ADA-C01 Question 458
Single answerCreate and maintain outbound data sharesA Snowflake administrator needs to provide a downstream business partner with continuous read-only access to a curated set of reporting tables. The partner will consume the data from its own Snowflake account. The administrator creates a database role that has SELECT on the required schemas and tables, creates a secure view to mask internal columns, and then creates an outbound share. When validating the configuration, the administrator finds that the partner can see the shared database, but queries against the secure view fail with an authorization error. What is the MOST likely action required to make the share work correctly while preserving least privilege?
- A
Grant the database role to the share so the shared objects are available through the outbound share
- B
Grant IMPORTED PRIVILEGES on the provider database to the consumer account so the secure view can resolve underlying objects
- C
Convert the secure view to a regular view because regular views are required for outbound shares
- D
Add the consumer account to the share and grant REFERENCE_USAGE on any database that contains objects referenced by the secure view
Show answer and explanation
Correct answer: D
Explanation
The key issue is cross-database dependencies in shared secure views. In Snowflake, outbound shares can include tables, secure views, and other supported secure objects. When a secure view in the shared database references objects in a different database, the provider must grant REFERENCE_USAGE on the referenced database to the share; otherwise, consumers may see the shared database but encounter authorization errors when querying the view. Adding the consumer account to the share is also required so the share is available to that account. Snowflake documentation on secure data sharing and shares explains that secure views are required for sharing views and that REFERENCE_USAGE is needed for cross-database references. Using database roles with shares is valid and often recommended for maintainability, but it does not replace the need for REFERENCE_USAGE when dependencies span databases.
- A. Incorrect.
Incorrect. Database roles can be granted to shares for data sharing, but that alone is not sufficient if a secure view in the shared database references objects in another database. In that case, the share also needs the necessary cross-database reference privilege. A candidate might choose this because database roles are a newer and recommended way to package object privileges for sharing, but the scenario specifically indicates the consumer can already see the shared database and still gets an authorization error when querying the secure view.
- B. Incorrect.
Incorrect. IMPORTED PRIVILEGES is granted inside the consumer account on a shared database so roles in the consumer account can use the imported database. It is not something the provider grants on its own local database to fix secure view resolution in an outbound share. This distractor targets confusion between provider-side sharing configuration and consumer-side access control.
- C. Incorrect.
Incorrect. Outbound shares require secure objects for sharing views, including secure views, not regular views. Regular views cannot be shared in the same way because Snowflake requires secure views to protect underlying definitions and data access paths. Someone might choose this option if they remember there are special requirements for shared views but misremember which type is supported.
- D. Correct.
Correct. If a shared secure view references objects in another database, the share must include REFERENCE_USAGE on the referenced database in addition to the relevant object privileges on the shared objects. The consumer must also be added to the share. This is a common requirement when creating or maintaining outbound shares that expose secure views across databases. It preserves least privilege because REFERENCE_USAGE allows name resolution for dependencies without exposing all objects in the referenced database.