-- Initial setup: roles and permissions
USE ROLE ACCOUNTADMIN;
CREATE ROLE analyst;
GRANT USAGE ON DATABASE my_db TO ROLE analyst;
GRANT USAGE ON SCHEMA my_db.public TO ROLE analyst;
GRANT SELECT ON ALL TABLES IN SCHEMA my_db.public TO ROLE analyst;
CREATE USER my_analyst PASSWORD = '****' DEFAULT_ROLE = analyst;
GRANT ROLE analyst TO USER my_analyst;
Best Practices
Never use ACCOUNTADMIN for daily work
Create role hierarchy: SYSADMIN > analyst > reader
Use network policies for IP restrictions
Enable MFA
✏️ Exercise: Create a new role, user, and grant appropriate permissions. Log in as that user and verify you can query the database.