SnowPro Associate: Platform Question 132
Single answerRole typesA Snowflake administrator is redesigning access control for a growing analytics environment. The company wants account-wide administrative tasks such as managing warehouses and users to remain tightly controlled, while allowing each business unit to independently grant access to its own schemas, tables, and views without relying on a central admin team. Which role design best meets these requirements?
- A
Grant all account-level and object-level privileges to SYSADMIN so business units can inherit everything they need from a single top-level system-defined role.
- B
Use account roles for account-level administration, and create database roles within each database so business units can manage object access inside their own databases.
- C
Use database roles for both warehouse administration and schema object access, because database roles can manage all securable objects in the account.
- D
Use only custom account roles for object access inside databases, because database roles cannot be granted to other roles.
Show answer and explanation
Correct answer: B
Explanation
The best answer is to combine role types based on scope: account roles for account-level administration and database roles for privileges within a specific database. In Snowflake, account roles are used for global or account-scoped securables, while database roles are scoped to a single database and are intended to simplify delegation of object privileges inside that database. A common best practice is to keep high-level administration centralized and tightly controlled while allowing data domain owners to manage grants within their own databases through database roles. Snowflake documentation on access control and role types distinguishes account roles from database roles and explains that database roles can be granted to account roles, enabling a flexible hierarchy without giving excessive account-wide power.
- A. Incorrect.
Incorrect. SYSADMIN is a powerful system-defined account role commonly used for managing objects such as warehouses and databases, but granting all account-level and object-level privileges through SYSADMIN conflicts with least-privilege design and does not delegate ownership of access management to business units in a scalable way. This approach centralizes too much power instead of separating account administration from database-level delegation.
- B. Correct.
Correct. Account roles are designed for account-level privileges, such as managing warehouses, users, and other account-scoped objects. Database roles are designed to manage privileges on objects within a specific database and are useful for delegating access management at the database level to business units. This aligns with Snowflake best practices for separating administrative responsibilities and supports decentralized object access control within each database.
- C. Incorrect.
Incorrect. Database roles cannot hold account-level privileges such as managing warehouses or users. They are limited to privileges on objects within the database where they are created. Choosing this option reflects the misconception that database roles can replace account roles for all security administration across the account.
- D. Incorrect.
Incorrect. Custom account roles can certainly be used for object access, but the statement about database roles is false. Database roles can be granted to account roles, which is one of their key benefits for implementing layered access models. Using only custom account roles may work in some environments, but it does not best satisfy the requirement to let business units independently manage access within their own databases.