SnowPro Associate: Platform Question 118
Single answer2.1 Define the roles that are used in Snowflake.A company is setting up a new Snowflake account for its analytics team. The security lead wants to follow least-privilege principles and separate administrative duties. One engineer must create and manage virtual warehouses, another must manage users and role grants, and a third must create databases and grant object privileges within those databases. Which set of Snowflake system-defined roles best matches these responsibilities?
- A
ACCOUNTADMIN for warehouses, SECURITYADMIN for users and roles, SYSADMIN for databases and object grants
- B
SYSADMIN for warehouses, USERADMIN for users and roles, SECURITYADMIN for databases and object grants
- C
SECURITYADMIN for warehouses, SYSADMIN for users and roles, USERADMIN for databases and object grants
- D
USERADMIN for warehouses, ACCOUNTADMIN for users and roles, SYSADMIN for databases and object grants
Show answer and explanation
Correct answer: A
Explanation
Snowflake provides several system-defined roles with distinct administrative purposes. SYSADMIN is intended for object creation and management, including warehouses and databases. USERADMIN is commonly described as the user and role management role because it can create users and roles. SECURITYADMIN is responsible for security-related administration, including managing grants, role hierarchy, and object privilege delegation. ACCOUNTADMIN is the most powerful role and includes the capabilities of SYSADMIN and SECURITYADMIN, but Snowflake best practice is to reserve it for tasks that truly require account-level administration. In real-world implementations, organizations often separate these duties to support least privilege and operational control. This aligns with Snowflake documentation on access control and system-defined roles.
- A. Correct.
Correct. In Snowflake, SYSADMIN is the primary role for creating and managing objects such as warehouses, databases, schemas, and other account objects used for workloads. SECURITYADMIN manages security-related tasks including granting and revoking privileges and managing role hierarchy. SYSADMIN is also commonly used to create databases and manage object privileges for those objects. ACCOUNTADMIN is the top-level administrative role that combines SYSADMIN and SECURITYADMIN capabilities, but best practice is to avoid using it for routine administration unless necessary.
- B. Incorrect.
Incorrect. SYSADMIN can manage warehouses and create databases, but USERADMIN is focused on creating and managing users and roles, not on granting all security privileges across the account. SECURITYADMIN, not USERADMIN, is the role intended to manage grants and broader security administration. This option incorrectly assigns database and object grant responsibilities to SECURITYADMIN as the primary object-management role rather than SYSADMIN.
- C. Incorrect.
Incorrect. SECURITYADMIN is not the standard role for warehouse management; SYSADMIN is. SYSADMIN is also not the designated role for creating and managing users and roles; USERADMIN creates users and roles, while SECURITYADMIN manages grants and inherited security administration. USERADMIN does not manage databases and object privileges as its primary purpose. This option confuses the responsibilities of the system-defined roles.
- D. Incorrect.
Incorrect. USERADMIN does not manage warehouses. ACCOUNTADMIN can manage users and roles because it is the highest-level role, but assigning routine user and role administration to ACCOUNTADMIN violates Snowflake best practice to minimize use of this powerful role. SYSADMIN for databases and object grants is reasonable, but the other role assignments are not.