ADA-C01 Question 140
Single answerPerform organizational tasksAn enterprise uses Snowflake Organizations to centrally manage multiple accounts across AWS and Azure. The security team wants one administrator to review organization-wide account metadata, including edition, region, and account names, without granting that administrator broad privileges inside each individual account. Which role should be granted to meet this requirement with the least privilege?
- A
ORGADMIN in the organization account
- B
ACCOUNTADMIN in each member account
- C
SECURITYADMIN in the organization account
- D
SYSADMIN in the organization account
Show answer and explanation
Correct answer: A
Explanation
In Snowflake Organizations, organization-level tasks are separated from account-level administration. The ORGADMIN role is the correct role for performing organizational tasks such as viewing and managing accounts in the organization. This is preferable to assigning ACCOUNTADMIN across multiple accounts because it supports centralized administration and follows least-privilege best practices. By contrast, SECURITYADMIN and SYSADMIN are account-scoped roles and do not satisfy the requirement for organization-wide account visibility. This reflects Snowflake best practices for separating organization administration from account administration, as described in Snowflake documentation for Organizations, ORGADMIN, and account management.
- A. Correct.
Correct. The ORGADMIN role is designed for organization-level administration tasks, such as viewing and managing accounts across the Snowflake organization. It provides access to organization-wide metadata and account management capabilities without requiring powerful administrative roles inside every individual account. This aligns with the least-privilege requirement for reviewing organization-level account information.
- B. Incorrect.
Incorrect. Granting ACCOUNTADMIN in every member account would provide far more privilege than necessary and would require separate administrative access within each account. The scenario specifically calls for organization-wide visibility without broad privileges inside each account, so this approach violates least-privilege principles.
- C. Incorrect.
Incorrect. SECURITYADMIN is an account-level role focused on managing grants and security objects within an account. It is not the primary organization-level role for reviewing organization-wide account metadata across all accounts in a Snowflake organization.
- D. Incorrect.
Incorrect. SYSADMIN is also an account-level role intended for managing objects such as warehouses, databases, and schemas within an account. It does not provide the organization-wide administrative scope needed to review metadata across all accounts in the organization.