为何建议将自定义角色分配给SYSADMIN？

Great questions—let’s break this down clearly since Snowflake’s role hierarchy can feel tricky at first!

What’s the Meaning of Assigning Custom Roles to SYSADMIN? #

First, let’s recall Snowflake’s default role hierarchy: ACCOUNTADMIN (top-level, full account control) sits above SYSADMIN (day-to-day system management), which in turn sits above specialized roles like USERADMIN and SECURITYADMIN.

When you assign a custom role (say, ETL_OPERATOR or DATA_WAREHOUSE_MANAGER) to SYSADMIN, here’s what it actually accomplishes:

• Safe permission inheritance: SYSADMIN gains all the permissions tied to the custom role, but the reverse isn’t true—your custom role won’t inherit SYSADMIN’s broader system privileges. This lets SYSADMIN users leverage specialized permissions without elevating the custom role to a higher, riskier tier.
• Delegate management control: SYSADMIN can now grant that custom role to other users or teams (like individual analysts or project groups) without needing to involve ACCOUNTADMIN for every small access request. For example, if you create a REPORTING_ACCESS role for read-only access to specific schemas, assigning it to SYSADMIN lets them handle who gets that access day-to-day.
• Avoid permission bloat: Instead of cluttering SYSADMIN with direct grants for every single task, you encapsulate specific responsibilities in custom roles. This keeps SYSADMIN’s permission set clean and focused on its core operational purpose.

You’d run this SQL command to make the assignment:

GRANT ROLE etl_operator TO ROLE sysadmin;

Core Purpose of This Recommended Practice #

Snowflake explicitly recommends this pattern for a few practical, high-impact reasons:

• Follow the principle of least privilege: ACCOUNTADMIN has unrestricted access to your entire account, so minimizing its use reduces the risk of accidental changes or security breaches. By delegating custom role management to SYSADMIN, you keep high-risk permissions locked away while still enabling efficient day-to-day operations.
• Separate duties clearly: ACCOUNTADMIN should focus on account-level tasks (like creating virtual warehouses, managing billing, or setting up account-wide security policies), while SYSADMIN handles operational management. Custom roles let you carve out specific job functions (e.g., ETL management, data governance) that SYSADMIN can oversee without overstepping into account-level controls.
• Improve maintainability and auditability: Custom roles act as "permission containers." If you need to update access for a specific team or task, you only modify the custom role—not SYSADMIN’s entire permission set. Plus, auditing is easier: you can track exactly who used the custom role for specific actions, rather than sorting through generic SYSADMIN activity logs.
• Scale your permission model: As your organization grows, you’ll create more custom roles for different teams or projects. Assigning them to SYSADMIN creates a consistent, scalable hierarchy that avoids messy, one-off grants directly from ACCOUNTADMIN.

内容的提问来源于stack exchange，提问作者Vivek Sharma