createRowAccessPolicy

Last updated: January 28, 2026

Creates a new row access policy in Snowflake. Row access policies control which rows can be accessed based on the policy expression and arguments mapped to table columns.

This change type supports automatic rollback, which will generate a dropRowAccessPolicy change.

Note: This change type does not support database inspection features (snapshot, diff, diff-changelog, and generate-changelog commands).

Available Attributes

Attribute	Type	Description	Required
`catalogName`	String	Name of the catalog (database) where the policy will be created	No
`schemaName`	String	Name of the schema where the policy will be created	No
`policyName`	String	Name of the row access policy to create	Yes
`replaceIfExists`	Boolean	If true, replaces the policy if it already exists using `OR REPLACE`. Only one of `replaceIfExists` or `ifNotExists` can be set to `true` (they are mutually exclusive).	No*
`ifNotExists`	Boolean	If true, only creates the policy if it doesn't already exist using `IF NOT EXISTS`. Only one of `replaceIfExists` or `ifNotExists` can be set to `true` (they are mutually exclusive).	No*
`comment`	String	Descriptive comment for the policy	No
`policyArguments`	MapWrapper	Key-value pairs defining policy arguments (name -> data type). At least one argument required. Each policy argument must have a non-empty name and data type.	Yes
`policyBody`	String	Boolean expression that determines row access using the policy arguments	Yes

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Basic policy -->
    <changeSet id="create-row-access-policy-basic" author="examples">
        <pro-snowflake:createRowAccessPolicy policyName="ADMIN_ONLY_POLICY">
            <pro-snowflake:policyArguments>
                <pro-snowflake:entry key="user_id" value="NUMBER"/>
            </pro-snowflake:policyArguments>
            <pro-snowflake:policyBody>CURRENT_ROLE() = 'ADMIN'</pro-snowflake:policyBody>
        </pro-snowflake:createRowAccessPolicy>
    </changeSet>

    <!-- Policy with OR REPLACE and comment -->
    <changeSet id="create-row-access-policy-replace" author="examples">
        <pro-snowflake:createRowAccessPolicy
                policyName="DEPARTMENT_ACCESS_POLICY"
                replaceIfExists="true"
                comment="Row access based on department and role">
            <pro-snowflake:policyArguments>
                <pro-snowflake:entry key="dept_id" value="VARCHAR"/>
                <pro-snowflake:entry key="access_level" value="NUMBER"/>
            </pro-snowflake:policyArguments>
            <pro-snowflake:policyBody>(dept_id = CURRENT_USER() AND access_level >= 3) OR CURRENT_ROLE() IN ('ADMIN', 'HR')</pro-snowflake:policyBody>
        </pro-snowflake:createRowAccessPolicy>
    </changeSet>

    <!-- Policy with IF NOT EXISTS -->
    <changeSet id="create-row-access-policy-if-not-exists" author="examples">
        <pro-snowflake:createRowAccessPolicy
                policyName="TENANT_ISOLATION_POLICY"
                ifNotExists="true">
            <pro-snowflake:policyArguments>
                <pro-snowflake:entry key="tenant_id" value="VARCHAR(50)"/>
            </pro-snowflake:policyArguments>
            <pro-snowflake:policyBody>tenant_id = CURRENT_USER()</pro-snowflake:policyBody>
        </pro-snowflake:createRowAccessPolicy>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "create-row-access-policy-basic",
        "author": "examples",
        "changes": [
          {
            "createRowAccessPolicy": {
              "policyName": "ADMIN_ONLY_POLICY",
              "policyArguments": {
                "entries": [
                  { "entry": { "key": "user_id", "value": "NUMBER" } }
                ]
              },
              "policyBody": "CURRENT_ROLE() = 'ADMIN'"
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "create-row-access-policy-replace",
        "author": "examples",
        "changes": [
          {
            "createRowAccessPolicy": {
              "policyName": "DEPARTMENT_ACCESS_POLICY",
              "replaceIfExists": true,
              "comment": "Row access based on department and role",
              "policyArguments": {
                "entries": [
                  { "entry": { "key": "dept_id", "value": "VARCHAR" } },
                  { "entry": { "key": "access_level", "value": "NUMBER" } }
                ]
              },
              "policyBody": "(dept_id = CURRENT_USER() AND access_level >= 3) OR CURRENT_ROLE() IN ('ADMIN', 'HR')"
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "create-row-access-policy-if-not-exists",
        "author": "examples",
        "changes": [
          {
            "createRowAccessPolicy": {
              "policyName": "TENANT_ISOLATION_POLICY",
              "ifNotExists": true,
              "policyArguments": {
                "entries": [
                  { "entry": { "key": "tenant_id", "value": "VARCHAR(50)" } }
                ]
              },
              "policyBody": "tenant_id = CURRENT_USER()"
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  #Basic policy
  - changeSet:
      id: create-row-access-policy-basic
      author: examples
      changes:
        - createRowAccessPolicy:
            policyName: ADMIN_ONLY_POLICY
            policyArguments:
              entries:
                - entry:
                    key: user_id
                    value: NUMBER
            policyBody: CURRENT_ROLE() = 'ADMIN'

  #Policy with OR REPLACE and comment
  - changeSet:
      id: create-row-access-policy-replace
      author: examples
      changes:
        - createRowAccessPolicy:
            policyName: DEPARTMENT_ACCESS_POLICY
            replaceIfExists: true
            comment: Row access based on department and role
            policyArguments:
              entries:
                - entry:
                    key: dept_id
                    value: VARCHAR
                - entry:
                    key: access_level
                    value: NUMBER
            policyBody: (dept_id = CURRENT_USER() AND access_level >= 3) OR CURRENT_ROLE() IN ('ADMIN', 'HR')

  #Policy with IF NOT EXISTS
  - changeSet:
      id: create-row-access-policy-if-not-exists
      author: examples
      changes:
        - createRowAccessPolicy:
            policyName: TENANT_ISOLATION_POLICY
            ifNotExists: true
            policyArguments:
              entries:
                - entry:
                    key: tenant_id
                    value: VARCHAR(50)
            policyBody: tenant_id = CURRENT_USER()

--liquibase formatted sql

--changeset examples:createrowaccesspolicy-1
```sql
-- Basic policy
CREATE ROW ACCESS POLICY PUBLIC.ADMIN_ONLY_POLICY
    AS (user_id NUMBER) RETURNS BOOLEAN -> CURRENT_ROLE() = 'ADMIN';

--changeset examples:policy-with-or-replace-and-comment
-- Policy with OR REPLACE and comment
CREATE OR REPLACE ROW ACCESS POLICY PUBLIC.DEPARTMENT_ACCESS_POLICY
    AS (dept_id VARCHAR, access_level NUMBER) RETURNS BOOLEAN ->
    (dept_id = CURRENT_USER() AND access_level >= 3) OR CURRENT_ROLE() IN ('ADMIN', 'HR')
    COMMENT = 'Row access based on department and role';

--changeset examples:policy-with-if-not-exists
-- Policy with IF NOT EXISTS
CREATE ROW ACCESS POLICY IF NOT EXISTS PUBLIC.TENANT_ISOLATION_POLICY
    AS (tenant_id VARCHAR(50)) RETURNS BOOLEAN -> tenant_id = CURRENT_USER();
```

<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog
        xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
        xmlns:pro-snowflake="http://www.liquibase.org/xml/ns/pro-snowflake"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
        http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-latest.xsd
        http://www.liquibase.org/xml/ns/pro-snowflake
        http://www.liquibase.org/xml/ns/pro-snowflake/liquibase-pro-snowflake-latest.xsd">

    <!-- Basic policy -->
    <changeSet id="create-row-access-policy-basic" author="examples">
        <pro-snowflake:createRowAccessPolicy policyName="ADMIN_ONLY_POLICY">
            <pro-snowflake:policyArguments>
                <pro-snowflake:entry key="user_id" value="NUMBER"/>
            </pro-snowflake:policyArguments>
            <pro-snowflake:policyBody>CURRENT_ROLE() = 'ADMIN'</pro-snowflake:policyBody>
        </pro-snowflake:createRowAccessPolicy>
    </changeSet>

    <!-- Policy with OR REPLACE and comment -->
    <changeSet id="create-row-access-policy-replace" author="examples">
        <pro-snowflake:createRowAccessPolicy
                policyName="DEPARTMENT_ACCESS_POLICY"
                replaceIfExists="true"
                comment="Row access based on department and role">
            <pro-snowflake:policyArguments>
                <pro-snowflake:entry key="dept_id" value="VARCHAR"/>
                <pro-snowflake:entry key="access_level" value="NUMBER"/>
            </pro-snowflake:policyArguments>
            <pro-snowflake:policyBody>(dept_id = CURRENT_USER() AND access_level >= 3) OR CURRENT_ROLE() IN ('ADMIN', 'HR')</pro-snowflake:policyBody>
        </pro-snowflake:createRowAccessPolicy>
    </changeSet>

    <!-- Policy with IF NOT EXISTS -->
    <changeSet id="create-row-access-policy-if-not-exists" author="examples">
        <pro-snowflake:createRowAccessPolicy
                policyName="TENANT_ISOLATION_POLICY"
                ifNotExists="true">
            <pro-snowflake:policyArguments>
                <pro-snowflake:entry key="tenant_id" value="VARCHAR(50)"/>
            </pro-snowflake:policyArguments>
            <pro-snowflake:policyBody>tenant_id = CURRENT_USER()</pro-snowflake:policyBody>
        </pro-snowflake:createRowAccessPolicy>
    </changeSet>

</databaseChangeLog>

{
  "databaseChangeLog": [
    {
      "changeSet": {
        "id": "create-row-access-policy-basic",
        "author": "examples",
        "changes": [
          {
            "createRowAccessPolicy": {
              "policyName": "ADMIN_ONLY_POLICY",
              "policyArguments": {
                "entries": [
                  { "entry": { "key": "user_id", "value": "NUMBER" } }
                ]
              },
              "policyBody": "CURRENT_ROLE() = 'ADMIN'"
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "create-row-access-policy-replace",
        "author": "examples",
        "changes": [
          {
            "createRowAccessPolicy": {
              "policyName": "DEPARTMENT_ACCESS_POLICY",
              "replaceIfExists": true,
              "comment": "Row access based on department and role",
              "policyArguments": {
                "entries": [
                  { "entry": { "key": "dept_id", "value": "VARCHAR" } },
                  { "entry": { "key": "access_level", "value": "NUMBER" } }
                ]
              },
              "policyBody": "(dept_id = CURRENT_USER() AND access_level >= 3) OR CURRENT_ROLE() IN ('ADMIN', 'HR')"
            }
          }
        ]
      }
    },
    {
      "changeSet": {
        "id": "create-row-access-policy-if-not-exists",
        "author": "examples",
        "changes": [
          {
            "createRowAccessPolicy": {
              "policyName": "TENANT_ISOLATION_POLICY",
              "ifNotExists": true,
              "policyArguments": {
                "entries": [
                  { "entry": { "key": "tenant_id", "value": "VARCHAR(50)" } }
                ]
              },
              "policyBody": "tenant_id = CURRENT_USER()"
            }
          }
        ]
      }
    }
  ]
}

databaseChangeLog:
  #Basic policy
  - changeSet:
      id: create-row-access-policy-basic
      author: examples
      changes:
        - createRowAccessPolicy:
            policyName: ADMIN_ONLY_POLICY
            policyArguments:
              entries:
                - entry:
                    key: user_id
                    value: NUMBER
            policyBody: CURRENT_ROLE() = 'ADMIN'

  #Policy with OR REPLACE and comment
  - changeSet:
      id: create-row-access-policy-replace
      author: examples
      changes:
        - createRowAccessPolicy:
            policyName: DEPARTMENT_ACCESS_POLICY
            replaceIfExists: true
            comment: Row access based on department and role
            policyArguments:
              entries:
                - entry:
                    key: dept_id
                    value: VARCHAR
                - entry:
                    key: access_level
                    value: NUMBER
            policyBody: (dept_id = CURRENT_USER() AND access_level >= 3) OR CURRENT_ROLE() IN ('ADMIN', 'HR')

  #Policy with IF NOT EXISTS
  - changeSet:
      id: create-row-access-policy-if-not-exists
      author: examples
      changes:
        - createRowAccessPolicy:
            policyName: TENANT_ISOLATION_POLICY
            ifNotExists: true
            policyArguments:
              entries:
                - entry:
                    key: tenant_id
                    value: VARCHAR(50)
            policyBody: tenant_id = CURRENT_USER()

--liquibase formatted sql

--changeset examples:createrowaccesspolicy-1
```sql
-- Basic policy
CREATE ROW ACCESS POLICY PUBLIC.ADMIN_ONLY_POLICY
    AS (user_id NUMBER) RETURNS BOOLEAN -> CURRENT_ROLE() = 'ADMIN';

--changeset examples:policy-with-or-replace-and-comment
-- Policy with OR REPLACE and comment
CREATE OR REPLACE ROW ACCESS POLICY PUBLIC.DEPARTMENT_ACCESS_POLICY
    AS (dept_id VARCHAR, access_level NUMBER) RETURNS BOOLEAN ->
    (dept_id = CURRENT_USER() AND access_level >= 3) OR CURRENT_ROLE() IN ('ADMIN', 'HR')
    COMMENT = 'Row access based on department and role';

--changeset examples:policy-with-if-not-exists
-- Policy with IF NOT EXISTS
CREATE ROW ACCESS POLICY IF NOT EXISTS PUBLIC.TENANT_ISOLATION_POLICY
    AS (tenant_id VARCHAR(50)) RETURNS BOOLEAN -> tenant_id = CURRENT_USER();
```

createRowAccessPolicy

Available Attributes

XML

JSON

YAML

SQL

More like this