ADA-C01 Question 286
Single answerIdentify constraints with sharing a Snowsight chartA Snowflake administrator creates a Snowsight chart from a worksheet that queries a secure view in the PROD_DB database. The administrator wants to share the chart with several analysts in the same Snowflake account who use different roles. When testing, some analysts can open the shared chart while others receive errors or cannot view the data behind it. Which statement best explains the constraint the administrator must account for when sharing a Snowsight chart?
- A
A shared Snowsight chart is only a visual object; recipients do not need access to the underlying database objects as long as they can log in to Snowsight.
- B
A shared Snowsight chart can be viewed only by users in the same Snowflake account, and those users still need appropriate privileges on the underlying objects used by the chart query.
- C
A shared Snowsight chart automatically runs with the owner's role, so recipients can view the chart even if they do not have privileges on the secure view.
- D
A shared Snowsight chart can be shared externally with any email address, provided the worksheet warehouse is running at the time the recipient opens the chart.
Show answer and explanation
Correct answer: B
Explanation
The key constraint when sharing a Snowsight chart is that the chart can be shared only with users in the same Snowflake account, and sharing the chart does not override Snowflake security. Recipients must still have appropriate privileges on the underlying objects referenced by the chart's query. In practice, this means administrators should validate role grants on databases, schemas, views, and any dependent objects before assuming a shared chart will be visible to all intended users. This aligns with Snowflake's RBAC model and Snowsight sharing behavior: shared interface objects do not replace object-level authorization.
- A. Incorrect.
Incorrect. This is a common misconception. Sharing a chart in Snowsight does not bypass Snowflake access control. The chart is based on query results and underlying objects, so recipients must still be authorized to access the data used to render the chart. Simply having access to Snowsight is not sufficient.
- B. Correct.
Correct. Snowsight chart sharing is constrained to users within the same Snowflake account, and access to the chart does not grant access to the underlying data automatically. Recipients must have the necessary privileges through their active role or available roles to query the underlying objects, such as the secure view and dependent database objects.
- C. Incorrect.
Incorrect. Snowsight chart sharing does not generally function as definer-rights execution for the chart owner. The recipient's own permissions still matter. Assuming the owner's role is used is a dangerous misunderstanding because it would undermine Snowflake's role-based access control model.
- D. Incorrect.
Incorrect. Snowsight chart sharing is not a general external sharing mechanism for arbitrary email recipients. It is intended for collaboration among users in the same Snowflake account. Also, whether a warehouse is running is not the core constraint in this scenario; the key limitation is recipient identity/account scope and object privileges.