Access Management Policy on Snowflake

On Snowflake, ALTR enforces an Access Management Policy by issuing GRANT and REVOKE statements to Snowflake roles through a service user, rather than an administrator running those statements by hand.

How Enforcement Works

ALTR applies Access Management Policy on a scheduled basis: a scheduled process evaluates each policy’s target objects against its matching strategy, computes the privileges each policy’s roles require, and issues the corresponding GRANT and REVOKE statements against your Snowflake account. Because enforcement runs on a schedule, a new object matching a policy’s pattern is picked up on the next scheduled run rather than immediately. You can also refresh a policy manually. A CSV report of each enforcement run is available for review.

When more than one Access Management Policy applies to the same Snowflake object, ALTR grants the union of all privileges those policies specify — policies are additive, and one policy cannot subtract access another policy grants.

Roles targeted by a policy must already exist in Snowflake; ALTR does not create roles.

Note

Deleting a policy revokes the access it granted. A future-granted privilege on an object created after the policy was set may not be fully revoked.

Privileges Granted by Object Type

The specific privileges ALTR grants depend on the target object’s type and the policy’s privilege level (read, write, or read and write). Granting access to a schema object always includes USAGE on its parent schema and database, so the role can reach it. Future grants — privileges applied automatically to objects created after the policy is defined — are set at the database and schema level.

Object Type	Read	Write
Database	USAGE on the database and on all schemas; SELECT on all tables and views; future grants: USAGE on future schemas, SELECT on future tables and views	USAGE on the database and on all schemas; INSERT, TRUNCATE, UPDATE on all tables and views; future grants: USAGE on future schemas, INSERT/TRUNCATE/UPDATE on future tables and views
Schema	USAGE on the schema and parent database; SELECT on all tables and views; future grants: SELECT on future tables and views	USAGE on the schema and parent database; INSERT, TRUNCATE, UPDATE on all tables and views; future grants: INSERT/TRUNCATE/UPDATE on future tables and views
Table	SELECT; USAGE on parent schema and database	INSERT, TRUNCATE, UPDATE; USAGE on parent schema and database
View	SELECT; USAGE on parent schema and database	INSERT, TRUNCATE, UPDATE; USAGE on parent schema and database

Read and write privilege level grants the union of the Read and Write privileges listed above.

Note

Write does not include DELETE. Neither read nor write includes DDL privileges (CREATE, ALTER, DROP).

Configure a Policy Refresh Schedule

An Access Management Policy on Snowflake sets a refresh schedule — none, daily, weekly, or monthly. See Create an Access Management Policy for the full policy-creation procedure.