ARA-C01 Question 99
Single answerUser, role, and grants provisioningA company is redesigning Snowflake access control for 300 analysts and engineers across multiple business units. The security team wants to minimize direct privilege grants to users, ensure future tables and views in each schema are automatically accessible to the appropriate teams, and make it easy to audit who can access production data. Which approach should the architect recommend?
- A
Grant object privileges directly to each user and use ACCOUNTADMIN to simplify ongoing provisioning and troubleshooting.
- B
Create functional roles for job responsibilities, grant object privileges to those roles, use future grants where appropriate, and assign roles to users or higher-level business roles.
- C
Create one shared role per database, grant that role all schema and object privileges in the database, and assign it to all users who might need occasional access.
- D
Grant privileges only at the database level because database grants automatically provide access to all current and future schemas, tables, and views.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to implement a role-based provisioning model using functional roles, role hierarchies, and future grants. In Snowflake, privileges should generally be granted to roles, and roles should then be granted to users. This improves scalability, auditability, and alignment with least-privilege design. For ongoing object creation, future grants help ensure that newly created tables and views inherit the required access patterns without manual intervention. Architects should also avoid using highly privileged roles such as ACCOUNTADMIN for routine access provisioning. These practices align with Snowflake documentation on access control, role hierarchy design, and future grants.
- A. Incorrect.
Incorrect. Directly granting privileges to users does not scale well, makes auditing harder, and goes against Snowflake RBAC best practices. Using ACCOUNTADMIN for routine provisioning is also inappropriate because it is a highly privileged administrative role that should be tightly controlled. A common misconception is that direct grants simplify management for small teams, but in enterprise environments they create long-term governance and compliance problems.
- B. Correct.
Correct. Snowflake best practice is to use role-based access control by granting privileges to roles rather than users. Creating functional roles such as analyst or engineer roles supports least privilege and cleaner provisioning. Granting those roles to users or to higher-level business roles allows flexible hierarchy design. Using future grants on schemas ensures that newly created tables and views automatically receive the required privileges, reducing operational overhead and preventing access gaps. This approach also improves auditability because access can be traced through role assignments and privilege grants.
- C. Incorrect.
Incorrect. A single broad shared role per database violates least-privilege principles and typically results in over-provisioning. It may seem administratively simple, but it makes segregation of duties difficult and expands access beyond business need. It also weakens auditability because many users inherit the same broad permissions rather than targeted privileges aligned to responsibilities.
- D. Incorrect.
Incorrect. Database-level privileges do not automatically provide access to all current and future schemas, tables, and views. In Snowflake, access to objects requires the appropriate privileges at each relevant layer, and future grants are typically defined on schemas for objects such as tables and views. This option reflects a common misunderstanding of Snowflake's privilege model.