COF-C03 Question 324
Single answerAccountsA company has separate Snowflake accounts for development, testing, and production under the same organization. The security team wants to give an auditor read-only visibility into account-level usage and billing trends across all three accounts without allowing the auditor to modify objects or switch into administrative roles inside each account. Which approach should the Snowflake administrator recommend?
- A
Create the auditor as a local user in each account and grant ACCOUNTADMIN so the auditor can view all account usage views
- B
Use the organization account to review organization-level usage and billing information across accounts, and grant the auditor an appropriate read-only role there
- C
Replicate the ACCOUNT_USAGE schema from each account into a central database and grant the auditor SYSADMIN on that database
- D
Create database roles in each production database and grant them to the auditor, because database roles provide account-level visibility across all accounts in the organization
Show answer and explanation
Correct answer: B
Explanation
For cross-account visibility into usage and billing across multiple Snowflake accounts in the same organization, the organization account is the best fit. Snowflake provides organization-level views and capabilities specifically for centralized administration, billing review, and account monitoring. This supports the security team's requirement to give an auditor read-only access without over-privileging the user in each account. Best practice is to follow least privilege and avoid granting powerful account roles such as ACCOUNTADMIN or SYSADMIN when only reporting visibility is needed. Snowflake documentation on organizations, organization accounts, and organization usage views describes these centralized capabilities.
- A. Incorrect.
Incorrect. While ACCOUNTADMIN can access broad metadata and billing-related information within an account, granting ACCOUNTADMIN violates least-privilege principles and gives far more power than required. It also requires managing access separately in each account, which does not meet the goal of centralized cross-account visibility without administrative access.
- B. Correct.
Correct. The organization account is designed to provide organization-wide visibility, including usage, billing, and account information across accounts in the same Snowflake organization. Granting an appropriate read-only role in the organization account aligns with least privilege and avoids giving the auditor powerful administrative roles in each individual account.
- C. Incorrect.
Incorrect. This is not the recommended solution for centralized cross-account billing and account visibility. ACCOUNT_USAGE data is account-specific, and trying to centralize it through replication adds complexity and administrative overhead. In addition, granting SYSADMIN is excessive for a read-only auditor and does not satisfy the requirement to avoid administrative privileges.
- D. Incorrect.
Incorrect. Database roles are scoped to database objects, not to account-level or organization-level metadata. They cannot provide cross-account visibility into billing or account usage across an entire organization. This option reflects a common misunderstanding between database-level access control and organization/account-level governance.