COF-C03 Question 123
Single answerStreamlit in SnowflakeA data team has built a Streamlit in Snowflake app that lets business users explore curated sales data stored in a shared database. The app runs successfully for the developer, but when analysts open it, the app loads and then fails when it tries to query a secure view in the shared database. The analysts already have USAGE on the Streamlit app itself. The team wants the analysts to use the app without being granted direct access to the underlying shared objects outside the app. Which action should the Snowflake administrator take to meet this requirement?
- A
Grant the analysts' role SELECT on the secure view and USAGE on the database and schema that contain it
- B
Create the Streamlit app so it runs with the owner’s rights, and ensure the app owner role has the required privileges on the shared database objects
- C
Grant the analysts' role OPERATE on the warehouse used by the Streamlit app so the app can inherit object access through the warehouse
- D
Convert the secure view to a regular view because Streamlit in Snowflake cannot query secure views for non-owner users
Show answer and explanation
Correct answer: B
Explanation
This question tests understanding of how Streamlit in Snowflake applications access data under Snowflake’s security model. A key design choice is whether the app runs with the viewer’s rights or the owner’s rights. When the requirement is to let users interact with data only through the app, without direct object privileges, owner’s rights is the appropriate approach. The app owner role must have the needed privileges on the referenced objects, while viewers need access to the app itself, not to every underlying table or view. Warehouse privileges are separate from data access privileges, and secure views are valid objects for app queries. This aligns with Snowflake best practices for least-privilege access and application-based data access control in Streamlit in Snowflake.
- A. Incorrect.
This is incorrect because granting the analysts direct SELECT and USAGE privileges would allow them to access the underlying objects outside the app, which violates the stated requirement. Although this would likely make the queries succeed, it does not preserve encapsulation of data access through the Streamlit app.
- B. Correct.
This is correct. Streamlit in Snowflake can be configured to run with the owner’s rights, allowing app viewers to use the app without needing direct privileges on the underlying objects. In this model, the privileges of the app owner are used for queries executed by the app, so the administrator must ensure the owner role has the necessary access to the secure view and related database objects.
- C. Incorrect.
This is incorrect because warehouse privileges control the ability to use or manage compute resources, not access to database objects such as views, tables, schemas, or databases. Granting OPERATE on a warehouse does not let a role query a secure view.
- D. Incorrect.
This is incorrect because Streamlit in Snowflake is not limited to regular views only. Secure views are supported Snowflake objects, and the issue here is privilege context, not object type compatibility. Changing a secure view to a regular view would not address the core requirement and could reduce security.