ADA-C01 Question 468
Single answerCreate user and role for accessA Snowflake administrator needs to onboard a new group of data analysts. The analysts must be able to sign in, use a shared virtual warehouse, and query only the tables in the ANALYTICS.REPORTING schema. They must not be able to create objects or administer other users. The company also wants access to be managed using a dedicated custom role rather than granting privileges directly to users. Which sequence of actions best meets these requirements?
- A
Create a custom role ANALYST_ROLE, grant USAGE on the warehouse, database, and schema, grant SELECT on the required tables to ANALYST_ROLE, create the users, grant ANALYST_ROLE to the users, and set ANALYST_ROLE as a default role for those users if needed.
- B
Create the users first, grant SELECT on ANALYTICS.REPORTING tables directly to each user, and then grant USAGE on the warehouse to PUBLIC so the analysts can run queries.
- C
Create a custom role ANALYST_ROLE, grant OWNERSHIP on the ANALYTICS.REPORTING schema and the warehouse to ANALYST_ROLE, create the users, and grant ANALYST_ROLE to the users.
- D
Create a custom role ANALYST_ROLE, grant SELECT on the required tables to the role, create the users, and grant the role to the users. USAGE on the database, schema, and warehouse is not required because SELECT already provides query access.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to create a dedicated custom role, grant only the minimum required privileges to that role, and then grant the role to the users. In Snowflake RBAC, best practice is to grant privileges to roles, not directly to users, because role-based management is easier to audit, scale, and maintain. For read-only query access, the required privileges typically include USAGE on the virtual warehouse, USAGE on the database, USAGE on the schema, and SELECT on the relevant tables or views. If users should start with that role active when they log in, the administrator can set a default role on the user. This aligns with Snowflake documentation on access control and privilege requirements for querying database objects.
- A. Correct.
Correct. This follows Snowflake access control best practices by granting privileges to a custom role and then assigning that role to users. To query objects, analysts need USAGE on the warehouse, database, and schema, plus SELECT on the tables or views they need to access. Granting the custom role to users satisfies the requirement to avoid direct grants to users, and setting it as a default role can simplify the sign-in experience.
- B. Incorrect.
Incorrect. Although this would technically provide access, it violates the stated requirement to manage access through a dedicated custom role rather than direct grants to users. Granting warehouse access through PUBLIC is also overly broad and is not aligned with least-privilege administration.
- C. Incorrect.
Incorrect. OWNERSHIP is far too powerful for analysts because it allows full control over the objects, including the ability to transfer ownership and manage grants in ways that exceed read-only requirements. The scenario explicitly states that the analysts must not be able to create objects or administer others.
- D. Incorrect.
Incorrect. SELECT alone is insufficient. In Snowflake, querying tables also requires USAGE on the parent database and schema, and a running warehouse requires USAGE on that warehouse. This option reflects a common misunderstanding that object-level SELECT is enough by itself.