SnowPro Associate: Platform Question 119
Single answer2.1 Define the roles that are used in Snowflake.A Snowflake account has just been provisioned for a growing analytics team. The company wants to follow least-privilege principles while setting up administration. One engineer needs to create warehouses and manage resource monitors, but should not be able to create users or roles. Another engineer needs to create users and assign roles, but should not manage virtual warehouses. Which role assignment best fits these requirements using Snowflake system-defined roles?
- A
Assign ACCOUNTADMIN to the first engineer and SECURITYADMIN to the second engineer
- B
Assign SYSADMIN to the first engineer and SECURITYADMIN to the second engineer
- C
Assign SECURITYADMIN to the first engineer and SYSADMIN to the second engineer
- D
Assign USERADMIN to the first engineer and SYSADMIN to the second engineer
Show answer and explanation
Correct answer: B
Explanation
Snowflake provides several system-defined roles with distinct responsibilities. In this scenario, the best mapping is SYSADMIN for the engineer who must create warehouses and manage compute-related objects, and SECURITYADMIN for the engineer who must create users and assign roles. ACCOUNTADMIN is intentionally very powerful and should be tightly restricted because it combines capabilities of SYSADMIN and SECURITYADMIN and more. USERADMIN can create and manage users, but SECURITYADMIN is the key role for managing roles and grants and is commonly used for security administration. Snowflake documentation describes SYSADMIN as the role owning and managing objects, while SECURITYADMIN is responsible for security-related tasks such as user, role, and grant management. This reflects the recommended separation of duties and least-privilege design for Snowflake role usage.
- A. Incorrect.
Incorrect. ACCOUNTADMIN is the highest-level system role and combines broad administrative capabilities, including those associated with security and object management. Giving ACCOUNTADMIN to the first engineer violates least-privilege because that engineer would gain far more access than required, including powerful account-level capabilities.
- B. Correct.
Correct. SYSADMIN is intended for creating and managing objects such as warehouses, databases, schemas, and other account objects used for workloads. SECURITYADMIN is the appropriate role for managing users and roles because it can create, monitor, and manage users and roles and grant/revoke role-based privileges. This assignment aligns with Snowflake's separation of duties and least-privilege best practices.
- C. Incorrect.
Incorrect. SECURITYADMIN is primarily for security-related administration such as managing users, roles, and grants. It is not the best fit for managing warehouses and resource monitors as the primary administrative role. SYSADMIN is the standard role for creating and managing operational objects like warehouses.
- D. Incorrect.
Incorrect. USERADMIN is focused on creating and managing users, but role management and broader grant management are generally associated with SECURITYADMIN. Also, SYSADMIN for the second engineer would incorrectly give warehouse and object management responsibilities rather than user and role administration.