SnowPro Associate: Platform Question 129
Single answerRole typesA company uses Snowflake to support several business units. The security team wants to let analysts in the FINANCE department query tables in the FINANCE schema without granting them broad account-level administrative permissions. They also want to assign this access to many users through a single grouping mechanism. Which role type should the team use to meet this requirement?
- A
Create an account role for FINANCE analysts, grant the necessary schema and object privileges to that role, and then grant the role to users
- B
Create a database role in the FINANCE database, grant object privileges to that database role, and grant the database role directly to users
- C
Create a database role in the FINANCE database, grant object privileges to that database role, and grant the database role to an account role that is then granted to users
- D
Use the PUBLIC role because it is automatically available to all users and can simplify FINANCE schema access management
Show answer and explanation
Correct answer: C
Explanation
In Snowflake, account roles and database roles serve different purposes. Account roles are global to the account and are the role type granted to users. Database roles are scoped to a specific database and are useful for managing privileges on database objects in a modular way. A common best-practice pattern is to grant object privileges to a database role, grant that database role to an account role, and then grant the account role to users. This lets administrators manage database access cleanly while still using account roles for user membership. Snowflake documentation distinguishes these role types clearly: database roles cannot be activated directly by users and cannot be granted directly to users, while account roles can. Using PUBLIC for department-specific access is generally inappropriate because PUBLIC is inherited broadly across the account.
- A. Incorrect.
This is plausible because account roles are commonly used to group users and privileges. However, the question specifically asks about choosing the most appropriate role type for granting access to objects in a particular database while still assigning access to many users through a grouping mechanism. Snowflake database roles are designed for database-scoped privilege management. While an account role can hold object privileges, using only an account role is less aligned with the role-type best practice for database-contained access.
- B. Incorrect.
This is incorrect because database roles cannot be granted directly to users. In Snowflake, database roles are granted to account roles, and account roles are then granted to users. A candidate might choose this option if they confuse database roles with account roles or assume both can be assigned to users in the same way.
- C. Correct.
This is correct. Database roles are intended to manage privileges on objects within a database. They can be granted privileges on schemas and objects in that database, and then granted to account roles. Account roles are the role type assigned to users. This pattern supports least privilege, scalable administration, and clean separation between database-specific access and user assignment.
- D. Incorrect.
This is incorrect. PUBLIC is an account role automatically granted to all users and roles, so granting FINANCE-specific access to PUBLIC would expose those objects much more broadly than intended. This violates least-privilege principles and is not appropriate for department-specific access control.