SnowPro Advanced: Security Engineer Question 18
Single answerSystem-defined rolesA security engineer at a large enterprise is redesigning access in Snowflake to reduce reliance on the ACCOUNTADMIN role. The company wants a platform operations team to manage warehouses, resource monitors, and account-level settings, while a separate security team manages users, roles, and grants. The engineer wants to use Snowflake system-defined roles wherever possible to align with least-privilege best practices. Which role should be assigned to the platform operations team?
- A
ACCOUNTADMIN, because it inherits all administrative privileges needed for operational tasks across the account
- B
SECURITYADMIN, because it can manage users and roles and therefore can also manage warehouses and account parameters
- C
SYSADMIN, because it owns and manages objects in the account and is intended for general object administration
- D
USERADMIN, because account-level operational tasks are grouped with user lifecycle administration
Show answer and explanation
Correct answer: C
Explanation
Snowflake provides system-defined roles with distinct administrative responsibilities. In practice, SECURITYADMIN is used for security and grant management, USERADMIN for users and roles, and SYSADMIN for creating and managing account objects. ACCOUNTADMIN sits at the top and should be tightly controlled because it inherits privileges from other major administrative roles and can perform nearly all actions in the account. For least-privilege designs, Snowflake best practice is to assign SYSADMIN for operational object management rather than defaulting to ACCOUNTADMIN. This aligns teams to separate duties: platform operations handle objects and infrastructure-related resources, while security administrators control identity and access. Candidates should recognize not just what a role can do, but which system-defined role is appropriate for a given real-world administrative boundary.
- A. Incorrect.
Incorrect. ACCOUNTADMIN is the most powerful system-defined role and is typically reserved for a very small number of trusted administrators. Although it can perform these tasks, assigning it to an operations team conflicts with Snowflake best practices to avoid routine use of ACCOUNTADMIN when lower-privilege system roles can meet the requirement.
- B. Incorrect.
Incorrect. SECURITYADMIN is primarily intended for security management, including managing grants globally and administering roles. It is not the best fit for warehouse and general object administration. A common misconception is that because SECURITYADMIN is powerful, it should manage most admin functions, but Snowflake separates security administration from object and operational administration.
- C. Correct.
Correct. SYSADMIN is the recommended system-defined role for managing objects such as warehouses and other general administrative resources. In Snowflake's role hierarchy, SYSADMIN is intended to own and manage account objects, while SECURITYADMIN focuses on access control. This makes SYSADMIN the appropriate role for a platform operations team managing warehouses, resource monitors, and similar operational resources without overusing ACCOUNTADMIN.
- D. Incorrect.
Incorrect. USERADMIN is focused on creating and managing users and roles. It does not serve as the primary role for warehouse administration or broader operational object management. This option reflects a misunderstanding of Snowflake's separation between identity administration and object administration.