createRole

Last updated: January 27, 2026

Creates a new role in Snowflake. Roles are named entities to which privileges can be granted and are used to control access to database objects.

Note: Automatic rollback drops the role.

Note: This change type does not support database inspection features (snapshot, diff, diff-changelog, and generate-changelog commands).

Available attributes

Attribute	Type	Description	Required
`roleName`	String	Name of the role to create	Yes
`replaceIfExists`	Boolean	Replace the role if it exists using `OR REPLACE`*	No
`ifNotExists`	Boolean	Only create if the role doesn't exist using `IF NOT EXISTS`*	No
`comment`	String	Comment describing the role	No
`tags`	Nested	Key-value pairs of tags to apply	No

* replaceIfExists and ifNotExists are mutually exclusive

tags attributes

Key-value pairs of tags to apply to the role. Tags must exist before use.

Attribute	Type	Description	Required
`key`	String	Tag name	Yes
`value`	String	Tag value	Yes

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Basic role -->
    <changeSet id="create-role-basic" author="examples">
        <pro-snowflake:createRole roleName="DATA_ANALYST"/>
    </changeSet>

    <!-- Role with comment -->
    <changeSet id="create-role-with-comment" author="examples">
        <pro-snowflake:createRole
                roleName="ANALYTICS_TEAM_LEAD"
                replaceIfExists="true"
                comment="Analytics Team Lead - Full access to analytics schemas"/>
    </changeSet>

    <!-- Role with tags -->
    <changeSet id="create-role-with-tags" author="examples">
        <pro-snowflake:createRole
                roleName="SERVICE_ACCOUNT_ROLE"
                ifNotExists="true"
                comment="Service account role for API access">
            <pro-snowflake:tags>
                <pro-snowflake:entry key="environment" value="production"/>
                <pro-snowflake:entry key="owner" value="platform-team"/>
            </pro-snowflake:tags>
        </pro-snowflake:createRole>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "create-role-basic",
        "author": "examples",
        "changes": [
          {
            "createRole": {
              "roleName": "DATA_ANALYST"
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "create-role-with-comment",
        "author": "examples",
        "changes": [
          {
            "createRole": {
              "roleName": "ANALYTICS_TEAM_LEAD",
              "replaceIfExists": true,
              "comment": "Analytics Team Lead - Full access to analytics schemas"
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "create-role-with-tags",
        "author": "examples",
        "changes": [
          {
            "createRole": {
              "roleName": "SERVICE_ACCOUNT_ROLE",
              "ifNotExists": true,
              "comment": "Service account role for API access",
              "tags": {
                "entries": [
                  { "entry": { "key": "environment", "value": "production" } },
                  { "entry": { "key": "owner", "value": "platform-team" } }
                ]
              }
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Basic role
  - changeSet:
      id: create-role-basic
      author: examples
      changes:
        - createRole:
            roleName: DATA_ANALYST

  # Role with comment
  - changeSet:
      id: create-role-with-comment
      author: examples
      changes:
        - createRole:
            roleName: ANALYTICS_TEAM_LEAD
            replaceIfExists: true
            comment: Analytics Team Lead - Full access to analytics schemas

  # Role with tags
  - changeSet:
      id: create-role-with-tags
      author: examples
      changes:
        - createRole:
            roleName: SERVICE_ACCOUNT_ROLE
            ifNotExists: true
            comment: Service account role for API access
            tags:
              entries:
                - entry:
                    key: environment
                    value: production
                - entry:
                    key: owner
                    value: platform-team

--liquibase formatted sql

--changeset examples:basic-role
-- Basic role
CREATE ROLE DATA_ANALYST;

--changeset examples:role-with-comment
-- Role with comment
CREATE OR REPLACE ROLE ANALYTICS_TEAM_LEAD COMMENT = 'Analytics Team Lead - Full access to analytics schemas';

--changeset examples:role-with-tags
-- Role with tags
CREATE ROLE IF NOT EXISTS SERVICE_ACCOUNT_ROLE
    COMMENT = 'Service account role for API access'
    WITH TAG (environment = 'production', owner = 'platform-team');

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Basic role -->
    <changeSet id="create-role-basic" author="examples">
        <pro-snowflake:createRole roleName="DATA_ANALYST"/>
    </changeSet>

    <!-- Role with comment -->
    <changeSet id="create-role-with-comment" author="examples">
        <pro-snowflake:createRole
                roleName="ANALYTICS_TEAM_LEAD"
                replaceIfExists="true"
                comment="Analytics Team Lead - Full access to analytics schemas"/>
    </changeSet>

    <!-- Role with tags -->
    <changeSet id="create-role-with-tags" author="examples">
        <pro-snowflake:createRole
                roleName="SERVICE_ACCOUNT_ROLE"
                ifNotExists="true"
                comment="Service account role for API access">
            <pro-snowflake:tags>
                <pro-snowflake:entry key="environment" value="production"/>
                <pro-snowflake:entry key="owner" value="platform-team"/>
            </pro-snowflake:tags>
        </pro-snowflake:createRole>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "create-role-basic",
        "author": "examples",
        "changes": [
          {
            "createRole": {
              "roleName": "DATA_ANALYST"
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "create-role-with-comment",
        "author": "examples",
        "changes": [
          {
            "createRole": {
              "roleName": "ANALYTICS_TEAM_LEAD",
              "replaceIfExists": true,
              "comment": "Analytics Team Lead - Full access to analytics schemas"
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "create-role-with-tags",
        "author": "examples",
        "changes": [
          {
            "createRole": {
              "roleName": "SERVICE_ACCOUNT_ROLE",
              "ifNotExists": true,
              "comment": "Service account role for API access",
              "tags": {
                "entries": [
                  { "entry": { "key": "environment", "value": "production" } },
                  { "entry": { "key": "owner", "value": "platform-team" } }
                ]
              }
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Basic role
  - changeSet:
      id: create-role-basic
      author: examples
      changes:
        - createRole:
            roleName: DATA_ANALYST

  # Role with comment
  - changeSet:
      id: create-role-with-comment
      author: examples
      changes:
        - createRole:
            roleName: ANALYTICS_TEAM_LEAD
            replaceIfExists: true
            comment: Analytics Team Lead - Full access to analytics schemas

  # Role with tags
  - changeSet:
      id: create-role-with-tags
      author: examples
      changes:
        - createRole:
            roleName: SERVICE_ACCOUNT_ROLE
            ifNotExists: true
            comment: Service account role for API access
            tags:
              entries:
                - entry:
                    key: environment
                    value: production
                - entry:
                    key: owner
                    value: platform-team

--liquibase formatted sql

--changeset examples:basic-role
-- Basic role
CREATE ROLE DATA_ANALYST;

--changeset examples:role-with-comment
-- Role with comment
CREATE OR REPLACE ROLE ANALYTICS_TEAM_LEAD COMMENT = 'Analytics Team Lead - Full access to analytics schemas';

--changeset examples:role-with-tags
-- Role with tags
CREATE ROLE IF NOT EXISTS SERVICE_ACCOUNT_ROLE
    COMMENT = 'Service account role for API access'
    WITH TAG (environment = 'production', owner = 'platform-team');

createRole

Available attributes

tags attributes

XML example

JSON example

YAML example

SQL example