Snowflake account baseline: roles, warehouses, network policies and resource monitors

#Roles

• System roles reserved: ACCOUNTADMIN for a few named admins with MFA, never as a default role.
• SYSADMIN owns databases and warehouses; SECURITYADMIN/USERADMIN manage roles and users.
• Functional roles (ANALYST, ENGINEER, BI_SERVICE) granted access roles (SALES_READ, SALES_WRITE), and functional roles granted to SYSADMIN.

USE ROLE SECURITYADMIN;
CREATE ROLE IF NOT EXISTS sales_read;
CREATE ROLE IF NOT EXISTS analyst;
GRANT ROLE sales_read TO ROLE analyst;
GRANT ROLE analyst TO ROLE sysadmin;

#Users and authentication

• SSO with your IdP (SAML), SCIM provisioning.
• MFA for any password users; service users use key-pair or OAuth, TYPE = SERVICE.
• ALTER ACCOUNT SET authentication policies as available in your edition.

#Network

CREATE NETWORK RULE corp_ips MODE = INGRESS TYPE = IPV4 VALUE_LIST = ('203.0.113.0/24');
CREATE NETWORK POLICY corp_only ALLOWED_NETWORK_RULE_LIST = ('corp_ips');
ALTER ACCOUNT SET NETWORK_POLICY = corp_only;   -- test with a user-level policy first!

Consider PrivateLink for cloud-private connectivity.

#Warehouses

• Separate warehouses per workload (ETL, BI, data science).
• AUTO_SUSPEND = 60–300, AUTO_RESUME = TRUE.
• STATEMENT_TIMEOUT_IN_SECONDS per warehouse.

CREATE WAREHOUSE bi_wh WAREHOUSE_SIZE = 'SMALL' AUTO_SUSPEND = 120 AUTO_RESUME = TRUE
  MIN_CLUSTER_COUNT = 1 MAX_CLUSTER_COUNT = 3 STATEMENT_TIMEOUT_IN_SECONDS = 1800;

#Cost control

USE ROLE ACCOUNTADMIN;
CREATE RESOURCE MONITOR rm_monthly WITH CREDIT_QUOTA = 2000 FREQUENCY = MONTHLY START_TIMESTAMP = IMMEDIATELY
  TRIGGERS ON 75 PERCENT DO NOTIFY ON 90 PERCENT DO NOTIFY ON 100 PERCENT DO SUSPEND;
ALTER WAREHOUSE bi_wh SET RESOURCE_MONITOR = rm_monthly;

#Data protection

• Time Travel retention set per database (DATA_RETENTION_TIME_IN_DAYS, up to 90 on Enterprise) for critical data.
• Fail-safe (7 days, Snowflake-managed) understood: not user-accessible, recovery through support only.
• Cross-region/cloud replication planned for DR (see the Snowflake replication post).

#Audit

• SNOWFLAKE.ACCOUNT_USAGE views (LOGIN_HISTORY, QUERY_HISTORY, ACCESS_HISTORY) monitored; alerts on failed logins and ACCOUNTADMIN use.

#Availability

A Snowflake account in one region is already resilient across that cloud region's availability zones. Region or cloud outages need replication and failover groups (Business Critical edition for failover).