ADA-C01 Question 451
Single answerShare different types of data objects including secure functionsA data provider wants to share a curated dataset with an external consumer using a secure share. The dataset includes several tables in database PROD_DB and a user-defined function that masks part of a customer identifier before it is exposed to consumers. The provider must ensure the consumer can use the function as part of queries against the shared data, while preventing exposure of underlying implementation details. Which action should the Snowflake administrator take?
- A
Create a secure UDF in PROD_DB, grant USAGE on the database and schema plus SELECT on the shared tables and USAGE on the function to the share, then add the share to the consumer account.
- B
Create a standard UDF in PROD_DB, grant SELECT on the shared tables to the share, and rely on the consumer's account privileges to execute the function.
- C
Clone the tables and function into a reader account database, because functions cannot be included in a secure share.
- D
Create a secure view that calls a standard UDF, then grant SELECT on the secure view to the share; the function does not need to be secure because only the view is shared.
Show answer and explanation
Correct answer: A
Explanation
In Snowflake Secure Data Sharing, providers can share more than just tables, including secure views and secure user-defined functions. When a consumer needs to execute function logic against shared data, the function should be created as a secure UDF so that its implementation details are protected and the object is eligible for secure sharing scenarios. The provider must grant the appropriate privileges to the share: typically USAGE on the database and schema containing the shared objects, SELECT on tables or views being exposed, and USAGE on the secure function. Standard UDFs are not the correct choice for this requirement because they do not provide the same protection for implementation details in a shared context. This aligns with Snowflake best practices and documentation for Secure Data Sharing, secure views, and secure UDFs.
- A. Correct.
Correct. To share executable logic with data consumers through Secure Data Sharing, the function must be a secure UDF. The provider must grant the necessary privileges to the share, including USAGE on the database and schema, SELECT on underlying shared tables or views as appropriate, and USAGE on the secure function. Secure functions are specifically designed to be shareable without exposing implementation details that standard functions may reveal.
- B. Incorrect.
Incorrect. Standard UDFs cannot be shared through a secure share in the same way secure UDFs can. The misconception is that table access alone is sufficient and that execution rights can come from the consumer account. In Snowflake data sharing, the provider must explicitly grant object privileges to the share, and the shared function must be created as secure if it is to be shared safely.
- C. Incorrect.
Incorrect. Functions can be shared, but they must be secure functions when exposed through data sharing. A reader account is not required just because a function is part of the shared solution. This option reflects the misconception that sharing executable logic requires copying or duplicating objects into a separate environment.
- D. Incorrect.
Incorrect. A secure view helps protect underlying query logic, but if the view calls a UDF that is intended to be part of the shared execution path, the function itself must still meet sharing requirements. Using a standard UDF does not satisfy the requirement to prevent exposure of implementation details for the function logic in a shared context.