SnowPro Advanced: Security Engineer Question 203
Single answerImplement the principle of least privilege for replication-specific rolesA global company uses Snowflake replication to maintain a read-only disaster recovery account in another region. The security team has asked the Snowflake administrator to redesign access so that replication can be configured and monitored using the principle of least privilege. The current process uses ACCOUNTADMIN for creating replication groups, adding databases to those groups, and performing failover-related setup. The administrator wants to replace this with a dedicated custom role that can manage only replication-related tasks and nothing broader. Which approach best meets this requirement?
- A
Create a custom role, grant it the global privileges required for replication and failover group management, and grant ownership or other required object-level privileges only on the specific databases/accounts objects that must be added to the replication or failover configuration.
- B
Create a custom role with MONITOR USAGE and imported privileges on the SNOWFLAKE database, because replication setup and failover actions can be completed with monitoring privileges alone.
- C
Use SECURITYADMIN instead of ACCOUNTADMIN, because SECURITYADMIN is the least-privileged system role that can create replication groups and add any database to them.
- D
Create a custom role that has MANAGE GRANTS and OWNERSHIP on all databases in the account, because broad ownership is required before any replication group or failover group can be created.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to create a dedicated custom role for replication administration and grant it only the specific global and object-level privileges required for the replication or failover tasks it must perform. In Snowflake, least privilege means avoiding powerful system roles such as ACCOUNTADMIN for routine operational work and avoiding broad grants like OWNERSHIP on all databases. Instead, administrators should separate global administrative capabilities from object scope and grant access only to the databases or other securables actually involved in replication. This aligns with Snowflake security best practices around role design, minimizing privilege scope, and using custom roles for specialized operational duties such as replication and failover management.
- A. Correct.
Correct. This is the least-privilege design Snowflake recommends in practice: use a dedicated custom role for replication administration, grant only the necessary global privileges for creating and managing replication/failover constructs, and separately grant the minimum object-level privileges needed on only those databases or objects that will participate. This avoids using ACCOUNTADMIN for routine replication administration and limits the blast radius if the role is misused.
- B. Incorrect.
Incorrect. Monitoring-related privileges do not allow a role to create or manage replication groups or failover groups. Imported privileges on the SNOWFLAKE database may help with visibility into account usage views, but they do not replace the administrative privileges needed to configure replication or failover. This option confuses observability with administrative control.
- C. Incorrect.
Incorrect. SECURITYADMIN is focused on role and grant management, not as a special-purpose replication administration role. It is not the designated least-privileged role for creating replication groups or managing replicated objects across the account. A custom role with the specific required privileges is the better least-privilege pattern.
- D. Incorrect.
Incorrect. MANAGE GRANTS and OWNERSHIP on all databases is far broader than necessary and violates least-privilege principles. A replication administrator should receive access only to the specific databases or objects that must be replicated, not blanket ownership across the account. This option reflects a common but overly permissive shortcut.