📝 Snowflake User Default Role is not set 🟢

• Contextual name: 📝 Default Role is not set 🟢
• ID: /ce/ca/snowflake/user/default-role-is-not-set
• Located in: 📁 Snowflake User

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Snowflake User
  • 🔌 Snowflake User - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Ensure that each Snowflake user account has a designated Default Role configured.

Rational

Assigning a Default Role to users reinforces the principle of least privilege by clearly defining the initial set of permissions available upon login. This practice:

• Provides predictable and controlled access at session start.
• Supports standardized access management and auditing across the organization.

Audit

This policy marks a Snowflake User as INCOMPLIANT if Default Role Name field is empty.

Remediation

Open File

Remediation

Using SQL

The executing role must hold the OWNERSHIP privilege on the target user account to modify its properties via SQL.

To assign a default role to a Snowflake user, execute the following SQL command:

ALTER USER {{username}} 
    SET DEFAULT_ROLE = {{role_name}};

Note: The specified {{role_name}} must already exist in Snowflake.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 Cloudaware Framework → 💼 User Account Management			16