Smart Access Control in Snowflake

Introduction

For any data platform, data organization and security must be treated with utmost importance. While maintaining and managing data efficiently is crucial, security ensures the right access levels by enforcing the Principle of Least Privilege so users operate within minimum necessary limits.

Snowflake, as a sophisticated data platform, treats security as an empowerment feature for platform users. Customers beginning their data journey often wonder about privilege distribution and how Snowflake handles access isolations in diverse workspaces.

RBAC

Role-based Access Control is an authorization framework in Snowflake that enables administrators to limit or channel appropriate permission levels based on:

• A person's role (persona), or
• An application

Examples include Data Engineer, Manager, or data integration platform/application roles.

ABAC

Attribute-based Access Control evaluates an attribute or combination of attributes associated with a person, rather than their job role, to execute granted operations. Common user attributes include position, department, and security clearance.

Example: User 'Tony Stark', the 'Manager' of the 'IT' department is allowed 'select' access on 'Innovations Table in Org Database' as long as he has 'security clearance'.

Roles

Roles are controlling factors that enforce and drive data, object, and account access control for organizations and their associates. There are two types:

1. System roles (or Super roles) have functional plus extra privileges mostly forbidden for custom roles
2. Custom roles are user-defined or user-created roles

Row-level security

Row-level security (RLS) in Snowflake is fulfilled by the 'Row Access Policy' feature. This policy controls dataset accessibility on relational objects (tables or views) based on:

• Current session role in Snowflake session
• Filter condition (record selection criteria)
• Other rules set in a separate mapping table

RLS is responsible for Segregation of Duties (SoD) and granular governance from an administration standpoint in centralized or decentralized manner.

RBAC versus ABAC – a concept (reality) check

Consider these essential questions about Snowflake's security framework:

• Does Snowflake allow organizations to control data access limits for authorized personnel enrolled in the system?
• Is RLS powered by RBAC and aligned to segregate allowed data access operations?
• Is granular access granted based on user attributes like department, location, and asset type?

Answering "YES" to all three suggests that ABAC is conceptually bound into Snowflake's security model.

Summary

Given how roles provision access in Snowflake and ABAC's interrelationship with RBAC, RLS is driven by roles and their privileges that govern access patterns and Segregation of Duties for authorized individuals on relational assets. This understanding reveals that ABAC is implicitly integrated into the platform's authorization framework, making RBAC the smart access control model in Snowflake.

Abbreviations & acronyms:

• RBAC – Role-based Access Control
• ABAC – Attribute-based Access Control
• RLS – Row-level Security
• SoD – Segregation of Duties
• PoLP – Principle of Least Privilege