COF-C03 Question 333
Single answerSharing and resharingA data provider account in Snowflake created a secure share that contains several secure views over sales tables. One consumer account has already created a database from the share and now wants to make a subset of that shared data available to a partner account without copying the data. The provider also wants to ensure that the partner can see only the subset selected by the consumer. Which action should the consumer take to meet this requirement?
- A
Create a new share directly from the imported shared database and grant the partner account access to that share.
- B
Create secure views in the imported database for the subset of data, then add those views to a new share for the partner account.
- C
Create a database role on the imported shared database and grant that database role to the partner account.
- D
Create a new database in the consumer account, define secure views in that database that reference objects in the imported shared database, and share that new database with the partner account.
Show answer and explanation
Correct answer: D
Explanation
This scenario tests understanding of Snowflake sharing and resharing. A consumer cannot directly share an imported database because imported databases are read-only and are not valid objects to share onward. To re-share data, the consumer must create its own database, create secure views that reference the imported shared data, and then share those secure views with another account. Secure views are important because they preserve the provider's and consumer's intended access boundaries while enabling controlled data exposure without replication. This aligns with Snowflake documentation on data sharing and data providers/consumers: imported shared databases cannot be modified, and resharing requires creating secure objects in a database owned by the resharing account.
- A. Incorrect.
Incorrect. Snowflake does not allow consumers to directly reshare objects from an imported shared database by creating a share on that imported database itself. Imported databases are read-only and cannot be used as the direct source for a new share.
- B. Incorrect.
Incorrect. Although secure views are required for controlled resharing, the consumer cannot create objects inside the imported shared database because it is read-only. This is a common misconception: consumers can query imported data, but they cannot add new objects to the imported database.
- C. Incorrect.
Incorrect. Database roles help manage privileges within a database, but they do not enable cross-account data sharing from an imported shared database to another account. In addition, granting a database role to a partner account is not the mechanism Snowflake uses for data sharing between accounts.
- D. Correct.
Correct. To reshare data, the consumer must create a separate database in its own account, then create secure views in that database that reference the imported shared database. The consumer can then create a new secure share on this locally owned database and grant access to the partner account. This allows the consumer to expose only the intended subset while avoiding data copying.