SnowPro Advanced: Security Engineer Question 239
Single answerAudit user roles and permissionsA financial services company is preparing for an internal audit and must prove which users currently have access to sensitive tables through role inheritance. The security engineer needs a reliable way to determine each user's effective role grants, including roles granted to other roles, without manually tracing every hierarchy. Which approach should the engineer use in Snowflake?
- A
Query ACCOUNT_USAGE.GRANTS_TO_USERS because it shows all privileges inherited by users from all parent and child roles
- B
Use SHOW GRANTS TO USER for each user because it returns the complete set of effective object privileges after role hierarchy is resolved
- C
Use the ACCOUNT_USAGE.GRANTS_TO_ROLES and GRANTS_TO_USERS views together with role hierarchy analysis to trace inherited access from roles to users
- D
Query ACCOUNT_USAGE.ACCESS_HISTORY because it lists all roles and privileges each user is allowed to use, even if they have never accessed the objects
Show answer and explanation
Correct answer: C
Explanation
In Snowflake, auditing user permissions requires understanding RBAC inheritance. Users receive roles directly, and those roles may inherit privileges from other roles through role-to-role grants. Therefore, determining effective access usually requires combining metadata sources: GRANTS_TO_USERS for direct role assignments to users and GRANTS_TO_ROLES for both role hierarchy and object privilege grants. By traversing the hierarchy, a security engineer can show how access to sensitive tables is inherited. SHOW commands can help with point-in-time inspection, but they do not automatically provide a complete entitlement model across nested role relationships for all users at audit scale. ACCESS_HISTORY is valuable for investigating actual usage patterns, but it is not the authoritative source for potential permissions. This approach follows Snowflake best practices for auditing roles and privileges using ACCOUNT_USAGE views and RBAC grant relationships.
- A. Incorrect.
Incorrect. ACCOUNT_USAGE.GRANTS_TO_USERS shows role grants made directly to users, not the full set of inherited object privileges after traversing role-to-role relationships. A common misconception is that this view alone is enough for effective access analysis, but inherited access requires additional role hierarchy tracing.
- B. Incorrect.
Incorrect. SHOW GRANTS TO USER is useful for seeing roles granted directly to a user, but it does not by itself provide a fully resolved report of all effective object privileges inherited through nested roles. An auditor would still need to analyze downstream role grants and object privileges.
- C. Correct.
Correct. To audit effective access, the engineer should combine direct user-role assignments from GRANTS_TO_USERS with role-role and role-object grants from GRANTS_TO_ROLES, then trace the hierarchy to determine inherited permissions. This aligns with how Snowflake models RBAC: users are granted roles, roles can be granted to roles, and object privileges are granted to roles.
- D. Incorrect.
Incorrect. ACCESS_HISTORY is designed to analyze actual object access activity, not entitlement or potential access. It can help answer what a user did access, but not what a user could access if they have never used a privilege. This is a frequent confusion between auditing usage and auditing permissions.