Snowflake Admin

Quick answer

A Snowflake admin (Snowflake administrator) is the person who keeps a Snowflake account secure, affordable and running: they manage users and roles, warehouses and credit limits, security policies, monitoring and recovery. Snowflake removes old DBA chores like patching, backups and index design, so the admin job shifts to governance, access, cost and reliability. In India, admin roles sit in IT services firms and global capability centres (GCCs), and the lowest experience ask we saw in October 2026 job descriptions was 2 to 5 years.

Key takeaways

1. Snowflake admin at a glance

Short answer: A Snowflake admin owns five areas: access, compute and cost, security, data protection and monitoring, and each maps to a few Snowflake features you must know well.

New to the platform itself? Read what Snowflake does first, then come back. This table is your map for the rest of the post.

Here is how a typical admin week flows:

2. What does a Snowflake administrator do?

Short answer: A Snowflake administrator manages who can do what, how much compute is used, how sensitive data is protected and how fast the team can recover from mistakes, mostly through SQL and Snowsight.

On older databases like Oracle or Teradata, a DBA spends time on upgrades, storage, backups, indexes and partitions. Snowflake handles those for you. Its architecture has a storage layer, a compute layer of virtual warehouses and a cloud services layer for security, metadata and query optimisation; our Snowflake architecture diagram post explains all three. So the admin role moves up a level.

A real admin job description shows the scope well. An Infosys "Snowflake admin" listing for Hyderabad, Pune and Bengaluru (2 to 5 years, seen on Naukri on 25 October 2026) asked the admin to:

The same JD asked for hands-on skill in security and user management, virtual warehouses and resource monitors, query tuning, Time Travel and Fail-safe, SQL and one cloud (AWS, Azure or GCP).

Some quick definitions you will see all through this post:

Do you still need a Snowflake admin?

Yes, but the role is often shared. Small teams let a senior data engineer act as part-time admin. Large enterprises and banks in Hyderabad and Bengaluru GCCs usually have a platform or admin team, because RBAC, cost control and compliance never stop. On 25 October 2026, Naukri showed about 1,985 results for "snowflake administrator" across India. That is a keyword-match count, not a count of open jobs, and one recruiter listing was repeated across seven cities, but it shows the title is real.

3. System roles and RBAC in Snowflake

Short answer: Snowflake ships with seven system-defined roles, and good admins build custom roles under SYSADMIN instead of handing out ACCOUNTADMIN.

Snowflake supports three access models. In DAC (discretionary access control) every object has an owner who can grant access. In RBAC, privileges go to roles and roles go to users; this is the normal model. In UBAC (user-based access control), privileges go to users directly, and they only count when the user runs USE SECONDARY ROLES ALL (Snowflake access control overview, October 2026).

ACCOUNTADMIN vs SYSADMIN vs SECURITYADMIN

ACCOUNTADMIN sits on top and contains both SYSADMIN and SECURITYADMIN. SYSADMIN owns objects such as warehouses and databases. SECURITYADMIN owns grants. Snowflake's setup guidance says to give ACCOUNTADMIN to more than one admin for safety, but to set a lower role such as SYSADMIN as their default role. It also says only USERADMIN or higher (or a role with CREATE ROLE on the account) can create roles, and recommends SECURITYADMIN for granting privileges and roles (Snowflake documentation, October 2026).

A simple role hierarchy

Build functional roles for each team (read-only for analysts and BI tools, transform for dbt jobs, load for ingestion tools) and grant them all up to SYSADMIN, so system admins can still manage every object those roles create. Simplified example (syntax from Snowflake's access control docs):

USE ROLE USERADMIN;
CREATE ROLE read_only COMMENT = 'Analysts and BI tools';
USE ROLE SECURITYADMIN;
GRANT ROLE read_only TO ROLE sysadmin;
GRANT USAGE ON WAREHOUSE bi_wh TO ROLE read_only;
GRANT USAGE ON DATABASE sales_db TO ROLE read_only;
GRANT USAGE ON SCHEMA sales_db.mart TO ROLE read_only;
GRANT SELECT ON ALL TABLES IN SCHEMA sales_db.mart TO ROLE read_only;
GRANT SELECT ON FUTURE TABLES IN SCHEMA sales_db.mart TO ROLE read_only;
GRANT ROLE read_only TO USER priya;

The FUTURE TABLES grant saves you from re-granting every time a new table lands in the schema, which is one of the most common admin tickets.

4. User and access management: MFA and key-pair authentication

Short answer: In 2026 an admin must move every human user to MFA or another strong method and every service account to key-pair or other non-password authentication, because Snowflake is ending single-factor passwords in phases.

The MFA rollout timeline

Snowflake's MFA rollout page (October 2026) sets out three phases. Snowflake calls these dates estimates and enforces them on a rolling basis, so your account may switch at a different time inside each window.

Users with TYPE=SERVICE cannot use passwords at all. The rollout does not apply to reader accounts, trial accounts or Snowflake Postgres. As of October 2026 you are inside the final window, so treat any human user still signing in with only a password as urgent work.

Key-pair authentication for service users

Pipelines, dbt jobs and BI service accounts should use key-pair authentication. Snowflake's key-pair page (October 2026) says:

Simplified example (from the key-pair docs):

-- On your machine (shell):
-- openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
-- openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
ALTER USER etl_service SET RSA_PUBLIC_KEY='MIIB...';

Find users who still sign in with only a password

LOGIN_HISTORY in ACCOUNT_USAGE records the first and second authentication factor of every login. Simplified example:

SELECT user_name, reported_client_type, COUNT(*) AS logins
FROM SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY
WHERE event_timestamp >= DATEADD('day', -30, CURRENT_TIMESTAMP())
  AND first_authentication_factor = 'PASSWORD'
  AND second_authentication_factor IS NULL
  AND is_success = 'YES'
GROUP BY user_name, reported_client_type
ORDER BY logins DESC;

Every name on this list is a person or tool to move to MFA, key pairs or another strong method.

5. Warehouse management and resource monitors

Short answer: Admins control compute by choosing warehouse sizes, keeping auto-suspend on, separating workloads into different warehouses, and attaching resource monitors that notify or suspend when a credit quota is reached.

Warehouse sizes double in credits per hour at each step, from X-Small at 1 credit to 6X-Large at 512 credits per hour. Billing is per second with a 60-second minimum each time a warehouse starts, and auto-suspend and auto-resume are on by default (Snowflake documentation, October 2026). New standard warehouses default to Gen2 in regions where it is available, and Adaptive Warehouses, where Snowflake manages sizing and scaling for you, became generally available on AWS on 16 June 2026 (Enterprise Edition or higher). Multi-cluster warehouses for high concurrency also need Enterprise Edition or higher.

We cover sizes, multi-cluster scaling policies, Gen2 and query acceleration in depth in virtual warehouses in Snowflake. As an admin, your rules of thumb are:

How resource monitors work

A resource monitor tracks and limits the credits used by warehouses and the cloud services that support them. It does not cover serverless features or AI services; for those, Snowflake points you to budgets. Only ACCOUNTADMIN can create a resource monitor. You can have one account-level monitor, and each warehouse can belong to only one warehouse-level monitor. Actions are NOTIFY, SUSPEND (lets running queries finish) and SUSPEND_IMMEDIATE (cancels them) (Snowflake resource monitors, October 2026).

Simplified example (based on the docs example):

USE ROLE ACCOUNTADMIN;
CREATE OR REPLACE RESOURCE MONITOR limit1
  WITH CREDIT_QUOTA = 1000
  TRIGGERS ON 100 PERCENT DO SUSPEND;
ALTER WAREHOUSE wh1 SET RESOURCE_MONITOR = limit1;

In real projects, admins add a NOTIFY trigger at a lower percentage so the team gets a warning before anything stops.

6. Cost governance with ACCOUNT_USAGE queries

Short answer: Snowflake cost is compute plus storage plus data transfer, and an admin tracks it every day with views in the SNOWFLAKE.ACCOUNT_USAGE schema such as WAREHOUSE_METERING_HISTORY and QUERY_HISTORY.

What you pay for

Snowflake's cost docs (October 2026) split the bill into three parts:

Cloud services are charged only when daily cloud services use goes above 10% of daily warehouse use. Snowflake's pricing table effective 15 October 2026 calls compute credits "Platform Credits" and bills AI separately in "AI Credits". On-demand list prices in AWS US East (N. Virginia) were $2, $3, $4 and $6 per credit for Standard, Enterprise, Business Critical and Virtual Private Snowflake, and on-demand storage was $23 per TB per month (Snowflake, October 2026). Prices vary by region and edition, so check your own contract and region before you build a budget.

ACCOUNT_USAGE vs INFORMATION_SCHEMA

The ACCOUNT_USAGE docs (October 2026) say ACCOUNTADMIN grants access to it, through IMPORTED PRIVILEGES or SNOWFLAKE database roles, so you can give a cost analyst read access without making them an admin.

Query 1: credits by warehouse, last 30 days

Simplified example:

SELECT warehouse_name,
       SUM(credits_used) AS total_credits,
       SUM(credits_used_cloud_services) AS cloud_services_credits
FROM SNOWFLAKE.ACCOUNT_USAGE.WAREHOUSE_METERING_HISTORY
WHERE start_time >= DATEADD('day', -30, CURRENT_DATE())
GROUP BY warehouse_name
ORDER BY total_credits DESC;

Query 2: idle warehouse cost

This one comes almost straight from Snowflake's WAREHOUSE_METERING_HISTORY page. It shows credits a warehouse burned while running but not serving queries, which usually means auto-suspend is set too long. Simplified example:

SELECT warehouse_name,
       (SUM(credits_used_compute)
        - SUM(credits_attributed_compute_queries)) AS idle_cost
FROM SNOWFLAKE.ACCOUNT_USAGE.WAREHOUSE_METERING_HISTORY
WHERE start_time >= DATEADD('days', -10, CURRENT_DATE())
  AND end_time < CURRENT_DATE()
GROUP BY warehouse_name;

Query 3: slowest queries this week

TOTAL_ELAPSED_TIME is in milliseconds. Spilling to remote storage is a strong hint that a warehouse is too small or a query needs rewriting. Simplified example:

SELECT query_id, user_name, role_name, warehouse_name, warehouse_size,
       total_elapsed_time / 1000 AS seconds,
       bytes_spilled_to_remote_storage
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
WHERE start_time >= DATEADD('day', -7, CURRENT_TIMESTAMP())
  AND execution_status = 'SUCCESS'
ORDER BY total_elapsed_time DESC
LIMIT 20;

For tuning the queries you find, see our Snowflake query optimization guide.

7. Security: network policies, masking and row access policies

Short answer: Admins limit where users can connect from with network policies, hide sensitive columns with masking policies, and filter rows by role with row access policies; masking and row access policies need Enterprise Edition or higher.

Network policies

A network policy is built from network rules. Each rule lists allowed or blocked addresses (for example TYPE = IPV4 with MODE = INGRESS), and the policy references them in an allowed list and a blocked list. Blocked rules are applied first. The older ALLOWED_IP_LIST and BLOCKED_IP_LIST parameters are legacy. You activate a policy on the whole account with ALTER ACCOUNT SET NETWORK_POLICY, or on a single user with ALTER USER ... SET NETWORK_POLICY. When more than one applies, a security integration policy wins over a user policy, which wins over the account policy (Snowflake documentation, October 2026).

A safe order of work: create rules for your office VPN and cloud egress IPs, build the policy, test it on one admin user, then apply it at account level, keeping a documented break-glass path so a wrong rule does not lock everyone out.

Dynamic data masking

Dynamic data masking is a column-level security feature. A masking policy decides at query time whether a role sees plain text or a masked value, so one column can serve both HR and analysts. Simplified example (from Snowflake's masking docs):

CREATE OR REPLACE MASKING POLICY email_mask AS (val string) RETURNS string ->
  CASE
    WHEN CURRENT_ROLE() IN ('ANALYST') THEN val
    ELSE '*********'
  END;
ALTER TABLE IF EXISTS user_info MODIFY COLUMN email SET MASKING POLICY email_mask;

For Indian projects, think PAN numbers, Aadhaar-linked fields, phone numbers and salary columns in banking, insurance and HR data.

Row access policies

A row access policy is a schema-level object that decides which rows a query can return. It applies to SELECT and to rows picked by UPDATE, DELETE and MERGE. Simplified example (from Snowflake's row access docs):

CREATE OR REPLACE ROW ACCESS POLICY rap_it
AS (empl_id varchar) RETURNS BOOLEAN ->
  'it_admin' = current_role();
ALTER TABLE t1 ADD ROW ACCESS POLICY rap_it ON (empl_id);

A typical use is a regional sales table where the South India team sees only its own states.

Snowflake Horizon Catalog

Snowflake groups its governance features under Snowflake Horizon Catalog: object tagging, masking and row access policies, sensitive data classification, data quality monitoring, column-level lineage, AI Guardrails, Trust Center and replication (Snowflake documentation, October 2026). As an admin, you will use Horizon features to prove to auditors who can see what.

8. Data protection: Time Travel, Fail-safe and replication

Short answer: Time Travel lets you restore data yourself for up to 1 day on Standard Edition or up to 90 days on Enterprise and above; Fail-safe adds 7 days that only Snowflake Support can use; replication and failover protect you from a regional outage.

Source: Snowflake documentation on editions, Time Travel, Fail-safe and replication, October 2026.

Key points for admins:

For Indian customers, note that Snowflake lists two India regions: AWS Asia Pacific (Mumbai) and Azure Central India (Pune). A disaster recovery design that must stay inside India would pair those (Snowflake documentation, October 2026).

9. Monitoring and the admin daily checklist

Short answer: Good admins run the same short checklist every day and every month, using ACCOUNT_USAGE views and Snowsight, so problems show up before users complain.

Daily checklist

Weekly checklist

Monthly checklist

Monitoring tools you will use:

10. Snowflake admin vs developer vs data engineer

Short answer: The developer and data engineer build pipelines and models; the admin controls the platform they build on: access, cost, security and recovery.

A Snowflake developer writes SQL, stored procedures and dbt models. A data engineer builds ingestion and orchestration. An admin rarely writes business logic but approves the roles, warehouses and policies everyone else uses. In smaller teams one person may do two of these jobs. Read our Snowflake developer guide for the build side, and our Snowflake data engineer guide, which has the full side-by-side comparison table of all three roles.

Many people move into admin work from a DBA background (Oracle, SQL Server, Teradata) or from a data engineering role where they already looked after warehouses and grants.

11. Skills and certifications for a Snowflake admin

Short answer: You need strong SQL, RBAC design, cost and security skills, one cloud, and some scripting; the matching certification is SnowPro Advanced: Administrator (ADA-C02), which needs SnowPro Core first.

Skills checklist

Terraform deserves a note: Snowflake's Terraform provider (snowflakedb/terraform-provider-snowflake) became an officially supported Snowflake product with version 2.0.0 in April 2025, so infrastructure as code for roles, users and warehouses is now a mainstream admin skill (GitHub, October 2026).

SnowPro Advanced: Administrator (ADA-C02)

The ADA-C02 exam page lists five capability areas: account administration, data security and governance; database objects and virtual warehouses; monitoring, tuning and optimisation; data sharing and the Snowflake Marketplace; and disaster recovery, backups and replication. You must pass SnowPro Core (COF-C03: 100 questions, 115 minutes, $175, or $140 in India) first. Exams run through Pearson VUE, online or at a test centre. You pay the full fee for every attempt, certifications are valid for 2 years, and you renew them through Snowflake's Continuing Education programme. There is no free exam. See our Snowflake certification overview for the full path.

The Advanced: Security Engineer exam (SEA-C01) also touches admin topics, but it retires on 1 December 2026, so do not plan for it now.

How much do certificates matter for admin jobs? Of the 14 Snowflake job descriptions we read on 25 October 2026, only one required a SnowPro certification: an Insight International "Snowflake Administrator (SnowPro Certified)" role in Hyderabad asking for 7 to 10 years, with SnowPro Core required and Advanced preferred. One other JD listed certification as preferred. Experience and hands-on skill still count most.

Free ways to practise

12. Snowflake admin jobs and pay in India

Short answer: Snowflake admin listings exist across Hyderabad, Bengaluru and Pune in IT services and consulting firms, usually asking 2 to 10 years of experience, and AmbitionBox shows typical admin pay around ₹9.8 to 14.2 lakh a year from a small sample.

Companies with Snowflake admin listings seen on 25 October 2026:

These are listings, not hiring commitments. Notice that none accepts freshers. Admin is usually a second or third job, after you have worked as a SQL developer, DBA or data engineer.

On pay, AmbitionBox showed a typical range of ₹9.8 to 14.2 lakh a year for "Snowflake Administrator" in India (48 salaries, 3 to 12 years' experience, updated September 2026) and ₹9.9 to 13.4 lakh for "Snowflake Admin" (36 salaries, 3 to 10 years, October 2026). Both samples are small, so read them as rough guides. For pay by city, experience and company across Snowflake roles, see our Snowflake developer salary guide.

A realistic path to a Snowflake admin role

For interview practice, our Snowflake interview questions page covers the concepts; expect admin rounds to ask about role hierarchy, resource monitors, MFA, cost queries and recovery.

13. How Brolly Academy helps

Short answer: Brolly Academy's 45-day Snowflake course covers the admin foundations: roles and RBAC, virtual warehouses, Time Travel and Fail-safe, data sharing, resource monitoring and data masking, with projects and interview preparation.

The Snowflake Training in Hyderabad course is taught by Mr. Bala Krishna, who has 13+ years in data warehousing, SQL and Snowflake. It runs for 45 days in classroom, live online and video formats, across 15 modules with 6 projects. Modules relevant to admin work include Introduction to Snowflake (warehouses, roles, account types), Secure Data Sharing (reader accounts, privileges, cross-region sharing and replication), Time Travel and Fail-safe, Query Caching, Clustering and Performance (cost optimisation), and Advanced Topics (pricing model, editions and credit usage, resource monitoring, data masking).

Fees as listed on the course page in October 2026:

You get a Brolly Academy Snowflake course completion certificate. The course prepares you for SnowPro Core, but SnowPro exams are run by Snowflake and their fees are separate. A free demo class is available before you enrol.

Frequently asked questions