How can I grant "CREATE DATABASE" permissions to a role in Snowflake

Question

I'm trying to create a Role hierarchy in Snowflake with a "top level" role which will be used for my helpdesk support team to manage users and resources within Snowflake. But this role cannot have access to any stored data due to compliance restrictions.

For user management, I've just granted SECURITYADMIN to the role and it seems to work pretty well. But for databases I would like to avoid using SYSADMIN as I would be inheriting the ability to view everything in the databases. So I've come up with a hierarchy that I think makes sense, which is basically the following with some added project roles:

ACCOUNTADMIN >--- HELPDESK (create/drop db then hand off to OU_MANAGER)
                - OU_MANAGER (create/drop schema/tables and assign grants within the OU) > OU_MEMBER (usage on resources in db)

What I would like to do is create the databases with my HELPDESK role, then grant all on that db to the management role for the organizational unit and hand it off to them.

I'm not sure if this is possible in Snowflake, or if I just have my syntax wrong. But I get an error when I try to run a basic grant create database to role helpdesk, and I can't find anything definitive in the docs about granting this kind of access.

question from:https://stackoverflow.com/questions/66055068/how-can-i-grant-create-database-permissions-to-a-role-in-snowflake

Answer 1

use role accountadmin;
grant create database on account to role helpdesk;