users

Creates, updates, deletes, gets or lists a users resource.

Overview

Name	users
Type	Resource
Id	snowflake.roles.users

Fields

The following fields are returned by SELECT queries:

get

successful

Name	Datatype	Description
name	string	User name (example: jackpatel)
display_name	string	Display name
first_name	string	First name
last_name	string	Last name
login_name	string	Login name
middle_name	string	Middle name
comment	string	Comment about the user. (example: A distinguished user)
created_on	string (date-time)
custom_landing_page_url	string
custom_landing_page_url_flush_next_ui_load	boolean	Whether or not to flush the custom landing page of the user on next UI load
days_to_expiry	integer	How many days until this user expires
default_namespace	string	The default namespace to use when this user starts a session
default_role	string	The default role to use when this user starts a session
default_secondary_roles	string	The default secondary roles of this user to use when starting a session. Only valid set values are ALL or NONE. Default is ALL after 2024-07 BCR. (ALL, NONE) (default: ALL)
default_warehouse	string	The default warehouse to use when this user starts a session
disabled	boolean	Has this user been disabled from the system
email	string	Email address
enable_unredacted_query_syntax_error	boolean	Whether to show unredacted query syntax errors in the query history.
expires_at	string (date-time)
ext_authn_duo	boolean
ext_authn_uid	string
has_password	boolean
has_rsa_public_key	boolean
last_successful_login	string (date-time)
locked_until	string (date-time)
mins_to_bypass_mfa	integer	How many minutes until MFA is required again
mins_to_bypass_network_policy	integer	Temporary bypass network policy on the user for a specified number of minutes
mins_to_unlock	integer	How many minutes until the account is unlocked after multiple failed logins
must_change_password	boolean	Does this user need to change their password (e.g., after assigning a temp password)
network_policy	string	Specifies an existing network policy is active for the user. Otherwise, use account default.
owner	string
password	string (password)	Password
password_last_set	string (date-time)
rsa_public_key	string	RSA public key of the user
rsa_public_key_2	string	Second RSA public key of the user
rsa_public_key_2_fp	string	Fingerprint of the user's second RSA public key
rsa_public_key_fp	string	Fingerprint of the user's RSA public key
snowflake_lock	boolean	Whether the user, account, or organization is locked by Snowflake.
snowflake_support	boolean	Whether Snowflake Support is allowed to use the user or account
type	string	Indicates the type of user (PERSON | SERVICE | LEGACY_SERVICE)

list

Properties of user.

Name	Datatype	Description
name	string	User name (example: jackpatel)
display_name	string	Display name
first_name	string	First name
last_name	string	Last name
login_name	string	Login name
middle_name	string	Middle name
comment	string	Comment about the user. (example: A distinguished user)
created_on	string (date-time)
custom_landing_page_url	string
custom_landing_page_url_flush_next_ui_load	boolean	Whether or not to flush the custom landing page of the user on next UI load
days_to_expiry	integer	How many days until this user expires
default_namespace	string	The default namespace to use when this user starts a session
default_role	string	The default role to use when this user starts a session
default_secondary_roles	string	The default secondary roles of this user to use when starting a session. Only valid set values are ALL or NONE. Default is ALL after 2024-07 BCR. (ALL, NONE) (default: ALL)
default_warehouse	string	The default warehouse to use when this user starts a session
disabled	boolean	Has this user been disabled from the system
email	string	Email address
enable_unredacted_query_syntax_error	boolean	Whether to show unredacted query syntax errors in the query history.
expires_at	string (date-time)
ext_authn_duo	boolean
ext_authn_uid	string
has_password	boolean
has_rsa_public_key	boolean
last_successful_login	string (date-time)
locked_until	string (date-time)
mins_to_bypass_mfa	integer	How many minutes until MFA is required again
mins_to_bypass_network_policy	integer	Temporary bypass network policy on the user for a specified number of minutes
mins_to_unlock	integer	How many minutes until the account is unlocked after multiple failed logins
must_change_password	boolean	Does this user need to change their password (e.g., after assigning a temp password)
network_policy	string	Specifies an existing network policy is active for the user. Otherwise, use account default.
owner	string
password	string (password)	Password
password_last_set	string (date-time)
rsa_public_key	string	RSA public key of the user
rsa_public_key_2	string	Second RSA public key of the user
rsa_public_key_2_fp	string	Fingerprint of the user's second RSA public key
rsa_public_key_fp	string	Fingerprint of the user's RSA public key
snowflake_lock	boolean	Whether the user, account, or organization is locked by Snowflake.
snowflake_support	boolean	Whether Snowflake Support is allowed to use the user or account
type	string	Indicates the type of user (PERSON | SERVICE | LEGACY_SERVICE)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	name, endpoint		Fetch user information using the result of the DESCRIBE command
list	select	endpoint	like, startsWith, showLimit, fromName	Lists the users in the system.
create	insert	endpoint, name	createMode	Create a user according to the parameters given
create_or_alter	replace	user_name, endpoint, name		Create a (or alter an existing) user. Even if the operation is just an alter, the full property set must be provided. Note that password is not currently altered by this operation but is supported for a newly-created object.
delete	delete	name, endpoint	ifExists	Delete a user with the given name.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
endpoint	string	Organization and account identifier (orgname-accountname) (default: orgname-accountname)
name	string	Identifier (i.e. name) for the resource.
user_name	string	Identifier (i.e. name) for the resource.
createMode	string	Parameter allowing support for different modes of resource creation. Possible values include: - errorIfExists: Throws an error if you try to create a resource that already exists. - orReplace: Automatically replaces the existing resource with the current one. - ifNotExists: Creates a new resource when an alter is requested for a non-existent resource.
fromName	string	Parameter to enable fetching rows only following the first row whose object name matches the specified string. Case-sensitive and does not have to be the full name.
ifExists	boolean	Parameter that specifies how to handle the request for a resource that does not exist: - true: The endpoint does not throw an error if the resource does not exist. It returns a 200 success response, but does not take any action on the resource. - false: The endpoint throws an error if the resource doesn't exist.
like	string	Parameter to filter the command output by resource name. Uses case-insensitive pattern matching, with support for SQL wildcard characters.
showLimit	integer	Parameter to limit the maximum number of rows returned by a command.
startsWith	string	Parameter to filter the command output based on the string of characters that appear at the beginning of the object name. Uses case-sensitive pattern matching.

SELECT examples

get

Fetch user information using the result of the DESCRIBE command

SELECT
name,
display_name,
first_name,
last_name,
login_name,
middle_name,
comment,
created_on,
custom_landing_page_url,
custom_landing_page_url_flush_next_ui_load,
days_to_expiry,
default_namespace,
default_role,
default_secondary_roles,
default_warehouse,
disabled,
email,
enable_unredacted_query_syntax_error,
expires_at,
ext_authn_duo,
ext_authn_uid,
has_password,
has_rsa_public_key,
last_successful_login,
locked_until,
mins_to_bypass_mfa,
mins_to_bypass_network_policy,
mins_to_unlock,
must_change_password,
network_policy,
owner,
password,
password_last_set,
rsa_public_key,
rsa_public_key_2,
rsa_public_key_2_fp,
rsa_public_key_fp,
snowflake_lock,
snowflake_support,
type
FROM snowflake.roles.users
WHERE name = '{{ name }}' -- required
AND endpoint = '{{ endpoint }}' -- required
;

list

Lists the users in the system.

SELECT
name,
display_name,
first_name,
last_name,
login_name,
middle_name,
comment,
created_on,
custom_landing_page_url,
custom_landing_page_url_flush_next_ui_load,
days_to_expiry,
default_namespace,
default_role,
default_secondary_roles,
default_warehouse,
disabled,
email,
enable_unredacted_query_syntax_error,
expires_at,
ext_authn_duo,
ext_authn_uid,
has_password,
has_rsa_public_key,
last_successful_login,
locked_until,
mins_to_bypass_mfa,
mins_to_bypass_network_policy,
mins_to_unlock,
must_change_password,
network_policy,
owner,
password,
password_last_set,
rsa_public_key,
rsa_public_key_2,
rsa_public_key_2_fp,
rsa_public_key_fp,
snowflake_lock,
snowflake_support,
type
FROM snowflake.roles.users
WHERE endpoint = '{{ endpoint }}' -- required
AND "like" = '{{ like }}'
AND startsWith = '{{ startsWith }}'
AND showLimit = '{{ showLimit }}'
AND fromName = '{{ fromName }}'
;

INSERT examples

create

Create a user according to the parameters given

INSERT INTO snowflake.roles.users (
name,
password,
login_name,
display_name,
first_name,
middle_name,
last_name,
email,
must_change_password,
disabled,
days_to_expiry,
mins_to_unlock,
default_warehouse,
default_namespace,
default_role,
default_secondary_roles,
mins_to_bypass_mfa,
rsa_public_key,
rsa_public_key_2,
comment,
type,
enable_unredacted_query_syntax_error,
network_policy,
endpoint,
createMode
)
SELECT 
'{{ name }}' /* required */,
'{{ password }}',
'{{ login_name }}',
'{{ display_name }}',
'{{ first_name }}',
'{{ middle_name }}',
'{{ last_name }}',
'{{ email }}',
{{ must_change_password }},
{{ disabled }},
{{ days_to_expiry }},
{{ mins_to_unlock }},
'{{ default_warehouse }}',
'{{ default_namespace }}',
'{{ default_role }}',
'{{ default_secondary_roles }}',
{{ mins_to_bypass_mfa }},
'{{ rsa_public_key }}',
'{{ rsa_public_key_2 }}',
'{{ comment }}',
'{{ type }}',
{{ enable_unredacted_query_syntax_error }},
'{{ network_policy }}',
'{{ endpoint }}',
'{{ createMode }}'
RETURNING
status
;

Manifest

# Description fields are for documentation purposes
- name: users
props:
  - name: endpoint
    value: "{{ endpoint }}"
    description: Required parameter for the users resource.
  - name: name
    value: "{{ name }}"
    description: |
      User name
  - name: password
    value: "{{ password }}"
    description: |
      Password
  - name: login_name
    value: "{{ login_name }}"
    description: |
      Login name
  - name: display_name
    value: "{{ display_name }}"
    description: |
      Display name
  - name: first_name
    value: "{{ first_name }}"
    description: |
      First name
  - name: middle_name
    value: "{{ middle_name }}"
    description: |
      Middle name
  - name: last_name
    value: "{{ last_name }}"
    description: |
      Last name
  - name: email
    value: "{{ email }}"
    description: |
      Email address
  - name: must_change_password
    value: {{ must_change_password }}
    description: |
      Does this user need to change their password (e.g., after assigning a temp password)
  - name: disabled
    value: {{ disabled }}
    description: |
      Has this user been disabled from the system
  - name: days_to_expiry
    value: {{ days_to_expiry }}
    description: |
      How many days until this user expires
  - name: mins_to_unlock
    value: {{ mins_to_unlock }}
    description: |
      How many minutes until the account is unlocked after multiple failed logins
  - name: default_warehouse
    value: "{{ default_warehouse }}"
    description: |
      The default warehouse to use when this user starts a session
  - name: default_namespace
    value: "{{ default_namespace }}"
    description: |
      The default namespace to use when this user starts a session
  - name: default_role
    value: "{{ default_role }}"
    description: |
      The default role to use when this user starts a session
  - name: default_secondary_roles
    value: "{{ default_secondary_roles }}"
    description: |
      The default secondary roles of this user to use when starting a session. Only valid set values are ALL or NONE. Default is ALL after 2024-07 BCR.
    valid_values: ['ALL', 'NONE']
    default: ALL
  - name: mins_to_bypass_mfa
    value: {{ mins_to_bypass_mfa }}
    description: |
      How many minutes until MFA is required again
  - name: rsa_public_key
    value: "{{ rsa_public_key }}"
    description: |
      RSA public key of the user
  - name: rsa_public_key_2
    value: "{{ rsa_public_key_2 }}"
    description: |
      Second RSA public key of the user
  - name: comment
    value: "{{ comment }}"
    description: |
      Comment about the user.
  - name: type
    value: "{{ type }}"
    description: |
      Indicates the type of user (PERSON | SERVICE | LEGACY_SERVICE)
  - name: enable_unredacted_query_syntax_error
    value: {{ enable_unredacted_query_syntax_error }}
    description: |
      Whether to show unredacted query syntax errors in the query history.
  - name: network_policy
    value: "{{ network_policy }}"
    description: |
      Specifies an existing network policy is active for the user. Otherwise, use account default.
  - name: createMode
    value: "{{ createMode }}"
    description: Parameter allowing support for different modes of resource creation. Possible values include: - `errorIfExists`: Throws an error if you try to create a resource that already exists. - `orReplace`: Automatically replaces the existing resource with the current one. - `ifNotExists`: Creates a new resource when an alter is requested for a non-existent resource.
    description: Parameter allowing support for different modes of resource creation. Possible values include: - `errorIfExists`: Throws an error if you try to create a resource that already exists. - `orReplace`: Automatically replaces the existing resource with the current one. - `ifNotExists`: Creates a new resource when an alter is requested for a non-existent resource.

REPLACE examples

create_or_alter

Create a (or alter an existing) user. Even if the operation is just an alter, the full property set must be provided. Note that password is not currently altered by this operation but is supported for a newly-created object.

REPLACE snowflake.roles.users
SET 
name = '{{ name }}',
password = '{{ password }}',
login_name = '{{ login_name }}',
display_name = '{{ display_name }}',
first_name = '{{ first_name }}',
middle_name = '{{ middle_name }}',
last_name = '{{ last_name }}',
email = '{{ email }}',
must_change_password = {{ must_change_password }},
disabled = {{ disabled }},
days_to_expiry = {{ days_to_expiry }},
mins_to_unlock = {{ mins_to_unlock }},
default_warehouse = '{{ default_warehouse }}',
default_namespace = '{{ default_namespace }}',
default_role = '{{ default_role }}',
default_secondary_roles = '{{ default_secondary_roles }}',
mins_to_bypass_mfa = {{ mins_to_bypass_mfa }},
rsa_public_key = '{{ rsa_public_key }}',
rsa_public_key_2 = '{{ rsa_public_key_2 }}',
comment = '{{ comment }}',
type = '{{ type }}',
enable_unredacted_query_syntax_error = {{ enable_unredacted_query_syntax_error }},
network_policy = '{{ network_policy }}'
WHERE 
user_name = '{{ user_name }}' --required
AND endpoint = '{{ endpoint }}' --required
AND name = '{{ name }}' --required
RETURNING
status;

DELETE examples

delete

Delete a user with the given name.

DELETE FROM snowflake.roles.users
WHERE name = '{{ name }}' --required
AND endpoint = '{{ endpoint }}' --required
AND ifExists = '{{ ifExists }}'
;