SnowPro Associate: Platform Question 125
Single answerExplain role hierarchyA Snowflake administrator is redesigning access control for an analytics team. The team lead wants BI_ANALYST role holders to automatically get all privileges assigned to the ANALYST_READONLY role, while still allowing additional BI-specific privileges to be granted separately. The administrator also wants to avoid granting the same object privileges directly to multiple roles. Which action best meets this requirement using Snowflake role hierarchy?
- A
Grant the BI_ANALYST role to the ANALYST_READONLY role so ANALYST_READONLY inherits BI-specific privileges
- B
Grant the ANALYST_READONLY role to the BI_ANALYST role so BI_ANALYST inherits the read-only privileges
- C
Grant both roles directly to each user and rely on the active role to combine the privileges at query time
- D
Create a share from ANALYST_READONLY and import it into BI_ANALYST to reuse the granted privileges
Show answer and explanation
Correct answer: B
Explanation
In Snowflake, role hierarchy is implemented by granting one role to another role. The receiving role inherits the privileges of the granted role. To make BI_ANALYST automatically receive all privileges of ANALYST_READONLY, the administrator should grant ANALYST_READONLY to BI_ANALYST. This supports a layered access model where lower-level reusable roles contain common privileges and higher-level functional roles inherit them and add more permissions as needed. This approach aligns with Snowflake access control best practices for reducing administrative overhead and avoiding duplicate object grants. See Snowflake documentation on access control, role hierarchy, and the GRANT ROLE command for how inherited privileges flow through role relationships.
- A. Incorrect.
Incorrect. In Snowflake role hierarchy, privileges flow upward from the granted role to the receiving role. If BI_ANALYST is granted to ANALYST_READONLY, then ANALYST_READONLY would inherit BI_ANALYST's privileges, which is the opposite of the requirement. This is a common directionality mistake when working with role inheritance.
- B. Correct.
Correct. Granting ANALYST_READONLY to BI_ANALYST makes ANALYST_READONLY a child role and BI_ANALYST the parent role. BI_ANALYST then inherits all privileges held by ANALYST_READONLY, while the administrator can still grant additional BI-specific privileges directly to BI_ANALYST. This follows Snowflake best practice of using hierarchical roles to reduce duplicate grants and simplify administration.
- C. Incorrect.
Incorrect. While a user can be granted multiple roles, Snowflake does not merge all account role privileges automatically just because both roles are assigned to the user. Privileges available in a session depend on the active primary role and, where applicable, secondary roles. This option also does not satisfy the goal of using hierarchy to avoid repeated direct grants across roles.
- D. Incorrect.
Incorrect. Shares are used for secure data sharing between accounts, not for passing privileges from one role to another within the same account. Role inheritance is managed through GRANT ROLE statements, not through shares.