Snowflake

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

BEGIN TRANSACTION;
    USE ROLE ACCOUNTADMIN; -- This combines both SYSADMIN and SECURITYADMIN

    -- IMPORTANT, PLEASE FILL THIS OUT AND SAVE THIS --
    SET ROLE_NAME = 'ARTIE_TRANSFER_ROLE';
    SET SERVICE_USER = 'ARTIE';
    SET DWH_NAME = UPPER('DWH');
    SET DB_NAME = UPPER('DB_NAME');
    SET SCHEMA_NAME = UPPER('public');
    -- END IMPORTANT --
    SET DB_SCHEMA_NAME = CONCAT($DB_NAME, '.', $SCHEMA_NAME);

    CREATE ROLE IF NOT EXISTS identifier($ROLE_NAME);
    CREATE USER IF NOT EXISTS identifier($SERVICE_USER)
        rsa_public_key = '<contents of rsa_key.pub, without the BEGIN and END lines>'
        default_role = $ROLE_NAME;
    GRANT ROLE identifier($role_name) to USER identifier($SERVICE_USER);
    CREATE WAREHOUSE IF NOT EXISTS identifier($DWH_NAME)
        warehouse_size = xsmall
        warehouse_type = standard
        auto_suspend = 10
        auto_resume = true
        initially_suspended = true;

    CREATE DATABASE IF NOT EXISTS identifier($DB_NAME);
    CREATE SCHEMA IF NOT EXISTS identifier($DB_SCHEMA_NAME);

    GRANT USAGE ON WAREHOUSE identifier($DWH_NAME) TO ROLE identifier($ROLE_NAME);
    GRANT USAGE ON DATABASE identifier($DB_NAME) TO ROLE identifier($ROLE_NAME);
    GRANT ALL PRIVILEGES ON SCHEMA identifier($DB_SCHEMA_NAME) TO ROLE IDENTIFIER($ROLE_NAME);
    -- Required when Snowpipe Streaming is enabled.
    GRANT CREATE PIPE ON SCHEMA identifier($DB_SCHEMA_NAME) TO ROLE identifier($ROLE_NAME);

    GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA identifier($DB_SCHEMA_NAME) TO ROLE IDENTIFIER($ROLE_NAME);
    GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA identifier($DB_SCHEMA_NAME) TO ROLE IDENTIFIER($ROLE_NAME);
COMMIT;

ALTER USER ARTIE SET RSA_PUBLIC_KEY='MIIBIjANBgkqh...';