SnowPro Associate: Platform Question 131
Single answerRole typesA Snowflake administrator is designing access for a finance reporting application used by hundreds of analysts. The application must query tables and views in a FINANCE database, but the analysts should not directly inherit object privileges in their interactive sessions. The administrator also wants a role that can be shared efficiently with many users and assigned to other roles. Which role type should be used for the application's data-access privileges?
- A
A database role in the FINANCE database
- B
An instance role on the finance warehouse
- C
A user-based role created separately for each analyst
- D
The PUBLIC role, because all users automatically receive it
Show answer and explanation
Correct answer: A
Explanation
Snowflake supports different role types, including account roles and database roles. For privileges that apply specifically to securable objects within one database, database roles are the best fit. They allow administrators to bundle access to tables, views, schemas, and other database-scoped objects inside that database, then grant the database role to account roles. This supports scalable administration and aligns with least-privilege design. PUBLIC is too broad for sensitive access, and instance roles are intended for class instances rather than standard database object authorization. Snowflake documentation on access control and database roles emphasizes using roles to group privileges logically and granting those roles to account roles for broader assignment to users and workloads.
- A. Correct.
Correct. A database role is designed to manage privileges on objects within a specific database and can be granted to account roles. In this scenario, the data-access privileges are limited to objects in the FINANCE database, and the administrator wants to manage those privileges centrally for application use. Database roles are appropriate for packaging database object privileges and then granting them to account roles that users or applications can use.
- B. Incorrect.
Incorrect. Instance roles are associated with specific class instances and are not used for standard access to database tables, views, or warehouses in the way described here. This option reflects a common confusion between newer Snowflake role-related features and the standard privilege model used for database objects.
- C. Incorrect.
Incorrect. Creating separate roles per analyst does not meet the requirement for efficient privilege management at scale. Snowflake best practice is to use roles to group privileges by function, then assign those roles to many users or to higher-level roles. A separate role for each analyst increases administrative overhead and does not solve the requirement to package application access cleanly.
- D. Incorrect.
Incorrect. Although every user gets the PUBLIC role, it should not be used as the primary mechanism for granting sensitive finance data access. PUBLIC is broadly available across the account, so using it for FINANCE reporting access would violate least-privilege principles and make access control difficult to manage safely.