How Snowflake cost is calculated: 5 steps to optimize your data warehouse costs before your next renewal

One stolen password can bring down an entire enterprise. The 2024 Snowflake breaches revealed how fragile weak access controls are, with 165 organizations and millions of users affected. The breaches were not the result of advanced attacks. They happened because stolen passwords went unchecked, and multi-factor authentication was missing. As businesses move more of their data to the cloud and centralize it on platforms like Snowflake, a critical question emerges: who should have access, and how do you manage it at scale without slowing the business or weakening security?

In this article, we’ll break down the Snowflake Role Hierarchy, explain why it matters, and share best practices for structuring roles that support security, compliance, and day-to-day operations.

What is Snowflake’s role hierarchy?

Snowflake’s role hierarchy is a structured framework that defines how permissions and access controls are organized within the platform. In Snowflake, access to data and operations is governed entirely by roles. Using the Role-Based Access Control (RBAC) model, you grant privileges to roles, and then assign users to those roles, simplifying administration, ensuring consistency, and making audit access easier. RBAC is generally recommended for production environments and enterprise-level governance.

The hierarchy operates on a parent-child relationship model where higher-level roles inherit privileges from subordinate roles, creating a tree-like structure. This structure provides granularity, clarity, and reusability, but it requires thoughtful planning to avoid sprawl or over-permissioned users.

Core components of Snowflake RBAC

• Roles: The fundamental building blocks that encapsulate specific privileges
• Privileges: Defined levels of access to securable objects (databases, schemas, tables)
• Users: Identities that can be assigned roles to access resources
• Securable Objects: Entities like databases, tables, views, and warehouses that require access control
• Role Inheritance: The mechanism allowing roles to inherit privileges from other roles

Understanding Snowflake's system-defined roles

Understanding the default role structure is crucial for building secure hierarchies:

ACCOUNTADMIN

• Root-level access to all account operations
• Can view and manage billing and credit data
• Should be tightly restricted to emergency use only
• Not a "superuser" - still requires explicit privileges for data access

SYSADMIN

• Full control over database objects and users
• Recommended parent for all custom roles
• Manages warehouses, databases, and schemas

SECURITYADMIN

• Manages user and role grants
• Controls role assignment and privilege distribution
• Essential for maintaining RBAC governance

Custom roles

• Created for specific teams or functions within an organization (e.g ANALYST_READ_ONLY, ETL_WRITER).

Best practices for designing a secure Snowflake role hierarchy

A well-structured role hierarchy minimizes risk, supports compliance, and makes onboarding/offboarding easier. Here’s how one should do it right:

1. Follow the Principle of Least Privilege

Grant only the minimum required permissions for each role to perform its function. Avoid blanket grants like GRANT ALL ON DATABASE.

Do this:

• Specific, targeted grants
• Avoid cascading access down the role tree unless absolutely needed
• Regularly audit roles to ensure they align with actual usage

GRANT SELECT ON TABLE SALES_DB.REPORTING.MONTHLY_REVENUE TO ROLE ANALYST_READ;
GRANT USAGE ON SCHEMA SALES_DB.REPORTING TO ROLE ANALYST_READ;
GRANT USAGE ON DATABASE SALES_DB TO ROLE ANALYST_READ;

Not this:

• Overly broad permissions

GRANT ALL ON DATABASE SALES_DB TO ROLE ANALYST_READ;

Why does it matter?

Least privilege prevents accidental (or malicious) misuse of sensitive data. It also supports data governance and compliance with various regulations like GDPR or HIPAA.

2. Use a layered role design

Design your roles using a layered and modular approach, often structured like this:

• Functional Roles (what the user does):

CREATE ROLE ANALYST_READ;
CREATE ROLE ETL_WRITE;
CREATE ROLE DATA_SCIENTIST_ALL;

• Environment Roles (where the user operates)

CREATE ROLE DEV_READ_WRITE;
CREATE ROLE PROD_READ_ONLY;

Composite or Team Roles (Group users by department or team, assigning multiple functional/environment roles under one umbrella)

CREATE ROLE MARKETING_TEAM_ROLE → includes PROD_READ_ONLY + ANALYST_READ

3. Avoid granting privileges directly to users

Always assign privileges to roles and not users. Then, assign users to those roles.

Why it matters?

This keeps access transparent and auditable. If a user leaves or changes teams, simply revoke or change the role. There’s no need to hunt down granular permissions.

4. Establish consistent naming conventions

Enforce naming conventions as consistent role and object naming makes automation and governance far easier to scale.

Recommended Naming Pattern:

• Access Roles: {ENV}_{DATABASE}_{ACCESS_LEVEL} (e.g., PROD_SALES_READ)
• Functional Roles: {FUNCTION}_{TEAM} (e.g., DATA_ANALYST, ETL_ENGINEER)
• Service Roles: {SERVICE}_{PURPOSE}_ROLE (e.g., FIVETRAN_LOADER_ROLE)

5. Use separate roles for Administration vs. Operations

Split roles that manage infrastructure (e.g., warehouses, roles, users) from roles that access data.

• Admins: SYSADMIN, SECURITYADMIN‍
• Data teams: DATA_ENGINEER_ROLE, ANALYST_ROLE, etc.

Why it matters? This separation of duties limits the potential impact of security incidents and supports audit compliance. Administrators should not have access to sensitive data unless it's absolutely necessary for their role.

6. Secure the top-level roles

Roles like ACCOUNTADMIN and SECURITYADMIN should be assigned to the fewest people possible, protected with MFA, and monitored for any usage.

Implementation Checklist:

• Limit ACCOUNTADMIN to 2-3 emergency users maximum
• Enable MFA for all administrative accounts
• Set up monitoring and alerting for admin role usage
• Regular access reviews and privilege audits
• Document and justify all administrative access

Monitoring, auditing & compliance: keeping your Snowflake hierarchy healthy

Even the best-designed role trees can get messy over time. Here’s how to maintain security:

1. Regular access reviews

Implement quarterly access reviews to maintain security hygiene:

• Role Effectiveness Analysis: Identify unused or over-privileged roles
• User Access Validation: Verify users have appropriate role assignments
• Privilege Scope Review: Ensure roles maintain least privilege principles
• Compliance Mapping: Document role mappings to business functions

2. Logging and monitoring

Enable Access History and Login History in Snowflake to track activity and implement automation tools for role assignments during employee transitions.

3. Onboarding/offboarding automation

Implement automation tools or scripts to efficiently manage role assignments during employee transitions.

4. Object Tagging for enhanced security

Use object tagging to classify sensitive data and control access accordingly.

Measuring RBAC Success: Key Performance Indicators

1. Security Metrics

• Access Review Coverage: % of roles reviewed quarterly
• Privilege Violations: Number of excessive privilege grants identified
• Failed Authentication Attempts: Monitor for unauthorized access patterns
• Role Utilization Rate: % of active roles vs. total created roles

2. Operational Metrics

• User Onboarding Time: Average time to provision new user access
• Role Management Efficiency: Time to modify/update role permissions
• Audit Response Time: Speed of access review and remediation
• Automation Coverage: % of role operations automated vs. manual

3. Compliance Metrics

• SOC 2 Readiness: Role hierarchy documentation completeness
• GDPR/Data Privacy: Data access control effectiveness
• Industry Compliance: Sector-specific requirement adherence
• Change Management: Role modification approval and documentation

Future-Proofing Your RBAC Strategy

The way you manage access today will define how secure and scalable your Snowflake environment is tomorrow. The strength of Snowflake’s RBAC model lies in its flexibility, but that power comes with responsibility. As AI features mature, as multi-cloud deployments become the norm, and as regulators tighten expectations around data privacy, static role hierarchies quickly fall behind. A poorly structured role hierarchy can lead to data leaks, audit failures, higher operational costs, and stalled innovation.

At Snowstack, we specialize in building RBAC strategies that are not only secure today but ready for what’s next. Our team of Snowflake-first engineers has designed role models that scale across continents, safeguard sensitive data for regulated industries, and enable AI without exposing critical assets. We continuously monitor Snowflake’s roadmap and fold new security capabilities into your environment before they become business risks.

Don’t wait for the next breach to expose the cracks in your access controls. Let’s design an RBAC strategy that keeps you secure, compliant, and future-ready.

👉 Book a free RBAC assessment

‍

Some companies still run databases like it’s 1999. Others have adopted cloud-native architectures that cut costs in half and double performance. Guess who’s winning?

Traditional databases force a trade-off between performance and budget. Collaboration still means passing around CSVs. Forward-thinking organizations have shifted to Snowflake’s cloud-native architecture, which scales instantly, operates securely, and keeps costs under control. But what truly sets Snowflake apart from traditional databases or even other cloud data platforms?

In this blog, we’ll break down three key architectural advantages that make Snowflake a game-changer for businesses that want to migrate to the cloud.

But first, what is a cloud-native database?

A cloud-native database is designed from the ground up for the cloud. Unlike traditional databases that were adapted from on-premise systems, cloud-native platforms are purpose-built to take advantage of the cloud’s strengths: scalability, flexibility, and resilience.

They scale horizontally by adding capacity in parallel instead of relying on bigger machines. They automatically adjust resources up or down based on demand, so you only pay for what you use. They also come with built-in high availability through data replication and automated recovery.

In short, a cloud-native database removes the rigid trade-offs of legacy systems and gives modern businesses the performance, efficiency, and reliability they need to stay competitive.

Snowflake's architecture: 3 strategic advantages

Snowflake isn’t just faster or cheaper. It’s built differently. The three architectural choices below explain why modern data teams trust Snowflake to scale, collaborate, and deliver insights in ways legacy systems never could.

1. Separation of storage and compute: elasticity without trade-offs

Most databases tie storage and compute together. Need more power to run quarterly reports? You’ll also pay for storage you don’t use. Want to keep historical data at a lower cost? You’re still paying for compute you don’t actually need.

Snowflake's Solution: Snowflake's architecture fundamentally decouples storage and compute layers, creating unprecedented flexibility for modern data teams.

• You can scale compute resources up or down independently of your data storage.
• Multiple workloads (e.g., data ingestion, analytics queries, and reporting) can run simultaneously on isolated compute clusters without performance conflicts.
• You can assign different warehouses (compute clusters) to different teams or departments without worrying about concurrency issues or resource contention.

Business impact: Imagine a BI team that runs heavy dashboards while a data science team trains models on the same data. The beauty behind this separation is that both can operate without stepping on each other’s toes. This translates to faster time-to-insight, cost control, and happy teams who aren’t waiting for resources to free up.

2. Multi-cluster shared data architecture: built for collaboration and scale

Traditional databases become performance challenge as more users access the system. Query response times degrade, teams queue for resources, and data silos emerge as different departments seek workarounds.

Snowflake's Solution: Snowflake’s multi-cluster shared data model allows any number of users and tools to access the same single source of truth without performance degradation. The platform automatically manages concurrency through intelligent multi-cluster compute scaling.

What this means for data teams:

• Unlimited concurrency: Teams don’t have to wait in line to access the warehouse. Snowflake automatically adds compute clusters as needed and scales them back down when demand drops.
• Cross-team collaboration: Data Engineers, analysts, and ML engineers can work off the same dataset in real time, using SQL, Python, or third-party tools.
• Data sharing across organizations: Snowflake’s architecture supports secure data sharing with external partners or vendors without copying or moving data. You simply grant access.

Business impact: This makes Snowflake not just a warehouse but a collaboration platform for data. Whether your team is distributed across continents or collaborating with external partners, Snowflake enables fast, consistent, and secure access to data.

3. Zero management with cloud-native infrastructure

Managing a traditional database means dealing with provisioning, tuning, indexing, patching, and more. These tasks require specialized DBAs and often lead to downtime, delays, and human error.

Snowflake flips the script with a “zero-management” approach.

Thanks to its fully managed SaaS model:

• No infrastructure to manage. Snowflake runs entirely in the cloud (on AWS, Azure, or GCP), abstracting away the underlying hardware.
• Automatic tuning and optimization. No need to manually set indexes or optimize queries, Snowflake handles that under the hood.
• Security and compliance out of the box. Features like automatic encryption, role-based access control, and compliance with standards (HIPAA, GDPR, SOC 2) are built-in.

Business impact: This lets your team focus on data and insights, not on maintenance. IT teams no longer need to waste time on low-value operational tasks. Instead, they can accelerate innovation and reduce costs.

Snowflake vs. the competition: why architecture matters

In 2025, your data architecture is more than a technical choice. It is a strategic decision that defines how quickly your organization can compete, innovate, and scale. When you compare modern data platforms, Snowflake's architectural advantages become clear when compared to alternatives:

How Snowflake’s architecture drives results?

Snowflake’s architecture solves the trade-offs that hold traditional databases back and delivers flexibility that many cloud platforms still lack. But technology alone is not enough. The difference comes from how you implement it.

Take the case of a $200M pharmaceutical distributor. Their teams were stuck with siloed on-prem systems, compliance risks, and reports that took hours to run. Our Snowflake-certified experts helped them migrate to Snowflake’s cloud-native architecture with a single governed data layer, dedicated compute clusters, and built-in role-based access. In just 90 days, reporting was 80% faster, the architecture was ready for AI and advanced analytics, and teams finally worked from the same source of truth.

👉 Read the full case study here

Making Snowflake’s architecture work for your business

Every organization’s data challenges look different, but the goal is the same: to turn Snowflake into a platform that delivers measurable results. That’s where Snowstack comes in. We bring proven experience from complex projects in finance, pharma, and FMCG. This gives clients confidence that their architecture is designed for scale, collaboration, and compliance from day one. Our role goes beyond implementation. We act as a long-term partner who helps data teams adapt, optimize, and grow with Snowflake as business needs evolve.

‍

In 2025 Snowflake is more than a database. It has become the foundation for data, AI, and applications. With almost 10,000 active Snowflake customers** globally and more than 850 certified services partners, the challenge isn't finding a partner. It's finding the right partner who can deliver tangible results while building a sustainable, cost-effective data platform.

In this blog, we outline the key criteria to evaluate when selecting a Snowflake partner in 2025 and explain how the choice you make will directly shape the success of your data initiatives.

What is a Snowflake consulting partner?

A Snowflake consulting partner is a certified services provider that specializes in implementing, optimizing, and managing Snowflake's Data Cloud platform. These partners range from global system integrators managing petabyte-scale deployments to boutique firms focusing on specific industries or Snowflake features.

Snowstack is built for this role. As a Snowflake-first partner, our focus is entirely on helping organizations succeed with the platform. We design and deliver environments that are secure, cost-efficient, and ready for AI. Because we focus exclusively on Snowflake, we bring a level of technical depth, delivery discipline, and industry knowledge that generalist consultancies cannot match.

Best criteria for selecting your Snowflake partner in 2025:

In 2025, not every Snowflake partner delivers the same results. Your choice can determine whether your data projects drive real business value or slip into delays, cost overruns, and a loss of confidence across the organization. Here is what to look for when evaluating a partner’s approach:

1. Delivery methodology as the deciding factor

The single biggest predictor of Snowflake implementation success isn't the partner's brand recognition or size. It's how they deliver. In our analysis of successful Snowflake projects, delivery methodology consistently emerges as the most critical differentiator.

Ask prospective partners:

• What is their delivery rhythm? Look for agile methodologies with short, business-visible delivery cycles rather than waterfall approaches with big reveals at the end
• How do they balance technical debt vs. time to market? The best partners prioritize early wins while building sustainable architecture
• Do they work in short iterations with quick business feedback? Partners should deliver "first dashboard live in 4 weeks" rather than 6-month black box projects
• Can they balance governance and speed? Avoid partners who treat governance as an afterthought or create excessive bottlenecks

What to look for: Partners with repeatable, transparent, and well-documented processes that adapt to your internal structure while maintaining consistent quality standards.

2. Snowflake-native thinking vs. generic cloud advice

The difference between Snowflake specialists and generalist cloud consultants becomes evident in architecture decisions, cost optimization strategies, and feature utilization.

Depth of platform knowledge matters:

• Do they understand Snowflake's native capabilities? Look for expertise in Streams & Tasks, Snowpark, Secure Sharing, Cortex AI, and Dynamic Tables
• Do they optimize for platform strengths? The best partners design for Snowflake's unique architecture rather than forcing legacy patterns
• Can they demonstrate platform-specific know-how? Ask about credit optimization, role hierarchy design, cost guardrails, and performance tuning strategies
• Are they current with latest features? Snowflake releases new capabilities quarterly partners should stay updated

Evaluation technique: Ask candidates to walk through a specific Snowflake architecture decision and explain their reasoning. Generic answers reveal generalist thinking.

A leading financial services firm was spending more than 800,000 dollars per month on cloud costs with little visibility into where the money was going. Within 90 days, we delivered a governed Snowflake platform that reduced data ingestion latency by 80%, enabled AI readiness, and put full cost controls in place.

3. Time to value: shipping early and often

The era of 6-month data projects with big reveals is over. Modern Snowflake implementations should deliver value incrementally, building momentum and stakeholder confidence throughout the process.

Measurement criteria: Ask to see examples of their delivery cadence, backlog management practices, and documentation standards. Partners should have concrete examples of incremental value delivery. For instance, one of our clients, a regional pharma distributor, moved from legacy on-premises systems to a Snowflake-native platform. Instead of a single large rollout, we delivered in focused iterations. Dashboards came first, followed by finance and supply chain integrations, and advanced governance policies were in place before production go-live. This approach kept stakeholders engaged and satisfied.

5. Team structure and location strategy

The 2025 landscape offers multiple delivery models, each with distinct advantages and trade-offs. However critical questions beyond geography:

• Will you get named engineers or a rotating bench? Consistency matters for knowledge retention
• Is there a lead you can trust? Avoid partners who channel everything through project managers without technical depth
• How do they ensure knowledge retention over time? Look for documentation practices and handover procedures

6. Embedded Support vs. one-and-done projects

Snowflake is a living platform that evolves continuously. Your partner relationship shouldn't end at go-live. Successful implementations require ongoing optimization, new source integration, and platform evolution support.

Post-implementation needs include:

• Onboarding new data sources as business requirements evolve
• Evolving data models based on changing business logic
• Performance optimization as data volumes and user counts grow
• Feature adoption as Snowflake releases new capabilities
• Cost optimization through usage pattern analysis

Partner support models to evaluate:

• Embedded engineers: Dedicated resources working as extended team members
• Managed services: Full platform management with SLA guarantees
• Retainer arrangements: On-demand expertise for specific needs
• Training and enablement: Knowledge transfer to build internal capabilities

Key consideration: Partners offering only project-based work may leave you stranded when you need ongoing support most. Unlike project-only vendors, our experts stay engaged long after go-live. Our model ensures that as your data platform grows, you have continuous access to the same experts who built it, ready to integrate new sources, optimize costs, and adopt new Snowflake features.

7. Governance, cost control, and trust

Platform ownership extends far beyond delivering functional pipelines. Successful Snowflake implementations require robust governance frameworks, proactive cost management, and enterprise-grade security practices.

Essential governance capabilities:

• Role-based access control and masking policies aligned with your security requirements
• Cost observability and alerting systems to prevent budget surprises
• Compliance framework alignment (SOC 2, GDPR, HIPAA, PCI-DSS)
• CI/CD and documentation practices for long-term maintainability
• Data quality and lineage tracking for trustworthy analytics

Without a solid governance foundation, a Snowflake platform may appear to work at first but will not scale sustainably. In our blog you can explore this topic in depth, but here is a snapshot of the cost control practices we recommend.

• Warehouse auto-suspend and auto-resume configuration
• Query result caching optimization
• Clustering key recommendations
• Storage optimization strategies
• Credit usage monitoring and alerting

8. AI Readiness and responsible adoption

Snowflake is rapidly evolving into a core platform for AI and machine learning, but realizing its potential requires more than connecting models to data. Successful implementations demand partners who can design secure, scalable, and responsible AI foundations inside Snowflake.

Essential AI readiness capabilities:

• Integration of Cortex AI for LLM-based applications with enterprise controls
• Snowpark ML workflows for efficient model training and deployment
• Feature store design for consistent and reusable machine learning pipelines
• AI governance frameworks to manage bias, privacy, and ethical use

Without a clear AI strategy built on trusted data, organizations face wasted investment, compliance risks, and a loss of stakeholder confidence. One regional pharma distributor overcame these challenges by migrating to Snowflake with us. With Snowpark ML workflows and governed feature stores, they got accurate demand forecasting and optimized their supply chain while ensuring responsible AI adoption.

Industry-Specific Considerations

Different industries have unique requirements that affect partner selection:

Financial Services: Emphasis on regulatory compliance, data residency, audit trails, and risk management frameworks.

Healthcare & Life Sciences: Focus on HIPAA compliance, data privacy, clinical data standards, and FDA validation support.

Manufacturing: Requirements for IoT data integration, real-time analytics, supply chain optimization, and operational intelligence.

Retail & E-commerce: Need for customer 360 views, real-time personalization, inventory optimization, and marketing analytics.

Technology Companies: Emphasis on developer productivity, API integrations, event streaming, and product analytics.

Snowflake partner red flags to avoid in 2025

Watch for these warning signs during partner evaluation:

‍

Who is the right Snowflake partner for you and your business in 2025?

Most data migrations don’t fail because of the technology. They fail because of poor execution and weak partner choices. When projects stall, the real cost is not just overspending. It is delayed initiatives, frustrated stakeholders, and lost confidence in the value of data.

In 2025, choosing a Snowflake partner is no longer about ticking boxes for certifications or chasing the lowest cost. It is a strategic decision that will shape whether your data initiatives deliver real business impact or fall short. At Snowstack, we combine deep Snowflake expertise with proven delivery methods, transparent team structures, and a focus on long-term governance and optimization. We help organizations move beyond one-off implementations to build scalable, AI-ready platforms that deliver measurable results and lasting trust in data.

👉 Book a strategy session with our experts now.

‍

‍