RBAC、DAC 與可保護物件階層

Snowflake 管理、治理與協作

Emily Melhuish

Technical Curriculum Developer, Snowflake

認識 Claro

全球建信用的 App

存取難題

基礎元件

權限是執行動作的准許：

SELECT：讀取
INSERT：寫入
CREATE：建立

Term	Definition
Privilege	Permission to perform an action (e.g. SELECT, INSERT, CREATE)
Object	Anything a privilege can be granted on (table, schema, database, warehouse)
Role	An entity to which privileges are granted; can be granted to users or other roles
User	A person or service account that connects to Snowflake and holds roles

角色為本的存取控制（RBAC）：運作方式

從左到右顯示 privilege、role、user 的流程圖

實作 RBAC

將權限授與角色

GRANT SELECT ON TABLE core.credit_scores
  TO ROLE analyst_role;

將角色指派給使用者

GRANT ROLE analyst_role TO USER maria;

¹ [Snowflake: Access Control Privileges](https://docs.snowflake.com/en/user-guide/security-access-control-privileges)

任意存取控制（DAC）

顯示轉移前後的 DAC 分割圖

每個物件都有擁有者＝一個角色，不是個人
RBAC 定義角色架構
DAC 決定各角色能控制什麼

轉移擁有權

將擁有權轉移給其他角色

-- 目前擁有者：SYSADMIN
GRANT OWNERSHIP ON TABLE core.credit_scores
  TO ROLE data_engineer
  REVOKE CURRENT GRANTS;

可保護物件階層

在每一層套用 USAGE

GRANT USAGE ON DATABASE <your_database>
  TO ROLE analyst_role;

GRANT USAGE ON SCHEMA core
  TO ROLE analyst_role;

GRANT SELECT ON TABLE core.credit_scores
  TO ROLE analyst_role;

系統定義的角色

Role	Responsibility
ACCOUNTADMIN	Full account control
SYSADMIN	Creates databases and warehouses
SECURITYADMIN	Network policies, masking policies, role management
USERADMIN	Creates users and assigns roles
PUBLIC	Default role for every user

¹ [Snowflake: Access Control Overview](https://docs.snowflake.com/en/user-guide/security-access-control-overview)

一起來練習吧！

Snowflake 管理、治理與協作