
Explore Snowflake best practices and data insights
Learn from our certified Snowflake experts to transform your data into commercial success.

7 Snowflake Security Essentials for Mid-Market Teams
The 2024 Snowflake breaches hit 165 organizations, mostly through stolen credentials and missing MFA. Mid-market teams need enterprise-grade controls without an enterprise-sized security team. Here are the seven security and governance essentials to get right during implementation, not after the first audit.
Mid-market data and analytics leaders face a unique challenge when implementing Snowflake. You need enterprise-grade security controls but often lack the dedicated security teams that larger organizations maintain. The 2024 Snowflake breaches proved what can happen when access controls are weak. With 165 organizations affected, the lesson is clear: security must be part of the implementation, not an afterthought. Snowstack helps enterprises implement Snowflake security with governance frameworks embedded from day one, ensuring mid-market teams achieve compliance confidence without slowing down delivery.
This guide breaks down seven security and governance essentials that mid-market teams need to address when deploying Snowflake. Each essential covers what to implement, why it matters, and how to get it right the first time.
Key Takeaways: 7 Snowflake Security Essentials for Mid-Market Teams
- Role-based access control structures permissions around business functions rather than individual users for scalable governance.
- Multi-factor authentication blocks credential-based attacks, which caused most recent Snowflake security incidents.
- Data encryption at rest and in transit protects sensitive information from unauthorized access and interception.
- Network policies restrict platform access to approved IP ranges and reduce external attack surface.
- Snowstack embeds governance controls during initial architecture design, helping mid-market teams achieve 100% audit readiness.
Security and Governance Essentials for Mid-Market Snowflake Implementations
1. Role-Based Access Control and Least Privilege
RBAC forms the foundation of Snowflake security. Instead of granting privileges directly to users, you assign privileges to roles and then grant those roles to users. This approach simplifies administration, supports compliance requirements, and makes access audits straightforward.
Mid-market teams should create a structured role hierarchy that separates functional roles from administrative ones. A finance analyst should have read access to reporting tables only. An ETL engineer needs write access to staging schemas. Keep these responsibilities distinct with specific, targeted grants rather than broad database-level permissions.
Critical practices include isolating compute access from data access, using separate roles for warehouse usage and data queries, and reserving ACCOUNTADMIN for emergency situations only.
2. Multi-Factor Authentication Enforcement
MFA blocks the most common attack vector: stolen credentials. The 2024 breaches happened because passwords were compromised and MFA was missing. Enforcing MFA across your entire Snowflake environment is the single most effective step you can take to protect user accounts.
Integrate Snowflake with your existing identity provider through SAML or OAuth for centralized management. Require MFA at the IdP level so all integrated applications, including Snowflake, inherit the same authentication standards. Document break-glass procedures for critical roles in case your SSO provider experiences downtime.
Do not make MFA optional. A universal enforcement policy is the only way to ensure this control cannot be circumvented by individual users.
3. Data Encryption Configuration
Snowflake encrypts data at rest with AES-256 and data in transit with TLS 1.2+ by default. For mid-market organizations handling regulated data, consider customer-managed encryption keys through your cloud provider's Key Management Service. This adds control over key access and the ability to revoke access instantly if needed.
Tri-Secret Secure combines a customer-managed key with Snowflake-managed and cloud provider keys. No single entity can decrypt the data independently. Establish key rotation policies and implement separate keys for development, staging, and production environments.
Monitor your KMS audit logs for unusual key access attempts. Early detection of anomalous activity can prevent security incidents from escalating.
4. Network Policies and IP Allowlisting
Network policies restrict access to your Snowflake environment based on IP addresses. This limits potential attack surface by ensuring only authorized networks can connect to your data platform.
Define allowlists based on your corporate network ranges, VPN endpoints, and trusted partner connections. For organizations with distributed teams, combine network policies with private connectivity options like AWS PrivateLink or Azure Private Link.
Review and update network policies quarterly as your organization's network footprint changes. Remote work and cloud-based tools can introduce new IP ranges that need authorization.
5. Activity Monitoring and Audit Logging
Continuous monitoring of user activities and access patterns identifies potential security threats before they become incidents. Snowflake's ACCOUNT_USAGE schema stores query history, login history, and administrative changes for up to one year.
Forward these logs to your SIEM platform for correlation with other security events across your infrastructure. Configure automated alerts for high-risk activities: ACCOUNTADMIN logins, unusual data export volumes, failed authentication attempts from new locations.
Create visualization dashboards to spot anomalies in query patterns and login trends. A sudden spike in data access outside business hours warrants immediate investigation. Grant access to ACCOUNT_USAGE views only to a dedicated AUDITOR role to preserve log integrity.
6. Data Classification and Dynamic Masking
Data classification identifies and tags sensitive columns, while dynamic masking automatically redacts that data based on the querying user's role. This protects sensitive information without altering source data or limiting legitimate analytics work.
Use Snowflake's EXTRACT_SEMANTIC_CATEGORIES function or partner tools to scan and tag sensitive columns automatically. Create masking policies with conditional logic that returns full values for authorized roles and redacted values for everyone else.
Apply masking policies through classification tags rather than individual columns. Any column tagged as PII automatically inherits the correct masking policy, reducing manual configuration and ensuring consistent protection across your environment.
7. Governance Framework and Compliance Alignment
Mid-market organizations operating under SOC 2, HIPAA, GDPR, or PCI DSS need governance controls built into initial architecture. Retrofitting compliance is expensive and error-prone. Embed lineage tracking, access documentation, and audit trails from day one.
Document your data governance framework including data classification standards, retention policies, access review cadences, and incident response procedures. Regular access reviews, conducted quarterly at minimum, verify that role assignments remain appropriate as team members change responsibilities.
Snowstack delivers Snowflake consulting with compliance expertise for regulated industries. Our implementations achieve 100% audit readiness for SOC 2 and GDPR frameworks with governance controls, access audits, and full traceability embedded during the initial build.
How Mid-Market Teams Can Secure Their Snowflake Platform
Security and governance decisions made during Snowflake implementation determine long-term platform health. Mid-market teams that address these seven essentials from the start avoid costly remediation projects later.
The challenge for many mid-market organizations is internal expertise. Specialized Snowflake knowledge for security architecture, RBAC design, and compliance frameworks requires experience across multiple deployments. Snowstack brings this Snowflake expertise to mid-market teams through Platform Team as a Service, compressing typical implementation timelines while embedding enterprise-grade security controls.
Ready to implement secure Snowflake data governance for your organization? Contact Snowstack to discuss your specific security and compliance requirements.
%201.webp)
How Snowflake cost is calculated: 5 steps to optimize your data warehouse costs before your next renewal
For data teams, the pattern is almost always the same. You move to Snowflake for performance and scale. But then the first bill lands, and suddenly your Snowflake warehouse costs are far higher than forecast. What went wrong?
For data teams, the pattern is almost always the same. You move to Snowflake for performance and scale. But then the first bill lands, and suddenly your Snowflake warehouse costs are far higher than forecast. What went wrong?
The first step to regaining control is understanding how Snowflake costs are calculated. This guide breaks down the cost structure and gives you five practical steps to optimize spend, so you only pay for the resources you actually need and can design a sustainable Snowflake FinOps practice before your next renewal.
But first, what Snowflake is used for?
Snowflake is a cloud data platform that enables organisations to store, process, and analyse data at scale. It operates on the three leading cloud providers (Amazon Web Services, Google Cloud Platform, and Microsoft Azure), giving businesses flexibility in how they deploy and expand their environments, whether as a greenfield implementation or as part of a larger Snowflake data platform rollout.
As a fully managed service, Snowflake removes the burden of infrastructure management. Users do not need to handle hardware, software updates, or tuning. Instead, they can focus entirely on working with their data while the platform manages performance, security, and scalability in the background - often with a lean internal team supported by a specialised Snowflake platform team.
One of Snowflake’s defining features is the separation of storage and compute, which allows each to scale independently. This design supports efficient resource usage, quick provisioning of additional capacity when needed, and automatic suspension of idle compute clusters known as virtual warehouses. These capabilities reduce costs while maintaining high performance when they’re configured with a cost-optimisation strategy.
Why your Snowflake cost keeps growing?
Before we discuses optimization, let's decode what you're actually paying for. Because if you're like most data teams, you're probably overpaying for things you didn't know you were buying.
Snowflake’s pay-as-you-go model is built on two primary components: compute and storage, along with a smaller component, cloud services.
1. Compute costs
This is typically the largest portion of your Snowflake bill. Compute is measured in Snowflake credits, an abstract unit that's consumed when a virtual warehouse is active.
Here's how the math works:
- Virtual Warehouses: These are the compute clusters (EC2 instances on AWS, for example) that run your queries, data loads, and other operations.
- "T-Shirt" Sizing: Warehouses come in sizes like X-Small, Small, Medium, Large, etc. Each size up doubles the number of servers in the cluster and, therefore, doubles the credit consumption per hour.
- Per-Second Billing: You're billed for credits on a per-second basis after the first 60 seconds of a warehouse running.
The formula for calculating the cost:
Credits Consumed = (Credits per hour for the warehouse) × (Total runtime in seconds) ÷ 3600
Real example: Running a Large warehouse (8 credits/hour) for 30 minutes (1800 seconds) would consume (8 * 1800)÷3600 = 4 credits. If you're paying $3 per credit, that half-hour just cost you $12. Scale that across dozens of queries per day, and you can see how costs spiral.
2. Storage Costs
At first, storage looks inexpensive compared to compute, but as data grows costs can rise quickly. Snowflake calculates storage charges based on the average monthly volume of data you store in terabytes. Because your data is automatically compressed, you’re billed on the compressed size, which most teams overlook.
You're paying for three different types of storage:
- Active Storage: The live data in your databases and tables.
- Time-Travel: Data kept to allow you to query or restore historical data from a specific point in the past. The default retention period is 1 day, but it can be configured up to 90 days for Enterprise editions.
- Fail-safe: A 7-day period of historical data storage after the Time-Travel window closes, used for disaster recovery by Snowflake support. This is not user-configurable.
3. Cloud services costs
The cloud services layer provides essential functions like authentication, query parsing, access control, and metadata management. For the most part, this layer is free. You only begin to incur costs if your usage of the cloud services layer exceeds 10% of your daily compute credit consumption. This is rare but can happen with an extremely high volume of very simple, fast queries.
5 steps to optimize your Snowflake warehouse costs
Now that you know what you're paying for, here are five steps to significantly reduce your spend.
Step 1: right-size your virtual warehouses
Running an oversized warehouse is like using a sledgehammer to crack a nut - it's expensive and unnecessary.
- Start small: Don't default to a
Largewarehouse. Begin with anX-SmallorSmalland only scale up if performance is inadequate. It's often more efficient to run a query for slightly longer on a smaller warehouse than for a few seconds on a larger one. Look for slow queries in the Query History that generate a lot of “Bytes spilled to local storage”. For large joins or window functions, going for aSmalltoLargewarehouse might be 4 times more expensive, but 10x faster, resulting in a 60% cost reduction. - Set aggressive auto-suspend policies: An active warehouse consumes credits even when it's inactive. Configure your warehouses to auto-suspend quickly when not in use. A setting of 1 to 5 minutes is a good starting point for most workloads. This single change can have a massive impact on your bill.
- Separate your workloads: Don't use one giant warehouse for everything. Create separate warehouses for different teams and tasks: (e.g.,
ELT_WHfor data loading,BI_WHfor analytics dashboards,DATASCIENCE_WHfor ad-hoc exploration). This prevents a resource-intensive data science query from slowing down critical business reports and allows you to tailor the size and settings for each specific workload. - Use multi-cluster warehouses for high concurrency: If you have many users running queries simultaneously (like a popular BI dashboard), instead of using a larger warehouse (scaling up), configure a multi-cluster warehouse (scaling out). This will automatically spin up additional clusters of the same size to handle the concurrent load and spin them down as demand decreases.
Step 2: optimize your queries and workloads
Inefficient queries are a primary driver of wasted compute credits. A poorly written query can run for minutes on a large warehouse when a well-written one could finish in seconds on a smaller one.
- Use the Query Profile: This is your best friend for optimization. Before trying to fix a slow query, run it and then analyse its performance in the Query Profile. This tool provides a detailed graphical breakdown of each step of query execution, showing you exactly where the bottlenecks are (e.g., a table scan that should be a prune, an exploding join).
- Avoid
SELECT *: Only select the columns you actually need. Pulling unnecessary columns increases I/O and can prevent Snowflake from performing "column pruning," a key optimization technique. - Be careful with
JOINs: Ensure you are joining on keys that are well-distributed. Accidental Cartesian products (cross-joins) are a notorious cause of runaway queries that can burn through credits. - Materialize complex views: If you have a complex view that is queried frequently, consider materializing it into a table. While this uses more storage, the compute savings from not having to re-calculate the view on every query can be substantial. Use Materialized Views for this, as Snowflake will automatically keep them up-to-date.
Step 3: manage your data storage lifecycle
While cheaper than compute, storage costs can creep up. Proactive data management is key.
- Configure Time-Travel Sensibly: Do you really need 90 days of Time-Travel for every table? For staging tables or transient data, a 1-day retention period is often sufficient. Align the Time-Travel window with your actual business requirements for data recovery.
- Use Transient and Temporary Tables: For data that doesn't need to be recovered (like staging data from an ELT process), use transient tables. These tables do not have a Fail-safe period and only have a Time-Travel period of 0 or 1 day. This can significantly reduce your storage footprint for intermediate data.
- Periodically Review and Purge Data: Implement a data retention policy and periodically archive or delete data that is no longer needed for analysis.
Step 4: maximize caching to get free compute
Snowflake has multiple layers of caching that can dramatically reduce credit consumption if leveraged correctly. When a query result is served from a cache, it consumes zero compute credits.
- The Result Cache: Snowflake automatically caches the results of every query you run. If another user submits the exact same query within 24 hours (and the underlying data has not changed), Snowflake returns the cached result almost instantly without starting a warehouse. This is perfect for popular dashboards where many users view the same report.
- Local Disk Cache (Warehouse Cache): When a warehouse executes a query, it caches the data it retrieved from storage on its local SSD. If a new query requires some of the same data, it can be read from this much faster local cache instead of remote storage, speeding up the query and reducing compute time. This cache is cleared when the warehouse is suspended.
Step 5: implement robust governance and monitoring
You can't optimize what you can't measure. Use Snowflake's built-in tools to monitor usage and enforce budgets.
- Set up Resource Monitors: This is your primary safety net. A Resource Monitor can be assigned to one or more warehouses to track their credit consumption. You can configure it to send alerts at certain thresholds (e.g., 75% of budget) and, most importantly, to suspend the warehouse when it hits its limit, preventing runaway spending.
- Analyse your usage data: Snowflake provides a wealth of metadata in the
SNOWFLAKEdatabase, specifically within theACCOUNT_USAGEschema. Views likeWAREHOUSE_METERING_HISTORY,QUERY_HISTORY, andSTORAGE_USAGEare invaluable. Query this data to find your most expensive queries, identify your busiest warehouses, and track your storage costs over time. - Tag everything for cost allocation: Use Snowflake's tagging feature to assign metadata tags to warehouses, databases, and other objects. You can tag objects by department (
finance,marketing), project, or user. This allows you to query the usage views and accurately allocate costs back to the teams responsible, creating accountability.
Bringing it all together
So what’s your next step? These five practices will help you reduce costs and build smarter habits, but turning them into measurable savings at scale takes more than a checklist. It requires the right expertise and execution.
For example, a leading financial services company was spending more than $800K per month on cloud costs with no clear view of where the money was going. Within 90 days of working with our experts, they gained full visibility, reduced ingestion latency by 80%, and built a governed, AI-ready platform while bringing costs back under control.
👉 Read the full case study here
At Snowstack, we bring certified Snowflake expertise and proven delivery methods to help enterprises cut spend, improve performance, and prepare their platforms for AI and advanced analytics.

How Snowflake is different from other databases: 3 architecture advantages for modern data teams
Some companies still run databases like it’s 1999. Others have adopted cloud-native architectures that cut costs in half and double performance. Guess who’s winning?
Some companies still run databases like it’s 1999. Others have adopted cloud-native architectures that cut costs in half and double performance. Guess who’s winning?
Traditional databases force a trade-off between performance and budget. Collaboration still means passing around CSVs. Forward-thinking organizations have shifted to Snowflake’s cloud-native architecture, which scales instantly, operates securely, and keeps costs under control. But what truly sets Snowflake apart from traditional databases or even other cloud data platforms?
In this blog, we’ll break down three key architectural advantages that make Snowflake a game-changer for businesses that want to migrate to the cloud.
But first, what is a cloud-native database?
A cloud-native database is designed from the ground up for the cloud. Unlike traditional databases that were adapted from on-premise systems, cloud-native platforms are purpose-built to take advantage of the cloud’s strengths: scalability, flexibility, and resilience.
They scale horizontally by adding capacity in parallel instead of relying on bigger machines. They automatically adjust resources up or down based on demand, so you only pay for what you use. They also come with built-in high availability through data replication and automated recovery.
In short, a cloud-native database removes the rigid trade-offs of legacy systems and gives modern businesses the performance, efficiency, and reliability they need to stay competitive.
Snowflake's architecture: 3 strategic advantages
Snowflake isn’t just faster or cheaper. It’s built differently. The three architectural choices below explain why modern data teams trust Snowflake to scale, collaborate, and deliver insights in ways legacy systems never could.
1. Separation of storage and compute: elasticity without trade-offs
Most databases tie storage and compute together. Need more power to run quarterly reports? You’ll also pay for storage you don’t use. Want to keep historical data at a lower cost? You’re still paying for compute you don’t actually need.
Snowflake's Solution: Snowflake's architecture fundamentally decouples storage and compute layers, creating unprecedented flexibility for modern data teams.
- You can scale compute resources up or down independently of your data storage.
- Multiple workloads (e.g., data ingestion, analytics queries, and reporting) can run simultaneously on isolated compute clusters without performance conflicts.
- You can assign different warehouses (compute clusters) to different teams or departments without worrying about concurrency issues or resource contention.
Business impact: Imagine a BI team that runs heavy dashboards while a data science team trains models on the same data. The beauty behind this separation is that both can operate without stepping on each other’s toes. This translates to faster time-to-insight, cost control, and happy teams who aren’t waiting for resources to free up.
2. Multi-cluster shared data architecture: built for collaboration and scale
Traditional databases become performance challenge as more users access the system. Query response times degrade, teams queue for resources, and data silos emerge as different departments seek workarounds.
Snowflake's Solution: Snowflake’s multi-cluster shared data model allows any number of users and tools to access the same single source of truth without performance degradation. The platform automatically manages concurrency through intelligent multi-cluster compute scaling.
What this means for data teams:
- Unlimited concurrency: Teams don’t have to wait in line to access the warehouse. Snowflake automatically adds compute clusters as needed and scales them back down when demand drops.
- Cross-team collaboration: Data Engineers, analysts, and ML engineers can work off the same dataset in real time, using SQL, Python, or third-party tools.
- Data sharing across organizations: Snowflake’s architecture supports secure data sharing with external partners or vendors without copying or moving data. You simply grant access.
Business impact: This makes Snowflake not just a warehouse but a collaboration platform for data. Whether your team is distributed across continents or collaborating with external partners, Snowflake enables fast, consistent, and secure access to data.
3. Zero management with cloud-native infrastructure
Managing a traditional database means dealing with provisioning, tuning, indexing, patching, and more. These tasks require specialized DBAs and often lead to downtime, delays, and human error.
Snowflake flips the script with a “zero-management” approach.
Thanks to its fully managed SaaS model:
- No infrastructure to manage. Snowflake runs entirely in the cloud (on AWS, Azure, or GCP), abstracting away the underlying hardware.
- Automatic tuning and optimization. No need to manually set indexes or optimize queries, Snowflake handles that under the hood.
- Security and compliance out of the box. Features like automatic encryption, role-based access control, and compliance with standards (HIPAA, GDPR, SOC 2) are built-in.
Business impact: This lets your team focus on data and insights, not on maintenance. IT teams no longer need to waste time on low-value operational tasks. Instead, they can accelerate innovation and reduce costs.
Snowflake vs. the competition: why architecture matters
In 2025, your data architecture is more than a technical choice. It is a strategic decision that defines how quickly your organization can compete, innovate, and scale. When you compare modern data platforms, Snowflake's architectural advantages become clear when compared to alternatives:
How Snowflake’s architecture drives results?
Snowflake’s architecture solves the trade-offs that hold traditional databases back and delivers flexibility that many cloud platforms still lack. But technology alone is not enough. The difference comes from how you implement it.
Take the case of a $200M pharmaceutical distributor. Their teams were stuck with siloed on-prem systems, compliance risks, and reports that took hours to run. Our Snowflake-certified experts helped them migrate to Snowflake’s cloud-native architecture with a single governed data layer, dedicated compute clusters, and built-in role-based access. In just 90 days, reporting was 80% faster, the architecture was ready for AI and advanced analytics, and teams finally worked from the same source of truth.
👉 Read the full case study here
Making Snowflake’s architecture work for your business
Every organization’s data challenges look different, but the goal is the same: to turn Snowflake into a platform that delivers measurable results. That’s where Snowstack comes in. We bring proven experience from complex projects in finance, pharma, and FMCG. This gives clients confidence that their architecture is designed for scale, collaboration, and compliance from day one. Our role goes beyond implementation. We act as a long-term partner who helps data teams adapt, optimize, and grow with Snowflake as business needs evolve.

Best practices for protecting your data: Snowflake role hierarchy
One stolen password can bring down an entire enterprise. As businesses move more of their data to the cloud and centralize it on platforms like Snowflake, a critical question emerges: who should have access, and how do you manage it at scale without slowing the business or weakening security?
One stolen password can bring down an entire enterprise. The 2024 Snowflake breaches revealed how fragile weak access controls are, with 165 organizations and millions of users affected. The breaches were not the result of advanced attacks. They happened because stolen passwords went unchecked, and multi-factor authentication was missing. As businesses move more of their data to the cloud and centralize it on platforms like Snowflake, a critical question emerges: who should have access, and how do you manage it at scale without slowing the business or weakening security?
In this article, we’ll break down the Snowflake Role Hierarchy, explain why it matters, and share best practices for structuring roles that support security, compliance, and day-to-day operations.
What is Snowflake’s role hierarchy?
Snowflake’s role hierarchy is a structured framework that defines how permissions and access controls are organized within the platform. In Snowflake, access to data and operations is governed entirely by roles. Using the Role-Based Access Control (RBAC) model, you grant privileges to roles, and then assign users to those roles, simplifying administration, ensuring consistency, and making audit access easier. RBAC is generally recommended for production environments and enterprise-level governance.
The hierarchy operates on a parent-child relationship model where higher-level roles inherit privileges from subordinate roles, creating a tree-like structure. This structure provides granularity, clarity, and reusability, but it requires thoughtful planning to avoid sprawl or over-permissioned users.
Core components of Snowflake RBAC
- Roles: The fundamental building blocks that encapsulate specific privileges
- Privileges: Defined levels of access to securable objects (databases, schemas, tables)
- Users: Identities that can be assigned roles to access resources
- Securable Objects: Entities like databases, tables, views, and warehouses that require access control
- Role Inheritance: The mechanism allowing roles to inherit privileges from other roles
Understanding Snowflake's system-defined roles
Understanding the default role structure is crucial for building secure hierarchies:
ACCOUNTADMIN
- Root-level access to all account operations
- Can view and manage billing and credit data
- Should be tightly restricted to emergency use only
- Not a "superuser" - still requires explicit privileges for data access
SYSADMIN
- Full control over database objects and users
- Recommended parent for all custom roles
- Manages warehouses, databases, and schemas
SECURITYADMIN
- Manages user and role grants
- Controls role assignment and privilege distribution
- Essential for maintaining RBAC governance
Custom roles
- Created for specific teams or functions within an organization (e.g
ANALYST_READ_ONLY, ETL_WRITER).
Best practices for designing a secure Snowflake role hierarchy
A well-structured role hierarchy minimizes risk, supports compliance, and makes onboarding/offboarding easier. Here’s how one should do it right:
1. Follow the Principle of Least Privilege
Grant only the minimum required permissions for each role to perform its function. Avoid blanket grants like GRANT ALL ON DATABASE.
Do this:
- Specific, targeted grants
- Avoid cascading access down the role tree unless absolutely needed
- Regularly audit roles to ensure they align with actual usage
GRANT SELECT ON TABLE SALES_DB.REPORTING.MONTHLY_REVENUE TO ROLE ANALYST_READ;
GRANT USAGE ON SCHEMA SALES_DB.REPORTING TO ROLE ANALYST_READ;
GRANT USAGE ON DATABASE SALES_DB TO ROLE ANALYST_READ;Not this:
- Overly broad permissions
GRANT ALL ON DATABASE SALES_DB TO ROLE ANALYST_READ;Why does it matter?
Least privilege prevents accidental (or malicious) misuse of sensitive data. It also supports data governance and compliance with various regulations like GDPR or HIPAA.
2. Use a layered role design
Design your roles using a layered and modular approach, often structured like this:
- Functional Roles (what the user does):
CREATE ROLE ANALYST_READ;
CREATE ROLE ETL_WRITE;
CREATE ROLE DATA_SCIENTIST_ALL;- Environment Roles (where the user operates)
CREATE ROLE DEV_READ_WRITE;
CREATE ROLE PROD_READ_ONLY;Composite or Team Roles (Group users by department or team, assigning multiple functional/environment roles under one umbrella)
CREATE ROLE MARKETING_TEAM_ROLE → includes PROD_READ_ONLY + ANALYST_READ3. Avoid granting privileges directly to users
Always assign privileges to roles and not users. Then, assign users to those roles.
Why it matters?
This keeps access transparent and auditable. If a user leaves or changes teams, simply revoke or change the role. There’s no need to hunt down granular permissions.
4. Establish consistent naming conventions
Enforce naming conventions as consistent role and object naming makes automation and governance far easier to scale.
Recommended Naming Pattern:
- Access Roles:
{ENV}_{DATABASE}_{ACCESS_LEVEL}(e.g.,PROD_SALES_READ) - Functional Roles:
{FUNCTION}_{TEAM}(e.g.,DATA_ANALYST,ETL_ENGINEER) - Service Roles:
{SERVICE}_{PURPOSE}_ROLE(e.g.,FIVETRAN_LOADER_ROLE)
5. Use separate roles for Administration vs. Operations
Split roles that manage infrastructure (e.g., warehouses, roles, users) from roles that access data.
- Admins:
SYSADMIN,SECURITYADMIN - Data teams:
DATA_ENGINEER_ROLE, ANALYST_ROLE,etc.
Why it matters? This separation of duties limits the potential impact of security incidents and supports audit compliance. Administrators should not have access to sensitive data unless it's absolutely necessary for their role.
6. Secure the top-level roles
Roles like ACCOUNTADMIN and SECURITYADMIN should be assigned to the fewest people possible, protected with MFA, and monitored for any usage.
Implementation Checklist:
- Limit
ACCOUNTADMINto 2-3 emergency users maximum - Enable MFA for all administrative accounts
- Set up monitoring and alerting for admin role usage
- Regular access reviews and privilege audits
- Document and justify all administrative access
Monitoring, auditing & compliance: keeping your Snowflake hierarchy healthy
Even the best-designed role trees can get messy over time. Here’s how to maintain security:
1. Regular access reviews
Implement quarterly access reviews to maintain security hygiene:
- Role Effectiveness Analysis: Identify unused or over-privileged roles
- User Access Validation: Verify users have appropriate role assignments
- Privilege Scope Review: Ensure roles maintain least privilege principles
- Compliance Mapping: Document role mappings to business functions
2. Logging and monitoring
Enable Access History and Login History in Snowflake to track activity and implement automation tools for role assignments during employee transitions.
3. Onboarding/offboarding automation
Implement automation tools or scripts to efficiently manage role assignments during employee transitions.
4. Object Tagging for enhanced security
Use object tagging to classify sensitive data and control access accordingly.
Measuring RBAC Success: Key Performance Indicators
1. Security Metrics
- Access Review Coverage: % of roles reviewed quarterly
- Privilege Violations: Number of excessive privilege grants identified
- Failed Authentication Attempts: Monitor for unauthorized access patterns
- Role Utilization Rate: % of active roles vs. total created roles
2. Operational Metrics
- User Onboarding Time: Average time to provision new user access
- Role Management Efficiency: Time to modify/update role permissions
- Audit Response Time: Speed of access review and remediation
- Automation Coverage: % of role operations automated vs. manual
3. Compliance Metrics
- SOC 2 Readiness: Role hierarchy documentation completeness
- GDPR/Data Privacy: Data access control effectiveness
- Industry Compliance: Sector-specific requirement adherence
- Change Management: Role modification approval and documentation
Future-Proofing Your RBAC Strategy
The way you manage access today will define how secure and scalable your Snowflake environment is tomorrow. The strength of Snowflake’s RBAC model lies in its flexibility, but that power comes with responsibility. As AI features mature, as multi-cloud deployments become the norm, and as regulators tighten expectations around data privacy, static role hierarchies quickly fall behind. A poorly structured role hierarchy can lead to data leaks, audit failures, higher operational costs, and stalled innovation.
At Snowstack, we specialize in building RBAC strategies that are not only secure today but ready for what’s next. Our team of Snowflake-first engineers has designed role models that scale across continents, safeguard sensitive data for regulated industries, and enable AI without exposing critical assets. We continuously monitor Snowflake’s roadmap and fold new security capabilities into your environment before they become business risks.
Don’t wait for the next breach to expose the cracks in your access controls. Let’s design an RBAC strategy that keeps you secure, compliant, and future-ready.
.webp)
Choosing the right Snowflake partner: what to look for in 2025
In 2025 Snowflake is more than a database. It has become the foundation for data, AI, and applications. With almost 10,000 active Snowflake customers** globally and more than 850 certified services partners, the challenge isn't finding a partner. It's finding the right partner who can deliver tangible results while building a sustainable, cost-effective data platform.
In 2025 Snowflake is more than a database. It has become the foundation for data, AI, and applications. With almost 10,000 active Snowflake customers** globally and more than 850 certified services partners, the challenge isn't finding a partner. It's finding the right partner who can deliver tangible results while building a sustainable, cost-effective data platform.
In this blog, we outline the key criteria to evaluate when selecting a Snowflake partner in 2025 and explain how the choice you make will directly shape the success of your data initiatives.
What is a Snowflake consulting partner?
A Snowflake consulting partner is a certified services provider that specializes in implementing, optimizing, and managing Snowflake's Data Cloud platform. These partners range from global system integrators managing petabyte-scale deployments to boutique firms focusing on specific industries or Snowflake features.
Snowstack is built for this role. As a Snowflake-first partner, our focus is entirely on helping organizations succeed with the platform. We design and deliver environments that are secure, cost-efficient, and ready for AI. Because we focus exclusively on Snowflake, we bring a level of technical depth, delivery discipline, and industry knowledge that generalist consultancies cannot match.
Best criteria for selecting your Snowflake partner in 2025:
In 2025, not every Snowflake partner delivers the same results. Your choice can determine whether your data projects drive real business value or slip into delays, cost overruns, and a loss of confidence across the organization. Here is what to look for when evaluating a partner’s approach:
1. Delivery methodology as the deciding factor
The single biggest predictor of Snowflake implementation success isn't the partner's brand recognition or size. It's how they deliver. In our analysis of successful Snowflake projects, delivery methodology consistently emerges as the most critical differentiator.
Ask prospective partners:
- What is their delivery rhythm? Look for agile methodologies with short, business-visible delivery cycles rather than waterfall approaches with big reveals at the end
- How do they balance technical debt vs. time to market? The best partners prioritize early wins while building sustainable architecture
- Do they work in short iterations with quick business feedback? Partners should deliver "first dashboard live in 4 weeks" rather than 6-month black box projects
- Can they balance governance and speed? Avoid partners who treat governance as an afterthought or create excessive bottlenecks
What to look for: Partners with repeatable, transparent, and well-documented processes that adapt to your internal structure while maintaining consistent quality standards.
2. Snowflake-native thinking vs. generic cloud advice
The difference between Snowflake specialists and generalist cloud consultants becomes evident in architecture decisions, cost optimization strategies, and feature utilization.
Depth of platform knowledge matters:
- Do they understand Snowflake's native capabilities? Look for expertise in Streams & Tasks, Snowpark, Secure Sharing, Cortex AI, and Dynamic Tables
- Do they optimize for platform strengths? The best partners design for Snowflake's unique architecture rather than forcing legacy patterns
- Can they demonstrate platform-specific know-how? Ask about credit optimization, role hierarchy design, cost guardrails, and performance tuning strategies
- Are they current with latest features? Snowflake releases new capabilities quarterly partners should stay updated
Evaluation technique: Ask candidates to walk through a specific Snowflake architecture decision and explain their reasoning. Generic answers reveal generalist thinking.
A leading financial services firm was spending more than 800,000 dollars per month on cloud costs with little visibility into where the money was going. Within 90 days, we delivered a governed Snowflake platform that reduced data ingestion latency by 80%, enabled AI readiness, and put full cost controls in place.
3. Time to value: shipping early and often
The era of 6-month data projects with big reveals is over. Modern Snowflake implementations should deliver value incrementally, building momentum and stakeholder confidence throughout the process.
Measurement criteria: Ask to see examples of their delivery cadence, backlog management practices, and documentation standards. Partners should have concrete examples of incremental value delivery. For instance, one of our clients, a regional pharma distributor, moved from legacy on-premises systems to a Snowflake-native platform. Instead of a single large rollout, we delivered in focused iterations. Dashboards came first, followed by finance and supply chain integrations, and advanced governance policies were in place before production go-live. This approach kept stakeholders engaged and satisfied.
5. Team structure and location strategy
The 2025 landscape offers multiple delivery models, each with distinct advantages and trade-offs. However critical questions beyond geography:
- Will you get named engineers or a rotating bench? Consistency matters for knowledge retention
- Is there a lead you can trust? Avoid partners who channel everything through project managers without technical depth
- How do they ensure knowledge retention over time? Look for documentation practices and handover procedures
6. Embedded Support vs. one-and-done projects
Snowflake is a living platform that evolves continuously. Your partner relationship shouldn't end at go-live. Successful implementations require ongoing optimization, new source integration, and platform evolution support.
Post-implementation needs include:
- Onboarding new data sources as business requirements evolve
- Evolving data models based on changing business logic
- Performance optimization as data volumes and user counts grow
- Feature adoption as Snowflake releases new capabilities
- Cost optimization through usage pattern analysis
Partner support models to evaluate:
- Embedded engineers: Dedicated resources working as extended team members
- Managed services: Full platform management with SLA guarantees
- Retainer arrangements: On-demand expertise for specific needs
- Training and enablement: Knowledge transfer to build internal capabilities
Key consideration: Partners offering only project-based work may leave you stranded when you need ongoing support most. Unlike project-only vendors, our experts stay engaged long after go-live. Our model ensures that as your data platform grows, you have continuous access to the same experts who built it, ready to integrate new sources, optimize costs, and adopt new Snowflake features.
7. Governance, cost control, and trust
Platform ownership extends far beyond delivering functional pipelines. Successful Snowflake implementations require robust governance frameworks, proactive cost management, and enterprise-grade security practices.
Essential governance capabilities:
- Role-based access control and masking policies aligned with your security requirements
- Cost observability and alerting systems to prevent budget surprises
- Compliance framework alignment (SOC 2, GDPR, HIPAA, PCI-DSS)
- CI/CD and documentation practices for long-term maintainability
- Data quality and lineage tracking for trustworthy analytics
Without a solid governance foundation, a Snowflake platform may appear to work at first but will not scale sustainably. In our blog you can explore this topic in depth, but here is a snapshot of the cost control practices we recommend.
- Warehouse auto-suspend and auto-resume configuration
- Query result caching optimization
- Clustering key recommendations
- Storage optimization strategies
- Credit usage monitoring and alerting
8. AI Readiness and responsible adoption
Snowflake is rapidly evolving into a core platform for AI and machine learning, but realizing its potential requires more than connecting models to data. Successful implementations demand partners who can design secure, scalable, and responsible AI foundations inside Snowflake.
Essential AI readiness capabilities:
- Integration of Cortex AI for LLM-based applications with enterprise controls
- Snowpark ML workflows for efficient model training and deployment
- Feature store design for consistent and reusable machine learning pipelines
- AI governance frameworks to manage bias, privacy, and ethical use
Without a clear AI strategy built on trusted data, organizations face wasted investment, compliance risks, and a loss of stakeholder confidence. One regional pharma distributor overcame these challenges by migrating to Snowflake with us. With Snowpark ML workflows and governed feature stores, they got accurate demand forecasting and optimized their supply chain while ensuring responsible AI adoption.
Industry-Specific Considerations
Different industries have unique requirements that affect partner selection:
Financial Services: Emphasis on regulatory compliance, data residency, audit trails, and risk management frameworks.
Healthcare & Life Sciences: Focus on HIPAA compliance, data privacy, clinical data standards, and FDA validation support.
Manufacturing: Requirements for IoT data integration, real-time analytics, supply chain optimization, and operational intelligence.
Retail & E-commerce: Need for customer 360 views, real-time personalization, inventory optimization, and marketing analytics.
Technology Companies: Emphasis on developer productivity, API integrations, event streaming, and product analytics.
Snowflake partner red flags to avoid in 2025
Watch for these warning signs during partner evaluation:
Who is the right Snowflake partner for you and your business in 2025?
Most data migrations don’t fail because of the technology. They fail because of poor execution and weak partner choices. When projects stall, the real cost is not just overspending. It is delayed initiatives, frustrated stakeholders, and lost confidence in the value of data.
In 2025, choosing a Snowflake partner is no longer about ticking boxes for certifications or chasing the lowest cost. It is a strategic decision that will shape whether your data initiatives deliver real business impact or fall short. At Snowstack, we combine deep Snowflake expertise with proven delivery methods, transparent team structures, and a focus on long-term governance and optimization. We help organizations move beyond one-off implementations to build scalable, AI-ready platforms that deliver measurable results and lasting trust in data.
Top data insights, delivered to your inbox

Save on your Snowflake costs
Use our Snowflake Savings Calculator to cut costs, boost efficiency, and drive higher profitability.

