COF-C03 Question 21
Single answerOrganization and account objectsA global company uses a Snowflake organization with several accounts for development, testing, and production across different cloud regions. The security team wants a central administrator to create a new account for a regional analytics team and also review organization-level usage for all accounts. Which role should be granted to the administrator to perform these tasks with the least privilege?
- A
ACCOUNTADMIN in one existing account
- B
ORGADMIN at the organization level
- C
SECURITYADMIN in each account
- D
SYSADMIN in the organization's primary account
Show answer and explanation
Correct answer: B
Explanation
Snowflake separates organization-level administration from account-level administration. Tasks such as creating accounts within an organization and reviewing organization-wide information are performed by the ORGADMIN role, not by account-level roles like ACCOUNTADMIN, SECURITYADMIN, or SYSADMIN. This distinction is important in real-world enterprise deployments where multiple Snowflake accounts are centrally governed. Following least-privilege principles, ORGADMIN is the appropriate role because it grants the specific organization-scope capabilities required without relying on broader or irrelevant account-level privileges. This aligns with Snowflake documentation on organization roles and account management, which distinguishes organization objects and operations from standard account administration.
- A. Incorrect.
Incorrect. ACCOUNTADMIN is the highest role within a single Snowflake account, but it does not provide organization-level authority to create new accounts in the organization or view organization-wide information across all accounts. A common misconception is assuming the highest account role automatically extends to the organization level, which it does not.
- B. Correct.
Correct. ORGADMIN is the organization-level administrative role used to manage organization objects and operations, including creating and managing accounts in the organization and accessing organization-level views and usage capabilities. This is the least-privilege role that matches the stated requirements because the tasks involve organization scope rather than a single account.
- C. Incorrect.
Incorrect. SECURITYADMIN is focused on managing security objects such as users, roles, and grants within an account. Even if granted in multiple accounts, it does not provide centralized organization-level privileges to create accounts or manage organization objects. This option reflects the misconception that combining account-level privileges can replace organization-level authority.
- D. Incorrect.
Incorrect. SYSADMIN manages objects such as warehouses, databases, schemas, and other account-level resources, typically within one account. It does not have organization-level privileges for creating accounts or reviewing organization-wide usage across all accounts. Being in a primary account does not elevate SYSADMIN to organization administration.