雪花系统角色 - USERADMIN 与 SECURITYADMIN

Question

寻找有关何时利用 USERADMIN 与 SECURITYADMIN 的输入，根据文档 SECURITYADMIN 继承了 USERADMIN 的权限

利用这两个角色进行用户、角色和拨款管理的正确方法是什么？我正在使用如下

USERADMIN - 用于以下用途

• 创建用户或删除用户
• 创建角色或删除角色

SECURITYADMIN - 用于以下用途

• 授予/撤销角色权限
• GRANT/REVOKE 将共享数据库上的导入权限授予 ROLES

问题是，谁应该执行以下操作。是 USERADMIN 还是 SECURITYADMIN？如果这两个角色在技术上都可以执行，是否有任何标准指导？

• 将角色授予另一个角色
• 向用户授予角色

谢谢。

Answer 1

The USERADMIN role didn\'t exist before April 2020, as this new role was introduced as an improvement to enable accounts to separate the management of users and roles from the SECURITYADMIN role - if desired.

\n

\n
• https://docs.snowflake.com/en/release-notes/2020-04.html#new-useradmin-system-role
\n

\n

You can use either system role to GRANT ROLE. The best practice should be determined by your own security policy.

\n

\n

Because the USERADMIN role is assigned to the SECURITYADMIN role, users with the SECURITYADMIN role can still administer users and roles. However, companies can now assign the USERADMIN role to separate the management of users and roles from the management of all grants.

\n

\n

\n

Use of the USERADMIN role to separate these duties is optional. The decision to use the USERADMIN role is driven entirely by the security model implemented for your account.

\n

\n

我自己的建议：既然USERADMIN可以GRANT ROLE,是更受限制的角色 \xe2\x80\x94 那么在授予角色时USERADMIN选择使用。USERADMIN

\n