ARA-C01 Question 100
Single answerUser, role, and grants provisioningA global company is onboarding hundreds of analysts into Snowflake across multiple business units. The security team wants a provisioning model that minimizes direct grants to users, supports least privilege, and ensures that when a user changes departments, administrators can update access with minimal manual effort. The company also wants analysts to be able to query approved shared data sets without being able to modify any objects. Which approach should the architect recommend?
- A
Grant database, schema, and table privileges directly to each analyst user, and use future grants only for new tables.
- B
Create functional access roles for analysts, grant object privileges to those roles, assign the roles to users, and use role hierarchy to inherit higher-level access where needed.
- C
Assign all analysts the SYSADMIN role so they can inherit required access automatically, then restrict data modification through warehouse-level permissions.
- D
Create one custom role per user, grant all required privileges to each custom role, and avoid role inheritance so access remains explicit.
Show answer and explanation
Correct answer: B
Explanation
The recommended Snowflake architecture for provisioning users and managing grants is role-based access control (RBAC): grant privileges to roles, then grant roles to users. This approach aligns with least-privilege principles and supports efficient lifecycle management when users change teams or responsibilities. A common pattern is to create object access roles (for example, read-only access to specific schemas or databases), then grant those roles to higher-level functional or business roles assigned to users. This minimizes direct grants, reduces administrative effort, and improves auditability. For read-only analyst access, the relevant privileges typically include USAGE on the warehouse, database, and schema, plus SELECT on tables and views as needed. Snowflake documentation and best practices consistently recommend managing access through roles rather than direct user grants, and using role hierarchy to simplify administration in enterprise environments.
- A. Incorrect.
Incorrect. Directly granting privileges to users does not align with Snowflake best practice for scalable access control. It increases administrative overhead and makes department changes harder to manage because each user's grants must be updated individually. While future grants can help with newly created objects, they do not solve the core governance issue of user-centric privilege management.
- B. Correct.
Correct. Snowflake best practice is to grant privileges to roles, not directly to users, and then assign roles to users. A functional role design supports least privilege and simplifies provisioning and deprovisioning. Role hierarchy allows business roles to inherit lower-level object access roles, reducing duplication and making departmental changes easier. Analysts can be granted only USAGE and SELECT-related privileges through read-only roles, which allows querying approved data sets without modification capability.
- C. Incorrect.
Incorrect. SYSADMIN is a high-privilege administrative role and should not be assigned broadly to analysts. It violates least privilege and creates unnecessary risk. In Snowflake, warehouse privileges do not control whether a user can modify database objects or data; object-level privileges such as INSERT, UPDATE, DELETE, CREATE, and OWNERSHIP govern those capabilities.
- D. Incorrect.
Incorrect. Creating one custom role per user often becomes difficult to govern at scale and defeats the purpose of role-based access control. It can lead to role sprawl and makes auditing and access reviews more complex. Avoiding role inheritance also removes one of Snowflake's key mechanisms for simplifying layered access models.