SnowPro Advanced: Security Engineer Question 21
Single answerSNOWFLAKE application rolesA software provider publishes a Snowflake Native App for customer account monitoring. The app includes two application roles: APP_VIEWER, which allows read-only access to the app's shared views, and APP_ADMIN, which allows access to administrative procedures inside the app. A consumer security engineer wants analysts to query only the app's monitoring views, while limiting administrative capabilities to a small operations group. Which action should the consumer take to meet this requirement using Snowflake best practices?
- A
Grant the APP_VIEWER application role directly to the analysts' account roles, and grant APP_ADMIN only to the operations account role.
- B
Grant the app's shared schema USAGE privilege to the analysts' account roles, because application roles are only for providers and cannot be granted by consumers.
- C
Grant APP_ADMIN to all users of the app, then rely on row access policies inside the app to block administrative actions for analysts.
- D
Create database roles in the consumer account that mirror APP_VIEWER and APP_ADMIN, then grant those database roles to users instead of granting application roles.
Show answer and explanation
Correct answer: A
Explanation
Snowflake Native Apps use application roles to expose provider-defined access boundaries to consumers. After an app is installed, the consumer grants those application roles to account roles in the consumer account. This lets the consumer map provider-defined permissions, such as viewer versus admin access, to their own internal role hierarchy while maintaining least privilege. Best practice is to grant only the minimum application role needed to each account role, rather than trying to bypass application roles with direct object grants or broad administrative access. This aligns with Snowflake guidance for Native Apps and role-based access control: application roles are the app-specific access interface, and consumer account roles are the identities to which those application roles are assigned.
- A. Correct.
Correct. In Snowflake Native Apps, application roles are the mechanism exposed by the provider so consumers can control who can use app functionality. The consumer can grant an application role from the installed app to account roles in their account. Granting APP_VIEWER to analyst-facing account roles and APP_ADMIN only to the operations role follows least-privilege design and is the intended way to delegate app access.
- B. Incorrect.
Incorrect. This reflects a common misconception. Consumers do not manage app access by directly granting privileges on internal app objects such as schemas or views. Instead, providers expose access through application roles, and consumers grant those application roles to their account roles. Application roles are specifically designed to be granted in the consumer account after installation.
- C. Incorrect.
Incorrect. This violates least privilege and misunderstands the purpose of application roles. APP_ADMIN should not be broadly granted if only a small group needs administrative procedures. Row access policies control data visibility, not whether a user should receive elevated administrative capabilities exposed by the app.
- D. Incorrect.
Incorrect. Consumer-created database roles cannot substitute for the permissions encapsulated in the app's application roles. While a consumer may use account roles as part of their own access model, access to Native App functionality exposed by the provider is granted through the app's application roles, not by recreating equivalent database roles in the consumer account.