SnowPro Associate: Platform Question 121
Single answerRole-Based Access Control (RBAC)A Snowflake administrator is onboarding a new analytics team. Team members need to query tables in the ANALYTICS_DB database, create their own worksheets and temporary objects for analysis, and avoid receiving more privileges than necessary. The administrator wants to follow Snowflake RBAC best practices and minimize ongoing maintenance as new users join the team. Which approach should the administrator take?
- A
Grant the SYSADMIN role directly to each analyst so they inherit the necessary database and warehouse privileges.
- B
Create a custom role for the analytics team, grant it USAGE on the required warehouse, database, and schema, grant SELECT on the required tables or views, then assign that role to the users.
- C
Grant OWNERSHIP on ANALYTICS_DB to each analyst so they can access all current and future objects without additional grants.
- D
Assign the PUBLIC role to the analysts and grant SELECT on ANALYTICS_DB to PUBLIC so access is automatically available to all users.
Show answer and explanation
Correct answer: B
Explanation
Snowflake RBAC is designed around assigning privileges to roles and then roles to users, rather than granting privileges directly to users. For this scenario, the best practice is to create a custom role for the analytics team and grant only the privileges needed for their work. In Snowflake, querying data generally requires USAGE on the virtual warehouse used to run queries, USAGE on the database and schema containing the objects, and SELECT on the tables or views. This model supports least privilege, improves auditability, and reduces maintenance because new users can simply be granted the existing role. Snowflake documentation and best practices consistently emphasize role-based design, least-privilege access, and avoiding unnecessary use of powerful system roles such as SYSADMIN or broad grants to PUBLIC.
- A. Incorrect.
Incorrect. Granting SYSADMIN directly to analysts violates least-privilege principles because SYSADMIN is a high-level system-defined role intended for managing objects, not routine data consumption. Although it may provide the needed access, it grants significantly more authority than required and increases security risk.
- B. Correct.
Correct. This is the recommended RBAC approach in Snowflake: create a custom functional role aligned to the team's job responsibilities, grant only the required privileges, and then assign the role to users. To query data, users typically need USAGE on the warehouse, database, and schema, plus SELECT on the target tables or views. This supports least privilege and simplifies administration as users are added or removed.
- C. Incorrect.
Incorrect. OWNERSHIP is the highest privilege on an object and transfers control of the object to the grantee. Giving analysts OWNERSHIP on the database is excessive and inappropriate for read-oriented analytics access. It also introduces governance and operational risk because owners can alter, drop, or re-grant privileges on the object.
- D. Incorrect.
Incorrect. Although all users receive the PUBLIC role, granting broad data access to PUBLIC is not a best practice because it exposes data to every user in the account unless otherwise constrained. This does not meet the requirement to avoid excessive privileges and makes future access management harder, not easier.