ADA-C01 Question 457
Single answerCreate and maintain outbound data sharesA Snowflake administrator manages a provider account that shares curated sales data with an external partner. The partner reports that a newly added table in the SALES.CURATED schema is not visible in their reader account, even though they can still query the previously shared tables. The administrator wants to make the new table available while following Snowflake sharing best practices and minimizing the risk of exposing unintended objects. What should the administrator do?
- A
Grant SELECT on the new table to the share directly.
- B
Grant USAGE on the database and schema to the partner's reader account, then grant SELECT on the new table to that reader account.
- C
Create a new share that includes the entire SALES database, then assign that share to the existing reader account.
- D
Transfer OWNERSHIP of the new table to the share so the partner can access it automatically.
Show answer and explanation
Correct answer: A
Explanation
To maintain an outbound data share, the provider must explicitly grant privileges on each object intended for consumption. For database objects in a share, this generally means granting USAGE on the database and schema and granting SELECT on each table or secure view that should be visible. Newly created objects are not automatically included in an existing share unless the provider explicitly grants the necessary privilege on those objects to the share. Best practice is to grant only the specific objects needed rather than broad access to an entire database. This aligns with Snowflake documentation on secure data sharing and reader accounts, which emphasizes that privileges are granted to the share and then made available to the consumer through that share.
- A. Correct.
Correct. In Snowflake outbound sharing, objects are added to a share by granting privileges to the share itself. For tables and secure views, the provider grants SELECT on the specific object to the share. Since the partner can already access existing shared objects, the required database and schema USAGE privileges are presumably already in place on the share. Granting SELECT on only the new table follows least-privilege best practices and avoids exposing additional objects unintentionally.
- B. Incorrect.
Incorrect. Privileges for shared data are granted to the share, not directly to a consumer account or reader account. A reader account is associated with a share, but the provider does not grant object privileges directly to that reader account in the same way as standard role-based access within an account. This option reflects a common misunderstanding between internal access control and data sharing configuration.
- C. Incorrect.
Incorrect. Creating a new share for the entire database would likely expose more objects than necessary and does not align with the requirement to minimize the risk of unintended exposure. Also, sharing is typically managed with explicit grants to the share for only the required databases, schemas, and objects. Broadening the scope to the full database is not a best-practice response to adding a single table.
- D. Incorrect.
Incorrect. Ownership cannot be transferred to a share. A share is not a role or a database object owner; it is a mechanism for exposing objects to consumers. Snowflake sharing works by granting privileges such as USAGE and SELECT to the share, not by changing object ownership.