For larger organizations, managing permissions on individual users can be time consuming. To help administrators of larger teams, we’ve introduced Teams, SELECT Organization Roles, Monitor Editor Roles and Usage Group Roles. Let’s cover each of those one-by-one:

Teams

Teams allow you to group users together, and assign roles to that team as a whole.

Editable objects (like Monitors) can now optionally be assigned to teams, meaning that Users with the relevant team membership can create and edit those Monitors without needing having access to other monitors on the account. Importantly, those Monitors also act with the roles of the the team they belong to.

SELECT Organization Roles

With the introduction of Teams it becomes even more important to have clarity on who can create, manage and delete Teams and Users. This includes access related permissions like managing SSO Groups. To centralize this, we’ve created SELECT Organization Roles, which users will require to perform these actions.

Monitor Editor Roles

By popular demand, we’ve also introduced a role in between the existing Viewer and Editor roles, called the Monitor Editor. As you’d expect, this role grants access to edit account Monitors, but not to perform other Editor actions like editing Usage Groups.

Usage Group Roles

NOTE: Usage Group Roles are currently an add-on feature. Contact support for eligibility.

For larger organizations, who may have multiple teams co-existing on a single Snowflake Account, it can be important to restrict how much each of those team users can view of activity in other teams, or prevent them having visibility of the overall account spend. To enable this we’ve introduced Usage Group Roles. Users with one of these roles will only be able to view usage data for workloads tagged in that Usage Group. They’ll still be able to explore the rest of the SELECT UI, but every tab will have their visibility pre-filtered to only the data their role permits them to access.

Importantly, these roles work especially well with the new Teams functionality to enable segregated groups of users, who can still manage their usage, and use Monitors - without requiring access to the wider account.

For more details on all of these changes, check out our updated docs, or reach out to support.