✦ Want a lab built just for you? ✦
Request a Lab ↗

Snowflake Core Part 2: Multi-Cluster Workloads, Governance, Secure Data Sharing, and Cost Control for a SaaS Analytics Platform

About this lab

Six months after Part 1, PulseMetrics, a B2B SaaS usage-analytics platform, has signed enterprise customers. Two million usage events a quarter, Monday-morning dashboard rushes, customers who want their own data, auditors who ask who can see what, and a CFO who wants every credit explained. This lab picks up the story and takes Snowflake into production. It is standalone: Task 1 regenerates all of PulseMetrics' data, so you do not need to have done Part 1.

You turn the dashboard warehouse into a multi-cluster warehouse and measure the difference between the Economy and Standard scaling policies with a concurrent burst you fire from one SQL block. You add statement timeouts that cancel a runaway query, check whether Query Acceleration would actually help before paying for it, and cap spend with one resource monitor per workload, a custom budget that also sees serverless spend, and a serverless alert that flags enterprise customers close to their contract allowance. You then build a least-privilege hierarchy of functional roles and database roles, prove what each role can and cannot do (including the secondary-roles trap), and protect personal data and revenue with tag-based masking and a mapping-table row access policy owned by a dedicated governance role.

Next you share live, per-customer usage data: one share, secure views filtered by CURRENT_ACCOUNT(), a preview with SIMULATED_DATA_SHARING_CONSUMER, and a real reader account in which you log in as the customer and see only their rows. You automate a CI-style dev refresh with a zero-copy database clone, an owner's-rights procedure and a nightly task owned by a least-privilege CI role. You choose Time Travel retention per object, see why a transient staging table cannot be recovered, bring back a dropped schema, beat the UNDROP name-collision trap, and undo a bad UPDATE with a Time Travel clone and an atomic SWAP. Finally you attribute cost to teams with warehouse tags and query tags, and clean up everything, including the reader account.

Account requirements, stated precisely: tested end to end on a Snowflake Enterprise trial (AWS EU Ireland) with the ACCOUNTADMIN role. Multi-cluster warehouses, 30-day Time Travel, masking and row access policies need Enterprise edition or higher; reader accounts, budgets and serverless alerts worked on the trial. Everything runs on X-Small warehouses that suspend after 60 seconds.

Lab details

  • Level: Advanced
  • Cloud: Snowflake
  • Domain: Data Engineering
  • Duration: 150 minutes

What you will learn

  • Isolate dashboard, ETL and ad-hoc workloads with a multi-cluster warehouse, measured scaling policies, statement timeouts and a Query Acceleration check
  • Cap and watch spend with per-workload resource monitors, a custom budget and a serverless alert on customer contracts
  • Build a least-privilege hierarchy of functional and database roles, and protect data with tag-based masking and row access policies
  • Share live, per-customer data with a secure share and a reader account, and verify it from the customer's side
  • Automate a zero-copy dev refresh with an owner's-rights procedure and a nightly task run by a least-privilege CI role
  • Set Time Travel retention per object, recover a dropped schema and a bad UPDATE, and attribute cost to teams with tags

Concepts covered

  • Multi-cluster warehouses and scaling policies
  • Statement timeouts and Query Acceleration eligibility
  • Resource monitors, budgets and serverless alerts
  • Functional roles, database roles, future grants and secondary roles
  • Tag-based masking and row access policies
  • Secure data sharing, reader accounts and consumer simulation
  • Zero-copy cloning for CI dev refreshes
  • Time Travel retention, Fail-safe, UNDROP and point-in-time restore
  • Cost attribution with object tags and query tags

Technologies used

  • Multi-Cluster Warehouses
  • Resource Monitors, Budgets and Alerts
  • Role-Based Access Control
  • Masking and Row Access Policies
  • Secure Data Sharing
  • Zero-Copy Cloning, Time Travel and Tags

Prerequisites

  • Comfortable with SQL (joins, GROUP BY, CTEs); Snowflake basics such as warehouses, tables and views (Part 1 of this lab covers them)
  • A Snowflake account, Enterprise edition or higher (an Enterprise trial works), where you can use the ACCOUNTADMIN role
  • About 150 minutes; everything runs on X-Small warehouses that suspend after 60 seconds

Topics

  • Snowflake
  • Data Engineering
  • SQL
  • Multi-Cluster Warehouses
  • Resource Monitors
  • Budgets
  • Alerts
  • RBAC
  • Database Roles
  • Masking Policies
  • Row Access Policies
  • Data Sharing
  • Reader Accounts
  • Zero-Copy Cloning
  • Time Travel
  • Fail-safe
  • Cost Attribution
  • Part 2