Snowflake role hierarchy review error "role granted to itself" how to fix

TL;DR

Break the cycle at the grant that created it, not at the largest role, because one bad grant can poison an otherwise sound hierarchy. Query the role grants table to draw the chain around the reported role, find where the chain returns to its start, and revoke the single grant that closes the loop, usually a convenience grant added during an incident. Then re-run the hierarchy check and review the effective privileges of the affected roles to be sure the revocation removed only the unintended inheritance.

role granted to itself

Use this when

• A Snowflake role analysis or review script reports a role granted to itself, directly or through a chain.
• Role hierarchy diagrams loop or the review tool recursion never ends.
• Effective privilege checks for the involved roles look inflated.

Not for this skill when

• The hierarchy is deep but acyclic and the complaint is complexity. Redesign is optional; there is no error to fix.
• A user has too many roles directly. That is assignment hygiene, separate from grant cycles.

Steps

1. Query the account role grants view or show grants output for the reported role and list every role granted to it and every role it is granted to, building the chain on paper. Verify: the chain around the reported role is written out grant by grant.
2. Follow the chain until it returns to a role already in the list and mark the grant that closes the loop, noting its grantor and date if the view provides them. Verify: the closing grant is identified with its grantor.
3. Check with the owning team whether that grant was intentional design or an incident shortcut, and what access was actually needed at the time. Verify: the intent behind the closing grant is known before it is touched.
4. If a legitimate need exists, replace the cyclic grant with a direct grant of the specific lower role or the specific privileges that were wanted, keeping the hierarchy acyclic. Verify: the replacement grant is in place and the chain no longer loops.
5. Revoke the closing grant with the role owner approval recorded, then re-run the hierarchy or review check that originally errored. Verify: the check completes with no self grant error.
6. Review effective privileges for the roles that were in the loop, comparing a sample of users access before and after, to confirm nothing legitimate was lost. Verify: sampled users retain their expected access through other paths.
7. Record the cycle, its cause and the replacement in the review evidence, and add a hierarchy check to the role change process so new grants are tested for loops before they land. Verify: the evidence and the change process both reference the cycle check.

Why it happens

Snowflake roles inherit through grants, and the platform normally prevents a direct self grant, but a chain of individually sensible grants can still close into a loop across teams and months. Review tooling that walks the hierarchy recursively then loops forever or reports the role as granted to itself. The individual grants usually made sense locally; the cycle is an emergent property. Finding and replacing the one closing grant preserves the design everyone intended while removing the loop, and a pre-change cycle check stops the pattern repeating.

Variants and edge cases

Snowflake role hierarchy cycle detected in review

The cycle phrasing. Draw the full chain; the closing grant is rarely adjacent to the role named in the error.

role inherits from itself through nested grants

The inheritance phrasing. Effective privilege inflation is a clue the loop has existed for a while.

securityadmin granted role by mistake loop

The grantor phrasing. Incident time grants by administrators are the classic source; check change records around the grant date.

Edge cases to check before closing the review cycle:

• Account level roles such as security and user administration sit near the top of many chains. Take extra care before changing grants that touch them.
• Future grants and ownership grants are different from role grants. Keep the cycle analysis to role to role grants.
• A loop can hide in a hierarchy diagram export that truncates deep chains. Query the grants data directly for the full chain.

Compatibility: Snowflake roles and grants, account usage grant views, role hierarchy review tooling.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_XCuXyH7J4kzf2La-LF8ODg