grantRole

Last updated: January 27, 2026

Grants a role to a user or to another role in Snowflake. Used to assign roles to users for access control or to create role hierarchies.

Note: Automatic rollback revokes the granted role.

Known limitation: This change type does not support database inspection features (snapshot, diff, diff-changelog, and generate-changelog commands).

Available attributes

Attribute	Type	Description	Required
`roleName`	String	Name of the role to grant	Yes
`toUser`	String	Name of the user to grant the role to*	No
`toRole`	String	Name of the role to grant the role to*	No

* Exactly one of toUser or toRole must be specified

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Grant role to user -->
    <changeSet id="grant-role-to-user" author="examples">
        <pro-snowflake:grantRole
                roleName="ANALYST_ROLE"
                toUser="JOHN_DOE"/>
    </changeSet>

    <!-- Grant role to role (role hierarchy) -->
    <changeSet id="grant-role-to-role" author="examples">
        <pro-snowflake:grantRole
                roleName="DATA_READER"
                toRole="ANALYST_ROLE"/>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "grant-role-to-user",
        "author": "examples",
        "changes": [
          {
            "grantRole": {
              "roleName": "ANALYST_ROLE",
              "toUser": "JOHN_DOE"
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "grant-role-to-role",
        "author": "examples",
        "changes": [
          {
            "grantRole": {
              "roleName": "DATA_READER",
              "toRole": "ANALYST_ROLE"
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Grant role to user
  - changeSet:
      id: grant-role-to-user
      author: examples
      changes:
        - grantRole:
            roleName: ANALYST_ROLE
            toUser: JOHN_DOE

  # Grant role to role (role hierarchy)
  - changeSet:
      id: grant-role-to-role
      author: examples
      changes:
        - grantRole:
            roleName: DATA_READER
            toRole: ANALYST_ROLE

--liquibase formatted sql

--changeset examples:grant-role-to-user
-- Grant role to user
GRANT ROLE ANALYST_ROLE TO USER JOHN_DOE;

--changeset examples:grant-role-to-role-role-hierarchy
-- Grant role to role (role hierarchy)
GRANT ROLE DATA_READER TO ROLE ANALYST_ROLE;

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Grant role to user -->
    <changeSet id="grant-role-to-user" author="examples">
        <pro-snowflake:grantRole
                roleName="ANALYST_ROLE"
                toUser="JOHN_DOE"/>
    </changeSet>

    <!-- Grant role to role (role hierarchy) -->
    <changeSet id="grant-role-to-role" author="examples">
        <pro-snowflake:grantRole
                roleName="DATA_READER"
                toRole="ANALYST_ROLE"/>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "grant-role-to-user",
        "author": "examples",
        "changes": [
          {
            "grantRole": {
              "roleName": "ANALYST_ROLE",
              "toUser": "JOHN_DOE"
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "grant-role-to-role",
        "author": "examples",
        "changes": [
          {
            "grantRole": {
              "roleName": "DATA_READER",
              "toRole": "ANALYST_ROLE"
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  # Grant role to user
  - changeSet:
      id: grant-role-to-user
      author: examples
      changes:
        - grantRole:
            roleName: ANALYST_ROLE
            toUser: JOHN_DOE

  # Grant role to role (role hierarchy)
  - changeSet:
      id: grant-role-to-role
      author: examples
      changes:
        - grantRole:
            roleName: DATA_READER
            toRole: ANALYST_ROLE

--liquibase formatted sql

--changeset examples:grant-role-to-user
-- Grant role to user
GRANT ROLE ANALYST_ROLE TO USER JOHN_DOE;

--changeset examples:grant-role-to-role-role-hierarchy
-- Grant role to role (role hierarchy)
GRANT ROLE DATA_READER TO ROLE ANALYST_ROLE;

grantRole

Available attributes

XML example

JSON example

YAML example

SQL example