page271
359
Role-Based Access Control
When implemented optimally, Snowflake role-based access control (RBAC) provides an
excellent approach to securing objects, attributes, and data. When poorly implemented
by nesting several layers of roles, performance issues arise due to the optimizer drilling
down through each layer and through view definitions to determine object access
entitlement.
Snowflake provides core administrative roles that may be wrapped for both single-
tenant and multitenant environments, a practice discussed in Maturing the Snowflake
Data Cloud. In addition to the Snowflake-supplied roles, you should define separate
roles for the following:
•
Application-owned objects
•
Data manipulation in application objects
Segregating object ownership from object usage is critical. Each logical grouping
of objects should have its own ownership role. Furthermore, you should implement
data manipulation (or object usage) roles according to their function, as shown in
Figure 10-1.
Figure 10-1.
Data manipulation roles
These are the application roles:
•
ELT role: Used to ingest data into our application; scope is limited to
staging/raw table population and triggering functionality to begin the
curation process.
•
Core role: Used to perform all curation activity to build our data
products in preparation for presentation.
ChapTer 10
OpTimizing perfOrmanCe