# Simplifying Multiple Snowflake Accounts Management, Security & Governance [By Ben Herzberg](https://blog.satoricyber.com/author/ben/) | Chief Scientist December 9, 2021 ## Reasons For Having Multiple Snowflake Accounts ### Testing and Staging Environments When developing software, it is important to keep a separation between development, testing, and staging environments. This is done to minimize the impact of bugs on the production environment. A part of healthy [DataOps](/content/dataops/a-comprehensive-guide-to-dataops/index.html) is to do the same for data infrastructure and introduce changes first on a staging environment, and only then on production. In Snowflake, this can be achieved in several ways. Some organizations put their staging databases on the same account as their production data. This is typically done to reduce overheads in managing multiple environments. However, this is often a shortcut that comes at the expense of a more complete staging environment... having a separate account where changes are made first, and once verified, are applied to production. ### Early Access Another reason for having separate accounts... is an environment where [Snowflake early access](https://docs.snowflake.com/en/user-guide/intro-releases.html) is enabled. As Snowflake is a SaaS product that continuously changes, it makes sense to take into account changes introduced by Snowflake. ### Multiple Business Units In many companies, Snowflake is used across multiple business units... Some organizations are solving these challenges within a single account. However, this is not always the case, and some organizations decide to simplify the separation, by having several Snowflake accounts and distributing them to their different business units. ### Regional Accounts For regulatory and compliance reasons, data from specific regions must be stored within a certain geographic region. Certain restrictions specific to these regions must be imposed... ### B2B Multiple Accounts Some businesses are managing data for other businesses in Snowflake. In some cases, the best way to separate the data of different customers is to use a separate account for each one of them. ### Different Cost Plans Organizations occasionally store different types of data with different requirements, where certain data may require higher account tiers. ## Simplifying Account Creation With ORGADMIN In the past, managing multiple accounts was done using support tickets. However, it is now possible to manage multiple accounts by using the ORGADMIN role. For example, to span a new account, you can use the following command: | | | --- | | CREATE ACCOUNT stage2
ADMIN d_NAME = stageadmin
ADMIN_PASSWORD = 'Aa123456' /* not this password :) */
FIRST_NAME = stage
LAST_NAME = admin
MUST_CHANGE_PASSWORD = TRUE
EMAIL = 'dataops@acme.corp'
EDITION = standard
REGION = aws_us_east_1; | ## Managing Multiple Snowflake Accounts Opening new accounts is one thing. However, managing them at scale, especially from a security, [data governance](/content/data-governance/essential-guide/index.html), and privacy point of view, is not trivial. | | | | | --- | --- | --- | | The Challenge | With Satori | Alternatives | | [Discovering Sensitive Data](https://blog.satoricyber.com/simplifying-multiple-snowflake-accounts-management-security-governance/#DiscoveringSensitive) | Continuous discovery Data Inventory for all accounts | Periodic data classification scans | | [Auditing & Monitoring](https://blog.satoricyber.com/simplifying-multiple-snowflake-accounts-management-security-governance/#AuditingMonitoring) | Audit across all data platforms | Effort when audit is actually required
ETLs to prepare logs | | [Access Control](https://blog.satoricyber.com/simplifying-multiple-snowflake-accounts-management-security-governance/#AccessControl) | Simplified access control across any number of accounts | Orchestration, or data engineering effort | | [Distributed Data Stewardship](https://blog.satoricyber.com/simplifying-multiple-snowflake-accounts-management-security-governance/#DistributedData) | Simplified data stewardship including classification and authorization across accounts | Orchestration, or data engineering effort | ### Discovering Sensitive Data Across Multiple Snowflake Accounts #### The Challenge Knowing where sensitive data is across accounts to place security controls and generate compliance reports. #### With Satori Satori continuously discovers sensitive data across all accounts... You can manage the classifications from a centralized location... #### Alternative Solutions An alternative may be to scan each account for sensitive data... performing periodic scans may be ineffective in a data-driven environment. ### Auditing & Monitoring For Multiple Snowflake Accounts #### The Challenge You require a data access log for security and compliance reasons. This data is kept per account, adding operational overhead and complicating finding answers to security and compliance requirements. #### With Satori With Satori, all data access is logged... You can analyze the data in its entirety... #### Alternative Solutions You can do nothing different and require reporting/querying of logs in your accounts... creates significant overhead. ### Access Control Across Multiple Snowflake Accounts #### The Challenge Managing access control can be challenging for multiple accounts due to varying knowledge in data engineering and security... #### With Satori Satori enables security management to be separated from the data infrastructure... #### Alternative Solutions Your data engineering team can write scripts to automate projects across accounts... distracting teams from core business value. ### Distributed Data Stewardship Across Multiple Accounts #### The Challenge Distributing data stewardship across multiple accounts can create delays in data accessibility... #### With Satori With Satori, datasets can be defined for specific data stewards... applying controls without data engineering resources. #### Alternative Solutions An alternative is building your own solution or using an orchestration solution... building your own can be complicated with hidden costs. ## Conclusion Splitting your Snowflake Data Cloud to separate accounts is a valid decision. Satori provides advantages to keep your security, governance, and privacy requirements at bay without excessive data engineering resources.