A read-only field report on the role & access topology of a single Snowflake account, captured at a single moment.
Eleven views from SNOWFLAKE.ACCOUNT_USAGE, plus two derived layers: role-origin classification and a cycle-safe role hierarchy closure. Per-view freshness is reported below; documented per-view max lag from Snowflake's docs is shown alongside.
| View | Rows | Latest Record | Max Lag (Doc) | Status |
|---|
| Role Origin | Roles |
|---|
Each finding is the output of a deterministic rule run against the snapshot. Severity is intrinsic to the rule, not to your specific account — a HIGH may be benign in context. Click a severity below to filter.
For each user, the set of administrative roles they can activate — directly granted or via role inheritance. Shorter reach is safer; depth 0 means the user holds the admin role directly.
Snowflake creates per-user objects (e.g. USER$<name>) with grants pointing at the user, not at a role. They’re typically benign but worth seeing once.
If a previous snapshot for this account exists in ~/.uberblick/history, this section diffs the current snapshot against the most recent older one. Privilege creep, terminations, MFA toggles, and grant churn surface here directly.
Two filters: leave both blank to see nothing. Type a user to see every object they can reach, or type an object name to see every user who can reach it. Type both to see the specific paths between them. Search is substring-match across user names, role names, database/schema/table names. Paths trace the role inheritance chain.
Pick a role from the dropdown to step inside it — without granting it to yourself. You will see every role it inherits, every object grant it (or its inherited roles) carries, and every user who holds it. This is the answer to "if I were CUSTOMER_ANALYST, what would my Snowflake look like?"
When a user activates all granted roles simultaneously, the union of privileges can exceed any single role. This is where dangerous combinations emerge — PII read in one role plus export privilege in another lets the user exfiltrate, even though neither role alone would. Below: per-user breakdown showing which role contributes what, with the unique privileges each role brings (privileges only available through that role).
For the highest-reach users in this snapshot (those reaching admin roles or many roles transitively), this view enumerates every object grant they can exercise across every role they hold. This is the full reachable surface — the answer to "what is the worst case if this user’s credentials leak?". Pick a user; the table shows object, privilege, the direct role they hold, and the inherited role that actually carries the grant.
Every user with their direct role count, transitive reachable role count, max path depth, and named binary flags. Sort by reaches_admin first to see who can become privileged. Click a row to expand the user’s direct role list.
| Name | Type | MFA | Default role | Direct | Reachable | Depth | Flags | Last login |
|---|
Tabular view of every role with edge counts and direct user grants. Search by name, toggle origin filters, click any column header to sort. Designed to scale: works the same with 5 roles or 5,000.
| Name | Origin | Type | Owner | Inherits | Inherited by | Users | Max reach |
|---|
Roles are stratified by origin: customer-created at the bottom, then Snowflake’s system roles, instance roles, and application roles above. Edges are USAGE inheritance grants. Click any node to highlight its 1-hop neighborhood.