ADA-C01 Question 61
Single answerProvide access to non-account Administrators to monitor billing and usage informationA Snowflake account uses a strict separation-of-duties model. The ACCOUNTADMIN role must not be granted to the FinOps team, but those users need to monitor warehouse credit consumption, storage trends, and monthly billing data for chargeback reporting. The team should be able to query usage and billing data in Snowsight without receiving broader administrative privileges. Which action should the Snowflake administrator take?
- A
Grant the global MONITOR USAGE privilege to a custom role and assign that role to the FinOps users
- B
Grant the MONITOR privilege on each warehouse to the FinOps users so they can see all billing and account usage views
- C
Grant imported privileges on the SNOWFLAKE database to a custom role and assign that role to the FinOps users
- D
Grant the ACCOUNTADMIN role temporarily each month so the FinOps users can review billing data and then revoke it
Show answer and explanation
Correct answer: C
Explanation
To provide non-account administrators with access to billing and usage information, Snowflake best practice is to use a custom role with imported privileges on the SNOWFLAKE database. The SNOWFLAKE database contains shared metadata, including views commonly used for usage monitoring and chargeback analysis. This approach supports least privilege and avoids granting ACCOUNTADMIN. Warehouse-level MONITOR privileges are insufficient because they only expose object-specific monitoring details, not the broader billing and account usage datasets needed for financial reporting. Refer to Snowflake documentation on the SNOWFLAKE database, imported privileges, and Account Usage views for the supported access model.
- A. Incorrect.
Incorrect. MONITOR USAGE is a global privilege, but it is not the standard mechanism for giving non-account administrators access to Snowflake-provided billing and usage views in the SNOWFLAKE database. In practice, access to many Account Usage, Organization Usage, and other shared metadata objects is typically provided through imported privileges on the SNOWFLAKE database. Choosing this option reflects a common confusion between global monitoring privileges and access to Snowflake's shared system database content.
- B. Incorrect.
Incorrect. MONITOR on a warehouse allows a role to view warehouse status and query activity related to that warehouse, but it does not provide access to centralized billing and usage datasets such as the ACCOUNT_USAGE or other Snowflake-provided usage views. This option is plausible because warehouse monitoring sounds related to credit usage, but it is too narrow and does not solve access to account-level billing information.
- C. Correct.
Correct. The recommended approach is to create a custom role and grant imported privileges on the SNOWFLAKE database to that role, then assign the role to the FinOps users. This gives access to Snowflake-provided shared metadata, including usage and billing-related views exposed through the SNOWFLAKE database, without granting full ACCOUNTADMIN. This aligns with least-privilege administration and is the standard way to allow non-account administrators to query billing and usage information.
- D. Incorrect.
Incorrect. Granting ACCOUNTADMIN, even temporarily, violates the separation-of-duties requirement and gives far more power than needed. ACCOUNTADMIN is highly privileged and should be tightly restricted. This option is a common operational shortcut, but it is not a best practice when the requirement is specifically to provide visibility into billing and usage without broader administrative access.