ARA-C01 Question 132
Single answerSharing within the same organization/same Snowflake accountA global enterprise uses one Snowflake account to host multiple business units. The Finance team owns a database with curated reporting tables and secure views. The HR analytics team, using separate roles in the same Snowflake account, needs read-only access to a subset of those objects without copying data and without managing a separate provider/consumer share setup. The architect wants the simplest solution that preserves central ownership of the source objects while allowing controlled access inside the same account. Which approach should the architect recommend?
- A
Create a secure data share from Finance and add the same Snowflake account as the consumer, then have HR create a database from the share.
- B
Grant IMPORTED PRIVILEGES on the Finance database directly to the HR role so the role can query shared objects in place.
- C
Create a database role in the Finance database, grant it SELECT on the required tables and secure views, then grant that database role to the HR role.
- D
Clone the Finance database into a new HR database and grant USAGE and SELECT on the clone to the HR role.
Show answer and explanation
Correct answer: C
Explanation
Within the same Snowflake account, the preferred pattern is standard role-based access control rather than data sharing. Snowflake supports account roles and database roles to delegate access to objects without copying data. Database roles are particularly useful when a data-owning team wants to package object privileges within a database and then grant those privileges to account roles used by other teams. This aligns with best practices for centralized governance, least privilege, and simplified administration. By contrast, shares and IMPORTED PRIVILEGES are designed for shared databases consumed from a share, typically across accounts. Cloning, while efficient, creates a separate object set and is better suited for isolation scenarios rather than ongoing same-account access to the authoritative source objects. Relevant Snowflake documentation includes guidance on database roles, access control (RBAC), secure views, and data sharing concepts distinguishing native grants from share-based consumption.
- A. Incorrect.
Incorrect. Shares are primarily intended for sharing data across accounts, including reader accounts and accounts within or outside the organization. Using a share back into the same account is not the simplest or intended mechanism for intra-account access control. It also adds unnecessary provider/consumer administration when standard grants or database roles can solve the requirement more directly.
- B. Incorrect.
Incorrect. IMPORTED PRIVILEGES applies to databases created from shares. It is not a way to grant access directly on a regular database within the same account. A candidate might choose this option because imported privileges are associated with shared data access, but that applies after a consumer database is created from a share, not for native same-account role-based access.
- C. Correct.
Correct. For sharing access within the same Snowflake account, the recommended approach is to use Snowflake RBAC, including database roles when the owner wants to manage object-level privileges centrally within a database. The Finance team can create a database role, grant privileges on the specific tables and secure views, and then grant that database role to an account role used by HR. This avoids data duplication, keeps ownership centralized, and is simpler than setting up a share for same-account use.
- D. Incorrect.
Incorrect. A zero-copy clone avoids physical duplication at creation time, but it creates a separate database that HR would then need to manage. This does not preserve a single centrally managed access path to the live source objects and can introduce drift if additional privileges or objects must be maintained separately. Cloning is useful for isolation, testing, and sandboxing, but it is not the simplest solution for controlled read-only access to a subset of current objects in the same account.