Snowflake permissions
Use the following information to understand the Snowflake permissions (also called privileges in Snowflake) that are used when configuring Snowflake permissions for Data Access.
| Permission | Why | When |
|---|---|---|
CREATE DATABASE IF NOT EXISTS COLLIBRA;
|
To create the configuration database that the connector uses to store its own operational metadata, such as masking configuration, filter allow-lists, secure functions, and tags. The configuration database is automatically excluded from synchronization and does not appear as a data object in Data Access. |
Always required. |
GRANT CREATE ROLE ON ACCOUNT TO ROLE COLLIBRA_SYNC;
|
To create and update the account roles that represent access controls in Data Access. | Required when exporting access controls from Data Access to Snowflake. |
GRANT MANAGE GRANTS ON ACCOUNT TO ROLE COLLIBRA_SYNC;
|
To read who has access to what, directly from Snowflake, giving near-real-time visibility into identity and access control changes in Snowflake. | Required when using the Manage Grants mode. |
GRANT APPLY MASKING POLICY ON ACCOUNT TO ROLE COLLIBRA_SYNC;
|
To apply and remove column mask policies. |
Required when using column masks. |
GRANT APPLY ROW ACCESS POLICY ON ACCOUNT TO ROLE COLLIBRA_SYNC;
|
To apply and remove row filter policies. |
Required when using row filters. |
GRANT IMPORT SHARE ON ACCOUNT TO ROLE COLLIBRA_SYNC;
|
To view the Snowflake shares that are shared with the account. |
Required when working with Snowflake shares. |
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE COLLIBRA_SYNC;
|
To access the |
Always required. |
GRANT USAGE ON WAREHOUSE <warehouse> TO ROLE COLLIBRA_SYNC;
|
To use a warehouse to run queries. | Always required. |
GRANT MONITOR USAGE ON ACCOUNT TO ROLE COLLIBRA_SYNC;
|
To read account-level objects (warehouses, databases, roles) for metadata discovery and usage monitoring across the account. |
Always required. |
GRANT APPLY TAG ON ACCOUNT TO ROLE COLLIBRA_SYNC;
|
To create and apply Snowflake object tags, including the tags that are used by tag-based masking architecture. |
Required when synchronizing tags, and when using column masks that use tags. |