SnowPro Advanced: Security Engineer Question 19
Single answerSNOWFLAKE database rolesA security engineer is redesigning access control for a Snowflake data platform used by multiple business units. The team wants to reduce account-role sprawl and ensure that privileges on objects in the FINANCE database are managed by the data owners without granting broad account-level authority. The engineer decides to use database roles. Which approach best meets these requirements while following Snowflake security best practices?
- A
Create database roles inside the FINANCE database, grant schema and object privileges to those database roles, and then grant the database roles to appropriate account roles used by users and applications.
- B
Create only account roles for FINANCE access, because database roles cannot be granted to account roles and are only useful for objects shared through listings.
- C
Grant FINANCE object privileges directly to users, because database roles do not support schema-level privileges and cannot simplify privilege management.
- D
Create database roles in a separate SECURITY database and grant them privileges on FINANCE objects, then assign those database roles directly to users.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to create database roles within the FINANCE database, grant FINANCE database object privileges to those database roles, and then grant the database roles to account roles. This aligns with Snowflake's RBAC model and supports separation of duties: database owners can manage access within their database boundary, while security administrators can continue to manage assignment of account roles to users and applications. Database roles are database-scoped, can be granted privileges on schemas and objects in their database, and can be granted to account roles. They are not assigned directly to users. This design helps reduce role proliferation at the account level and is consistent with Snowflake guidance on using roles to manage privileges rather than granting directly to users.
- A. Correct.
Correct. Snowflake database roles are designed to manage privileges on objects within a specific database. A practical best-practice pattern is to grant object privileges in the FINANCE database to database roles defined in that same database, and then grant those database roles to account roles. Users and applications activate account roles, not database roles directly. This reduces account-role sprawl and allows data owners to manage database-scoped access without requiring broad account-level role administration.
- B. Incorrect.
Incorrect. This reflects a common misconception. Database roles can be granted to account roles in Snowflake, which is a primary way to make database-role privileges available to end users and applications. While account roles can certainly be used, saying database roles are only useful for sharing scenarios is wrong and misses their value for modular, database-scoped access control.
- C. Incorrect.
Incorrect. Direct grants to users are not a Snowflake best practice because they make access harder to audit, maintain, and scale. In addition, database roles can hold privileges on schemas and other securable objects within the database. The statement that database roles do not support schema-level privileges is false.
- D. Incorrect.
Incorrect. Database roles are contained within a specific database and are intended to manage privileges on objects in that database. Creating a database role in a separate SECURITY database to manage FINANCE object access is not the correct model. Also, database roles are not granted directly to users; they are granted to account roles, and users receive access through those account roles.