SnowPro Advanced: Security Engineer Question 12
Single answerManage hierarchical RBAC modelsA global company uses Snowflake to separate duties across regions and environments. The security team wants a hierarchical RBAC design that minimizes direct grants to users, allows regional administrators to manage only their own objects, and lets analysts inherit the access they need through role assignment. The proposed model includes these custom roles: ANALYST, US_ANALYST, EU_ANALYST, US_ADMIN, EU_ADMIN, and SECURITY_ADMIN_CUSTOM. Which design best meets these requirements while following Snowflake RBAC best practices?
- A
Grant database and schema privileges directly to users for faster onboarding, and assign US_ADMIN and EU_ADMIN only when object ownership changes are required.
- B
Create a hierarchy where ANALYST is granted to US_ANALYST and EU_ANALYST; grant object privileges for each region to the corresponding regional role; grant US_ANALYST and EU_ANALYST to users; and grant administrative privileges for each region to US_ADMIN and EU_ADMIN separately.
- C
Grant US_ANALYST and EU_ANALYST to ANALYST so that all analysts automatically inherit both regions' privileges, then use future grants to limit access at query time.
- D
Use SECURITY_ADMIN_CUSTOM as the owner of all regional objects and grant it to all analysts, because inherited ownership is the simplest way to ensure analysts can access required data.
Show answer and explanation
Correct answer: B
Explanation
The best answer is the hierarchical model in Option 2 because it uses Snowflake RBAC as intended: grant privileges to roles, grant roles to roles for inheritance, and grant roles to users. A practical design uses lower-level job-function roles for common access and higher-level or regional roles for scoped privileges. This reduces direct user grants, improves auditability, and simplifies administration. Regional admin roles should be separate from analyst roles so that administrative capabilities do not bleed into consumer access. Snowflake documentation and security best practices emphasize role-based privilege assignment, least privilege, and careful use of ownership because OWNERSHIP is a special privilege that effectively conveys full control over an object. Future grants are useful for automation, but they complement rather than replace a correct hierarchy design.
- A. Incorrect.
Incorrect. Snowflake best practice is to grant privileges to roles, then assign roles to users, rather than granting privileges directly to users. Direct grants increase administrative overhead and make hierarchical RBAC harder to manage and audit. Also, reserving admin roles only for ownership changes does not address the need for regional privilege delegation and clean inheritance.
- B. Correct.
Correct. This design uses role hierarchy appropriately: a shared base role (ANALYST) can hold common privileges, while regional roles such as US_ANALYST and EU_ANALYST inherit from it and receive region-specific grants. Users are assigned the appropriate regional role instead of direct object privileges. Separate admin roles for each region help enforce least privilege and delegation boundaries. This aligns with Snowflake's RBAC model, where privileges are granted to roles and roles can be granted to other roles to build a hierarchy.
- C. Incorrect.
Incorrect. Granting US_ANALYST and EU_ANALYST to ANALYST reverses the intended inheritance model and would cause anyone with ANALYST to inherit both regional access sets. That violates least privilege and regional separation requirements. Future grants can automatically apply privileges to new objects, but they do not dynamically restrict an over-broad role hierarchy at query time.
- D. Incorrect.
Incorrect. Object ownership is powerful because the owning role has full control over the object, including the ability to grant privileges. Granting an ownership-capable role broadly to analysts violates least privilege and separation of duties. In Snowflake, ownership should be tightly controlled, typically by dedicated administrative roles, not by general consumer roles.