The SELECT privilege is granted for all tables within the prod.analytics schema.
3. The analyst_role receives immediate and automatic access to any new table created later in that schema.

Limitations and requirements

• Both features are opt-in and must be enabled per account.
• Requires MANAGE GRANTS on the target container or a higher container.
• Inherited grants on executable objects (such as procedures and functions) should be reviewed carefully, as they may allow executing code with the owner's privileges.