COF-C03 Question 122
Single answerStreamlit in SnowflakeA data engineering team publishes a Streamlit in Snowflake app that lets business users explore sales data stored in tables in the ANALYTICS database. After deployment, several users can open the app, but when they submit filters the app fails with an authorization error when querying the underlying tables. The app owner wants to fix access for users while following Snowflake best practices and avoiding direct grants on every base table to each end user. Which action should the administrator take?
- A
Grant users the USAGE privilege on the warehouse only, because Streamlit apps inherit all data access from the app owner automatically.
- B
Grant users OWNERSHIP on the Streamlit app object so they can execute queries against the underlying tables through the app.
- C
Create or use an application role for the Streamlit app, grant that application role the required privileges on the database objects the app queries, and grant the application role to the users or roles that need access.
- D
Convert the app into a secure view, because secure views are the only supported way to let Streamlit in Snowflake access protected data.
Show answer and explanation
Correct answer: C
Explanation
The key issue is that opening a Streamlit in Snowflake app does not automatically give a user data access to the objects the app queries. Access must still be granted through Snowflake's privilege model. A best-practice approach is to use an application role associated with the Streamlit app, grant that role the required privileges on the underlying database objects, and then grant the application role to the appropriate users or account roles. This supports centralized administration and least-privilege access. Warehouse privileges alone are insufficient because compute access does not replace object privileges. Likewise, granting OWNERSHIP is overly permissive, and secure views are optional design choices rather than a requirement for Streamlit in Snowflake. This aligns with Snowflake guidance for managing privileges for Streamlit apps and general RBAC best practices.
- A. Incorrect.
Incorrect. A warehouse is required to run queries, but warehouse access alone does not provide authorization to read databases, schemas, or tables. Streamlit in Snowflake does not automatically bypass object-level privileges just because a user can open the app. Users still need the necessary privileges through the appropriate role model.
- B. Incorrect.
Incorrect. OWNERSHIP is the highest privilege and is not a best-practice solution for routine app usage. Giving end users OWNERSHIP on the app object would be excessive and would not be the recommended way to manage access to the app's underlying data. This option reflects a common misconception that administrative control over the app object is equivalent to governed data access.
- C. Correct.
Correct. For Streamlit in Snowflake, administrators can use an application role to encapsulate the privileges the app needs on referenced Snowflake objects. Then they grant that application role to the roles or users who should use the app. This approach follows least-privilege principles and avoids granting direct access on every base table individually to each end user.
- D. Incorrect.
Incorrect. Secure views can be useful for governed data sharing and abstraction, but they are not the only supported way for Streamlit in Snowflake to access data. A Streamlit app can query supported Snowflake objects directly as long as the necessary privileges are granted. Converting the app into a secure view is not meaningful, because a Streamlit app and a secure view are different object types with different purposes.