SnowPro® Advanced: Security Engineer key terms

A model where privileges are granted to roles rather than directly to users, and users receive privileges by being assigned roles. In Snowflake, roles form a hierarchy and are the primary unit of authorization.

The tree of roles in an account where a child role inherits all privileges granted to roles beneath it. A user's active role determines which privileges from the hierarchy are in effect.

The single role a session is actively using at a given moment. Only privileges granted to that role and the roles below it in the hierarchy apply to the session's operations.

The most powerful built-in system role, able to manage billing, account-level settings, and all objects. Snowflake recommends limiting its use and granting narrower roles for routine work.

The built-in system role intended to own and manage warehouses and databases. Custom roles that create objects are typically granted to SYSADMIN so administrators retain oversight.

The built-in system role that manages users, roles, and grants, including the MANAGE GRANTS privilege. It sits above USERADMIN in the default hierarchy.

A built-in system role limited to creating and managing users and roles. It provides a least-privilege way to handle identity administration without granting broad account control.

A specific permitted action on an object, such as SELECT on a table or USAGE on a warehouse. Privileges are granted to roles and are the atomic units of authorization.

The act of assigning a privilege on an object to a role, or assigning a role to a user or another role. Grants can be revoked and are visible through SHOW GRANTS commands.

Grants that automatically apply to objects created later in a schema or database, so new tables or views inherit intended access without manual re-granting.

A schema where object owners cannot grant privileges themselves; only the schema owner or a role with MANAGE GRANTS can. This centralizes control over who can share data.

A global privilege that lets a role grant or revoke privileges on any object, regardless of ownership. It effectively bypasses ownership checks and should be tightly restricted.

Authentication where Snowflake trusts an external identity provider to verify users, via SAML 2.0 or OAuth. Credentials are validated by the IdP, and Snowflake consumes the resulting assertion or token.

A configuration where users authenticate once with a corporate identity provider and gain access to Snowflake without a separate password. It typically relies on SAML federation.

An XML-based federation standard Snowflake supports for SSO. The identity provider issues a signed assertion describing the user, which Snowflake validates to establish a session.

A token-based authorization framework Snowflake supports for delegated access, commonly used by integrations and client applications. Access tokens are issued by an authorization server and validated by Snowflake.

A passwordless method where the client signs a challenge with a private key and Snowflake verifies it with the registered public key. Often used for service accounts and automated tools.

Requiring a second proof of identity beyond a password, such as a one-time code from an authenticator app. Snowflake supports MFA and can enforce it for users or the whole account.

Account-level rules governing password length, complexity, and reuse that Snowflake enforces for password-based users. Policies can be attached to the account or to individual users.

The external system that authenticates users and issues assertions or tokens trusted by Snowflake. Examples include Okta, Azure AD, and other SAML or OAuth-compatible services.

An integration where Snowflake accepts access tokens issued by a third-party authorization server, mapping token claims to a Snowflake role. It enables programmatic access without storing Snowflake credentials.

Attaching key-value labels to objects such as tables or columns. Tags support classification, cost tracking, and can drive masking or row access policies.

A masking policy associated with a tag rather than individual columns. Any column assigned that tag is automatically masked, simplifying protection of sensitive data at scale.

A policy that rewrites column values at query time based on the querying role, so unauthorized users see masked results while stored data remains unchanged.

A schema-level object containing the logic that determines what value a column returns for a given role or condition. It is applied to columns and evaluated per query.

A policy that filters which rows a role can see from a table or view, evaluated at query time. It enforces row-level security without duplicating data.

Controlling access to individual columns rather than whole tables, typically through masking policies or by exposing only selected columns in views.

A view whose definition is hidden from users who query it, preventing them from seeing underlying logic or bypassing protections. Often used to expose filtered or masked data safely.

Protecting stored data by encrypting it on disk. Snowflake encrypts data with AES-256 and manages keys hierarchically so data is unreadable without proper keys.

Protecting data while it moves between clients and Snowflake or between internal components, using TLS. It prevents eavesdropping or tampering on the network path.

A Snowflake feature that combines a Snowflake-managed key with a customer-managed key in a cloud key service, so data cannot be decrypted without both. It gives customers control over key revocation.

An encryption key the customer creates and controls in a cloud KMS rather than Snowflake. It enables independent key lifecycle control and the ability to revoke access to data.

Periodically replacing encryption keys with new ones to limit the impact of a compromised key. Snowflake rotates its internal keys, and customers rotate their own KMS keys.

An account or user-level rule that allows or blocks connections by IP address range. It restricts where users and services can connect from.

A reusable object that defines lists of IP addresses or cloud endpoints. Network rules are referenced by network policies and by external access integrations.

Connecting to Snowflake over a private network path such as AWS PrivateLink or Azure Private Link rather than the public internet, reducing exposure.

A Snowflake object that lets code such as UDFs or procedures reach approved external endpoints, governed by network rules. It limits outbound traffic to explicitly allowed destinations.

Snowflake views that record which columns and objects were read by queries, supporting audit and compliance reporting on data access.

A shared schema containing account-level views of query history, logins, grants, and storage, used for monitoring and auditing activity across the account.

A schema in each database exposing metadata about its objects and, in some cases, views of query and usage history scoped to that database.

The record of security-relevant events such as logins, grants, and queries, used to investigate incidents and demonstrate compliance. Snowflake exposes this through account usage views and login history.

A view recording authentication attempts, including successes and failures, client details, and reported errors. It helps detect credential attacks and access anomalies.