ADA-C01 Question 117
Select 21.7 Set up and manage security administration and authorization.A Snowflake administrator is redesigning access control for a finance data platform. The company wants to enforce separation of duties so that role management is handled by a small IAM team, while object privileges inside databases and schemas are managed by data platform administrators. The current design relies heavily on ACCOUNTADMIN for both tasks, and auditors have flagged this as excessive privilege concentration. The administrator needs to implement a model that reduces ACCOUNTADMIN usage while still allowing the IAM team to create roles and assign roles to users, and allowing platform administrators to grant object privileges on existing and future objects. Which TWO actions should the administrator take?
- A
Grant the CREATE ROLE privilege at the account level to a custom role used by the IAM team, and grant that role the global MANAGE GRANTS privilege so it can manage all object grants.
- B
Grant the global MANAGE GRANTS privilege to a custom platform-admin role so it can centrally grant and revoke privileges on securable objects, including future grants, without requiring object ownership.
- C
Grant the custom IAM role to SECURITYADMIN so members of the IAM team can activate SECURITYADMIN when role creation or role assignment tasks are required.
- D
Transfer ownership of all databases and schemas to the IAM team so they can grant object privileges without needing elevated system privileges.
- E
Use SECURITYADMIN for user and role administration, and delegate object-level privilege administration through either object ownership or MANAGE GRANTS to a separate custom administrative role.
Show answer and explanation
Correct answers: C, E
Explanation
The best answer is to separate identity and role administration from object privilege administration. In Snowflake, SECURITYADMIN is the built-in system role intended for creating roles, managing users, and granting roles. This makes it appropriate for a tightly controlled IAM team, avoiding routine use of ACCOUNTADMIN. For object privileges, Snowflake supports delegation through object ownership or through the global MANAGE GRANTS privilege, which allows a role to grant and revoke privileges on securable objects without owning them. This is useful for a platform-admin role that must manage access consistently across existing and future objects. The key design principle is least privilege and separation of duties: ACCOUNTADMIN should be reserved for a small number of exceptional account-wide tasks, not day-to-day role management and data access administration. This aligns with Snowflake documentation on system roles, the MANAGE GRANTS global privilege, and role-based access control best practices.
- A. Incorrect.
Incorrect. CREATE ROLE is an account-level privilege, but using MANAGE GRANTS for the IAM team violates the stated separation of duties because MANAGE GRANTS enables broad grant/revoke control across objects. The scenario specifically wants role management separated from object privilege administration. Giving both capabilities to the IAM team recreates excessive privilege concentration.
- B. Incorrect.
Incorrect. MANAGE GRANTS is indeed a global privilege that allows centralized grant and revoke management, including future grants, without owning each object. However, this option alone does not address the requirement that the IAM team be able to create roles and assign roles to users. It solves only part of the problem and therefore is not a complete action set for the scenario as written.
- C. Correct.
Correct. In Snowflake, SECURITYADMIN is the standard system role for user and role management, including creating roles and granting roles to users and other roles. Delegating access to SECURITYADMIN functions to a tightly controlled IAM team is aligned with least privilege and reduces the need to use ACCOUNTADMIN for routine security administration.
- D. Incorrect.
Incorrect. Transferring ownership of all databases and schemas to the IAM team is contrary to separation of duties and is operationally risky. Ownership is highly privileged and would give the IAM team broad control over objects well beyond role administration. It also creates unnecessary coupling between identity administration and data object administration.
- E. Correct.
Correct. Snowflake best practice is to minimize ACCOUNTADMIN use and delegate responsibilities. Object-level privilege administration can be handled either by object owners or by a role with the global MANAGE GRANTS privilege. Using a separate custom administrative role for this purpose preserves separation between IAM responsibilities and data/platform privilege management.