SnowPro Associate: Platform Question 126
Single answerExplain role hierarchyA Snowflake administrator is redesigning access for an analytics team. The team wants junior analysts to query curated reporting views, while senior analysts should inherit the same access and also be able to create new tables in the ANALYTICS schema. To simplify administration, the administrator plans to use a role hierarchy instead of granting privileges separately to every role. Which approach best meets this requirement?
- A
Grant the senior analyst role to the junior analyst role, so junior analysts inherit all privileges from senior analysts.
- B
Grant the junior analyst role to the senior analyst role, then grant SELECT on the reporting views to the junior analyst role and CREATE TABLE on the ANALYTICS schema to the senior analyst role.
- C
Assign both the junior analyst role and the senior analyst role directly to each senior analyst user, because privileges cannot be inherited through roles.
- D
Create one role with all required privileges for both junior and senior analysts, because role hierarchy cannot be used with schema-level privileges.
Show answer and explanation
Correct answer: B
Explanation
Snowflake uses a role-based access control model in which roles can be granted to other roles, forming a hierarchy. The granted role becomes a child role, and the receiving role inherits the child role's privileges. For this scenario, the junior analyst role should contain the common lower-level access, and that role should be granted to the senior analyst role. Then the senior analyst role can receive additional privileges such as CREATE TABLE on the ANALYTICS schema. This design supports least privilege, reduces repeated grants, and matches Snowflake best practices for scalable RBAC administration. Relevant Snowflake documentation covers role hierarchy and privilege inheritance in the access control and RBAC sections.
- A. Incorrect.
Incorrect. This reverses the intended hierarchy. In Snowflake, if role A is granted to role B, then role B inherits the privileges of role A. Granting the senior role to the junior role would cause junior analysts to inherit senior-level privileges, violating least-privilege design.
- B. Correct.
Correct. This is the standard way to model role hierarchy in Snowflake. The junior analyst role holds the base privileges, such as SELECT on curated reporting views. Granting the junior role to the senior role allows the senior role to inherit those privileges. Additional privileges, such as CREATE TABLE on the ANALYTICS schema, can then be granted only to the senior role. This simplifies administration and aligns with best practices for layered access.
- C. Incorrect.
Incorrect. Although assigning multiple roles directly to users can work, the statement that privileges cannot be inherited through roles is false. Snowflake supports role hierarchy specifically so that one role can inherit privileges from another role, reducing duplicated grants and simplifying access management.
- D. Incorrect.
Incorrect. Snowflake role hierarchy does work with schema-level privileges, including privileges such as CREATE TABLE on a schema. Combining all access into a single role would remove the distinction between junior and senior analysts and make least-privilege administration harder.