Snowflake Access Control: Mastering the Features for Data Privacy and Regulatory Compliance

Description

Intermediate user level Table of Contents About the Author About the Technical Reviewer Acknowledgments Introduction Part I: Background Chapter 1: What Is Access Control? Access Control Paradigms Role-Based Access Control (RBAC) Data Democratization Principle of Least Privilege (PLP) Rule-Based Access Control Attribute-Based Access Control (ABAC) Principle of Separation of Duties Access Control Methods Groups or Roles Lookup Tables and Mappings Miscellaneous Rules Wrapping Up Chapter 2: Data Types Requiring Access Control Personally Identifiable Information General PII Multimedia Protected Health Information (PHI) Financial Information Social Security Numbers and National Identity Numbers Passwords Non-PII Personal Data Anonymized Data Tokenized Data Tokenizing with Mock Data Using a One-Way Hash Encrypting Data Aggregated Data Internal Non-sensitive Information Publicly Available Information Other Sensitive Data Free Text Fields Financial Reporting Data Key Takeaways Chapter 3: Data Privacy Laws and Regulatory Drivers Internet Privacy GDPR Definitions Who Is Affected? Special Category of Personal Data Data Processing Principles Data Minimization Storage Limitation Integrity and Confidentiality Handling Data with GDPR Compliance APPI Definitions Who Is Affected? Handling Data with APPI Compliance CCPA Definitions Who Is Affected? Handling Data with CCPA Compliance US State General Privacy Regulations SOX Definitions Who Is Affected? Handling Data with SOX Compliance SOX Scope Creating Financial Reports Restricting Access HIPAA Definitions Who Is Affected? Handling Data with HIPAA Compliance Future Regulations Generalizing Data Privacy Regulations Key Takeaways Sources Chapter 4: Permission Types Permission Type Concepts Privilege Scope Categories Global and Account Databases, Warehouses, and Other Account Objects Schemas Schema Objects Snowflake Permission Types General Global and Account Databases Schemas Tables and Views Warehouses Granting and Revoking Privileges Granting Privileges Revoking Privileges Privilege Constraints Permission Modifiers All Future Grants With Grant Option Working with Permissions Read Write Dataset Admin System Admin Account Admin Other Specialized Roles Key Takeaways Part II: Creating Roles Chapter 5: Functional Roles: What a Person Does What Are Roles in Snowflake? How Many Users Should Be in Each Role? What Are Functional Roles? Using Functional Roles for Job Function Using Functional Roles for a Dataset Why Should I Use Functional Roles? How Do I Use Functional Roles? Who Owns a Functional Role? Key Takeaways Chapter 6: Team Roles: Who a Person Is What Are Team Roles? Why Use Team Roles? How Do I Use Team Roles? Who Owns Team Roles? When Should I Use Team Roles and When Should I Use Functional Roles? How Can I Use Team Roles and Functional Roles Together? Key Takeaways Chapter 7: Assuming a Primary Role What Is a Primary Role? Default Roles How Do I Assume a Primary Role? Using SQL Using the Snowflake User Interface Using Python Connector Other Services How Do Primary Roles Work? Key Takeaways Chapter 8: Secondary Roles What Are Secondary Roles? Why Should I Use Secondary Roles? How Do I Use Secondary Roles? Enabling Secondary Roles for Users Enabling Secondary Roles on Integrations Logging and Ownership Disabling Secondary Roles Key Takeaways Part III: Granting Permissions to Roles Chapter 9: Role Inheritance What Is Role Inheritance? Why Should I Use Role Inheritance? How Do I Use Role Inheritance? Creating a Hierarchy Functional Role Hierarchy Team Role Hierarchy Functional and Team Role Hierarchy Privilege Hierarchy Role Inheritance and Specialty Roles End User Experience Naming Conventions Role Inheritance and Secondary Roles Logging with Role Inheritance Key Takeaways Chapter 10: Account- and Database-Level Privileges Account Level User and Role Management Creating Account-Level Objects Monitoring Activity Miscellaneous Database Level Key Takeaways Chapter 11: Schema-Level Privileges What Is Schema-Level Access? Why Use Schema-Level Access? Schema-Level Privileges Administrative Privileges Managed Access Monitoring Privileges Read Privileges Write Privileges Data Engineering Platform Privileges Bulk Grants on Schema Objects All Future Grants Mapping Roles to Schemas Team Roles Functional Roles Specialized Schemas Key Takeaways Chapter 12: Table- and View-Level Privileges What Is Table-Level Access Control? Why Use Table-Level Access Control? What Are the Different Types of Views? Standard Views Materialized Views Secure Views Table- and View-Level Privileges Read Privileges Write Privileges Admin Privileges How Do I Implement Table-Level Access Control? How Does Table Level Work with Schema Level? Key Takeaways Chapter 13: Row-Level Permissioning and Fine-Grained Access Control What Is Row-Level Permissioning? Why Use Row-Level Permissioning? How Do I Use Row-Level Permissioning? Row Access Policies vs. Secure Views Creating Row Access Policies Creating a Basic Row Access Policy Creating a Row Access Policy Using a Mapping Table Creating More Complex Row Access Policies Removing a Row Access Policy Altering Row Access Policies Creating a Python Script to Generate Row Access Policies Constraints Using Secure Views Creating a Basic Secure View Creating a Secure View Using a Mapping Table Creating More Complex Secure Views Creating a Python Script to Generate Secure Views Tips and Tricks User-Defined Functions Aggregate Statistics Row-Level Permissioning with Secondary Roles Key Takeaways Chapter 14: Column-Level Permissioning and Data Masking What Is Column-Level Permissioning? Why Use Column-Level Permissioning? How Do I Implement Column-Level Permissioning? Using Dynamic Masking Policies Creating a Basic Masking Policy Creating a Python Script to Generate Masking Policies Masking JSON Data Constraints Using Secure Views Creating a Basic Secure View Creating a Python Script to Generate Secure Views Using Tokenization Combining Column-Level and Row-Level Permissions Tips and Tricks Categorize Data Types Create UDFs Use Consistent Naming Conventions Key Takeaways Part IV: Operationally Managing Access Control Chapter 15: Secure Data Sharing What Is Secure Data Sharing? Why Use Secure Data Shares? How Do I Use Secure Data Shares? Provider Account Create a Share Grant Object Privileges to Share Verify Share Privileges Optionally Create a Reader Account Share with External Account Consumer Account Create Database from Share Grant Privileges on Share Revoking Access and Dropping Shares Revoking Object Privileges from a Share Revoking Access to a Share Dropping a Share Constraints Secure Views Cross-Region and Cross-Cloud Storage Platform CURRENT_USER and CURRENT_ROLE Functions Granular Access Control with Shares Access Control by Account Consuming Account RBAC Key Takeaways Chapter 16: Separating Production from Development What Does It Mean to Separate Production from Development? Why Separate Production from Development? How Do I Separate Production from Development? Types of Users to Support Platform Developers Pipeline Developers Working with External Sources SQL Developers Transforming Data Visualization Developers Creating a Dev Environment Using Separate Schemas Using Separate Databases Using Separate Accounts Populating Dev Data Production Data in Separate Schemas Production Data in Separate Databases Production Data in a Separate Account Synthetic Data RBAC in Dev For All Setups Separate Schemas Separate Database Separate Account Connecting to Dev Key Takeaways Chapter 17: Upstream and Downstream Services Upstream Services What Are Upstream Services? How Do I Maintain RBAC with Upstream Services? Data Sources Compute and Orchestration Cloud Storage Downstream Services What Are Downstream Services? How Do I Maintain RBAC with Downstream Services? Services That Are Upstream and Downstream Key Takeaways Chapter 18: Managing Access Requests Role Creation and Population Role Discovery Requests for Existing Roles Role Owners With Grant Option Using a Ticketing System Building a Custom Tool Key Takeaways Index