SnowPro Advanced: Security Engineer Question 133
Single answerTroubleshoot row access policy enforcementA security engineer is troubleshooting why a row access policy is not filtering rows as expected in a shared analytics table. The table SALES.PUBLIC.ORDERS has a row access policy attached to the REGION column. The policy body checks the current role against a mapping table SECURITY.PUBLIC.REGION_ROLE_MAP to determine which regions are visible. Analysts querying the table can see all rows, even though the mapping table only grants each analyst role access to a subset of regions. The engineer confirms the policy is attached to the table and the SQL logic is correct. What is the most likely cause of the issue?
- A
The role that owns the row access policy does not have privileges to query the mapping table referenced inside the policy.
- B
The analysts need the APPLY ROW ACCESS POLICY privilege on the ORDERS table to have the policy enforced during SELECT queries.
- C
The mapping table must be in the same schema as the protected table, otherwise row access policy predicates are ignored.
- D
The row access policy should reference CURRENT_AVAILABLE_ROLES() instead of CURRENT_ROLE(), because CURRENT_ROLE() cannot be used in policy expressions.
Show answer and explanation
Correct answer: A
Explanation
When troubleshooting row access policy enforcement in Snowflake, one of the most important checks is whether the policy owner has sufficient privileges on any objects referenced in the policy body, such as entitlement or mapping tables. Row access policies support lookup-table patterns, but those lookups depend on proper object privileges for the policy owner. If those privileges are missing, the policy may not evaluate as expected. By contrast, querying users do not need APPLY ROW ACCESS POLICY for policy enforcement; that privilege is used for setting or managing policies. Snowflake documentation on row access policies and policy context emphasizes validating policy attachment, active role/session context, and privileges on referenced objects as standard troubleshooting steps.
- A. Correct.
Correct. Row access policies can reference mapping tables, but the policy executes with the privileges of the policy owner for objects referenced in the policy body. If the policy owner lacks the necessary privileges on SECURITY.PUBLIC.REGION_ROLE_MAP, the policy logic cannot evaluate as intended. In troubleshooting, ensuring the policy owner has USAGE on the database and schema and SELECT on the mapping table is a key step.
- B. Incorrect.
Incorrect. APPLY ROW ACCESS POLICY is relevant when creating or attaching policies, not for end users simply querying a protected table. Policy enforcement occurs automatically during query execution for users who have SELECT on the table. A common misconception is that end users need a separate privilege for enforcement, but they do not.
- C. Incorrect.
Incorrect. Snowflake does not require the mapping table referenced by a row access policy to be in the same schema as the protected table. Cross-schema and cross-database references are supported, provided required privileges are granted. This option reflects a plausible but incorrect assumption about object locality.
- D. Incorrect.
Incorrect. CURRENT_ROLE() is valid in row access policy expressions and is commonly used for role-based filtering. CURRENT_AVAILABLE_ROLES() is a different function with a different purpose and is not required to make row access policies work. Choosing this option would reflect confusion between the active role and the set of roles available in the session.