Snowflake Organizations & Accounts Design: Multi-Account Strategy Guide

A Snowflake Organization is the top-level management unit that logically groups multiple Accounts. By placing accounts under a single Organization, separated by use case, environment, or region, you achieve unified governance and billing management. The ORGADMIN role is responsible for Organization-level administrative operations.

Organization / Account Hierarchy

The Snowflake resource hierarchy, from top to bottom, is Organization → Account → Database → Schema → Table / View / UDF / .... The Organization is the unit for billing and governance, and each Account has its own independent compute, storage, users, and role system.

• Organization: The unit for billing, contracts, and account management. Administered by the ORGADMIN role
• Account: An independent Snowflake environment. ACCOUNTADMIN is the top-level role. Edition / Cloud / Region can be configured per account
• Data sharing between accounts is achieved with Secure Data Sharing or Database Replication

The ORGADMIN Role and Its Privileges

ORGADMIN is the Organization-level administrative role and can perform the following operations:

• CREATE ACCOUNT: create new accounts
• SHOW ORGANIZATION ACCOUNTS: list all accounts
• ALTER ACCOUNT: modify accounts (rename, drop)
• Query the ORGANIZATION_USAGE schema (cost monitoring)
• Global settings for Database Replication

-- Use the ORGADMIN role
USE ROLE ORGADMIN;

-- List all accounts in the Organization
SHOW ORGANIZATION ACCOUNTS;

-- Details for specific accounts
SHOW ORGANIZATION ACCOUNTS LIKE 'PROD_%';

CREATE ACCOUNT Syntax

Run CREATE ACCOUNT under the ORGADMIN role to create a new account. You specify the admin user, edition, and region.

-- Create a production account
USE ROLE ORGADMIN;
CREATE ACCOUNT prod_analytics
  ADMIN_NAME = 'admin_user'
  ADMIN_PASSWORD = '********'
  ADMIN_RSA_PUBLIC_KEY = 'MIIBIjANBgkqh...'
  EMAIL = '[email protected]'
  EDITION = 'ENTERPRISE'
  REGION = 'AWS_AP_NORTHEAST_1'
  COMMENT = 'Analytics team production environment';

-- Create a dev account (Standard Edition to control cost)
CREATE ACCOUNT dev_sandbox
  ADMIN_NAME = 'dev_admin'
  ADMIN_PASSWORD = '********'
  EMAIL = '[email protected]'
  EDITION = 'STANDARD'
  REGION = 'AWS_AP_NORTHEAST_1'
  COMMENT = 'Sandbox for development and validation';

-- Rename an account
ALTER ACCOUNT dev_sandbox RENAME TO dev_analytics;

-- Drop an account (non-recoverable; 25-day grace period applies)
ALTER ACCOUNT dev_analytics DROP;

Multi-Account Design Patterns

Design the granularity of account separation based on the size and requirements of the organization.

Account-Level Parameter Settings

-- Initial configuration after account creation (run as each account's ACCOUNTADMIN)
USE ROLE ACCOUNTADMIN;

-- Configure a network policy (IP restrictions)
CREATE NETWORK POLICY corp_network_policy
  ALLOWED_IP_LIST = ('203.0.113.0/24', '198.51.100.0/24')
  BLOCKED_IP_LIST = ()
  COMMENT = 'Allow access only from the corporate network';
ALTER ACCOUNT SET NETWORK_POLICY = corp_network_policy;

-- Configure session timeouts
ALTER ACCOUNT SET
  STATEMENT_TIMEOUT_IN_SECONDS = 3600
  STATEMENT_QUEUED_TIMEOUT_IN_SECONDS = 600;

-- Create a Resource Monitor
CREATE RESOURCE MONITOR monthly_monitor
  WITH CREDIT_QUOTA = 5000
  FREQUENCY = MONTHLY
  START_TIMESTAMP = IMMEDIATELY
  TRIGGERS
    ON 80 PERCENT DO NOTIFY
    ON 100 PERCENT DO SUSPEND;
ALTER ACCOUNT SET RESOURCE_MONITOR = monthly_monitor;

Data Exchange Between Accounts

-- Secure Data Sharing (provider side)
USE ROLE ACCOUNTADMIN;
CREATE SHARE analytics_share;
GRANT USAGE ON DATABASE analytics TO SHARE analytics_share;
GRANT USAGE ON SCHEMA analytics.public TO SHARE analytics_share;
GRANT SELECT ON TABLE analytics.public.kpi_summary
  TO SHARE analytics_share;
ALTER SHARE analytics_share ADD ACCOUNTS = prod_marketing;

-- Data Sharing (consumer side)
USE ROLE ACCOUNTADMIN;
CREATE DATABASE shared_analytics
  FROM SHARE provider_org.prod_analytics.analytics_share;
GRANT IMPORTED PRIVILEGES ON DATABASE shared_analytics
  TO ROLE analyst_role;

-- Database Replication (cross-region synchronization)
-- Primary side
ALTER DATABASE analytics ENABLE REPLICATION
  TO ACCOUNTS prod_eu_west;
-- Secondary side (run on prod_eu_west)
CREATE DATABASE analytics AS REPLICA OF
  prod_analytics.analytics;

Cross-Organization Governance

• Listings (Marketplace): Use private listings across accounts within an Organization to catalog data
• SCIM integration: Configure SCIM Integration (Azure AD / Okta) in each account to auto-provision users and groups
• Connection: Manage Client Redirect connection URLs at the Organization level and switch the connection target automatically during failover

Key Points for the Exam

• CREATE ACCOUNT can only be executed by the ORGADMIN role
• Each account can have an independent Edition / Cloud / Region
• Secure Data Sharing is the most efficient way to share data between accounts in the same Organization
• ORGADMIN is purely an Organization-administration role; it cannot directly access data inside an account
• Benefits and drawbacks of the environment, business-unit, and region separation patterns

Check Your Understanding with a Question

Frequently Asked Questions