ARA-C01 Question 139
Single answerSharing to a non-Snowflake customerA data provider uses Snowflake on AWS us-east-1 and needs to share a curated set of secure views with a strategic partner that does not have a Snowflake account. The partner wants to query the data immediately without procuring cloud infrastructure or setting up a full Snowflake deployment, and the provider wants to minimize operational effort while retaining control over what objects are exposed. Which approach should the architect recommend?
- A
Create a reader account for the partner, grant access to a database created from the share, and let the provider manage the compute used by the partner.
- B
Export the data from the secure views to external stage files and send pre-signed URLs so the partner can query the files directly without Snowflake.
- C
Set up database replication to the partner's cloud account so the partner can access a read-only copy without needing a Snowflake account.
- D
Create a listing in the Snowflake Marketplace and require the partner to subscribe anonymously without creating any Snowflake identity.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a reader account. In Snowflake, secure data sharing lets providers share live data without copying it, and reader accounts extend this model to consumers who do not already have a Snowflake account. This is the standard architecture for sharing to a non-Snowflake customer. The provider creates the share, grants objects such as secure views to the share, creates the reader account, and then creates a database for the reader account from that share. The provider manages the warehouse and associated compute cost for the reader account, which aligns with the requirement to minimize setup effort for the partner.
This is preferable to file exports because exports break the live-sharing model, require extra operational processes, and reduce governance. It is also preferable to replication because replication is not a substitute for sharing to a non-account consumer. Marketplace listings are useful for broader data distribution, including private listings for selected consumers, but they do not eliminate the need for the consumer to have Snowflake access.
Relevant Snowflake documentation and best practices include Snowflake Secure Data Sharing, Reader Accounts, and guidance on using secure views/UDFs for governed sharing. Key implementation considerations include granting only the required secure objects to the share, understanding that reader accounts consume provider-managed compute, and ensuring the provider uses secure objects where needed to protect underlying logic and enforce controlled access.
- A. Correct.
Correct. A reader account is specifically designed for sharing data with consumers who do not already have a Snowflake account. The provider creates the share, creates a reader account, and then creates a database in that reader account from the share. The provider also provides and pays for the virtual warehouse resources that the reader account uses. This matches the scenario requirements: immediate access, no need for the partner to deploy full Snowflake infrastructure, and strong provider control over exposed objects through secure sharing constructs such as secure views.
- B. Incorrect.
Incorrect. Sending exported files through an external stage is not Snowflake secure data sharing and does not preserve the governed sharing model described in the scenario. The partner would not be querying the secure views in Snowflake; instead, they would be accessing static file extracts. This increases operational effort, introduces file lifecycle and security management overhead, and loses benefits such as live data access and centralized object-level governance through shares.
- C. Incorrect.
Incorrect. Database replication is a Snowflake-to-Snowflake capability and does not solve the requirement for a consumer that lacks a Snowflake account. Replication also targets another Snowflake account in a supported region/cloud configuration. It is intended for business continuity, disaster recovery, or cross-account/cross-region data availability, not for onboarding a non-Snowflake customer with minimal setup.
- D. Incorrect.
Incorrect. A Marketplace or private listing still requires the consumer to access Snowflake as a consumer with an appropriate Snowflake identity/account context. It is not an anonymous access mechanism for organizations with no Snowflake account at all. In this scenario, the requirement is specifically to share with a non-Snowflake customer immediately, which is the primary use case for a reader account.