ARA-C01 Question 301
Single answerConnectorsA SaaS company is building a Snowflake Native App with a Snowflake Connector for PostgreSQL to onboard customer data into each customer's own Snowflake account. During pilot testing, several customers report that connector setup fails because the application cannot create the required integration objects and warehouses using the customer's default application role. The SaaS company's architects want a design that minimizes manual setup, follows Snowflake security best practices, and allows the app to provision only the privileges required for the connector to operate. Which approach should the architects recommend?
- A
Require customers to grant ACCOUNTADMIN to the application so the connector can create all required objects during installation.
- B
Design the app to request elevated privileges through app specifications and have a customer-approved app instance role perform the setup steps needed by the connector.
- C
Instruct customers to pre-create every warehouse, integration, database, and schema manually before installing the app, because connectors cannot participate in controlled privilege elevation.
- D
Embed a service user and password for each customer inside the application package so the connector can authenticate externally and create missing Snowflake objects.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use Snowflake Native App and connector privilege-management patterns that let customers explicitly approve the app's required privileges, rather than over-privileging the app or forcing excessive manual configuration. In practical connector deployments, the architect should minimize setup friction while adhering to least privilege. Requiring ACCOUNTADMIN is an anti-pattern because it grants unnecessary authority. Similarly, embedding credentials is a serious security flaw and bypasses Snowflake's governance model. Snowflake best practices for Native Apps and connectors emphasize controlled, customer-approved privilege elevation for app setup and operation, using application roles and related app authorization mechanisms so the connector can create or manage only the objects it truly needs.
- A. Incorrect.
Incorrect. Granting ACCOUNTADMIN to an application is not aligned with least-privilege design and is far broader than necessary for connector setup. Snowflake Native Apps and connector-based solutions should avoid requiring highly privileged administrative roles when a scoped, customer-approved privilege model can be used instead.
- B. Correct.
Correct. For Snowflake connectors deployed through a Native App, the recommended pattern is to use customer-approved privilege requests and app roles/instance roles so the app can perform only the setup tasks it actually needs. This supports least privilege, reduces operational friction, and lets customers explicitly approve elevated access required for creating or managing connector-related objects.
- C. Incorrect.
Incorrect. While some prerequisites can be pre-created by customers in certain designs, it is not true that connectors cannot use controlled privilege elevation. For Native Apps and connector scenarios, Snowflake provides mechanisms to request and manage the privileges needed for installation and operation, which is generally preferable to forcing extensive manual setup.
- D. Incorrect.
Incorrect. Embedding per-customer credentials in an application package is insecure and not an approved Snowflake design pattern for provisioning Snowflake objects in customer accounts. Connector setup should rely on Snowflake's native security and privilege model rather than distributing static administrative credentials.