Role Maintenance

Early Access: This API is provided in Early Access. Please contact our customer support team for more information and to enable this feature.

Overview

The Role Maintenance API allows you to simulate modifications to an existing role's permissions and check if other roles with the resulting permission set already exist. This API is particularly useful for role rationalization and consolidation in Snowflake environments.

Use cases and features

This API enables effective role maintenance and governance with several key capabilities:

1. Role Rationalization: Find existing roles that match a desired permission set after modifications

2. Role Consolidation: Identify opportunities to consolidate roles by checking for existing roles with similar permissions

3. Permission Planning: Plan permission changes and identify existing alternatives before implementation

Limitations

• This feature is currently limited to the .

Role Maintenance API

Request Parameters

The API accepts a request object with the following parameters:

GranteeModification Structure

Each GranteeModification object contains:

Note: You can specify either or both of these fields:

• If only from_resource_permissions is set, those permissions will be removed

• If only to_resource_permissions is set, those permissions will be added

• If both are set, the permissions will be updated accordingly

This flexibility allows you to model different types of permission changes within a single API call. For example, you can simultaneously remove access to one resource while adding access to another, or modify permission levels on the same resource.

ResourcePermissions Structure

Each ResourcePermissions object contains:

Request and Response Protocol

Proto Message Definitions

The API uses the following protocol buffer message definitions:

Response Structure

The API returns a response object with the following field:

Usage Example

Request

This example simulates removing database and schema permissions from one role while adding database permissions to another:

Response

The response indicates that a role with the resulting permission set exists:

Example: Adding permissions only

This example shows adding permissions to a role:

Request

Response

Example: Removing permissions only

This example shows removing permissions from a role:

Request

Response

Related APIs