COF-C03 Question 158
Single answerSystem-defined rolesA Snowflake account has several custom roles used by developers and analysts. During a security review, the team discovers that some custom roles were granted directly to the ACCOUNTADMIN role for convenience. The security lead wants to reduce risk by ensuring highly privileged system-defined roles are used only when necessary, while still allowing administrators to manage users, roles, and warehouses. Which system-defined role is the BEST choice to perform routine identity and access administration without using the most powerful role in the account?
- A
ACCOUNTADMIN
- B
SECURITYADMIN
- C
SYSADMIN
- D
USERADMIN
Show answer and explanation
Correct answer: B
Explanation
Snowflake provides several system-defined roles with distinct administrative responsibilities. For least-privilege administration, ACCOUNTADMIN should be reserved for exceptional tasks because it is the most powerful role in the account. USERADMIN is responsible for creating users and roles, while SYSADMIN manages many account objects such as warehouses and databases. SECURITYADMIN is generally the best role for routine identity and access administration because it inherits USERADMIN and can manage grants across the account. In practice, administrators often separate duties by using SYSADMIN for object administration and SECURITYADMIN for access control. This aligns with Snowflake guidance to minimize use of ACCOUNTADMIN and rely on lower-privileged system-defined roles whenever possible.
- A. Incorrect.
Incorrect. ACCOUNTADMIN is the highest-level system-defined role and inherits privileges from other major administrative roles. It should be tightly controlled and used sparingly for tasks that truly require full account-level administration. Using it for routine identity and access administration violates least-privilege best practices.
- B. Correct.
Correct. SECURITYADMIN is the appropriate system-defined role for routine identity and access administration because it can manage grants globally and inherits the USERADMIN role. This allows it to create and manage users and roles and grant roles to users or other roles without relying on ACCOUNTADMIN for day-to-day access administration.
- C. Incorrect.
Incorrect. SYSADMIN is intended primarily for creating and managing objects such as warehouses, databases, schemas, and other account objects used for operational administration. While it is powerful for object management, it is not the best role for routine user and role administration.
- D. Incorrect.
Incorrect. USERADMIN is focused on creating users and roles, but it is not the best answer in this scenario because the requirement includes broader identity and access administration. SECURITYADMIN inherits USERADMIN and also has the global ability to manage grants, making it more suitable for routine access administration.