SnowPro Associate: Platform Question 134
Single answerPrivilegesA Snowflake administrator needs to let a data engineering role named ETL_ROLE load files from an existing internal stage named RAW_STAGE into table SALES.RAW. The team wants to follow least-privilege principles and avoid giving broad administrative access. Which privilege should be granted directly on the stage so ETL_ROLE can read the staged files during the load process?
- A
GRANT USAGE ON STAGE RAW_STAGE TO ROLE ETL_ROLE
- B
GRANT READ ON STAGE RAW_STAGE TO ROLE ETL_ROLE
- C
GRANT OPERATE ON STAGE RAW_STAGE TO ROLE ETL_ROLE
- D
GRANT SELECT ON STAGE RAW_STAGE TO ROLE ETL_ROLE
Show answer and explanation
Correct answer: B
Explanation
To load data from an internal stage, the executing role must be able to read the files stored in that stage. In Snowflake, the stage privilege that supports this is READ. This is distinct from more general privileges like USAGE and from table privileges like SELECT. In a real deployment, ETL_ROLE would also need other supporting privileges, such as USAGE on the database and schema containing the stage and target table, INSERT on the target table for COPY INTO, and USAGE on the warehouse used to run the load. However, when the question asks specifically which privilege must be granted directly on the stage, READ is the correct least-privilege answer. This aligns with Snowflake privilege models for stage objects and standard role-based access control best practices.
- A. Incorrect.
Incorrect. USAGE on a stage does not allow a role to read files from the stage for loading. For stages, Snowflake uses stage-specific privileges such as READ and WRITE. A common misconception is assuming USAGE applies uniformly across all object types, but for stages the required access is more specific.
- B. Correct.
Correct. READ on an internal stage allows the role to read files from the stage, which is required when loading data from the stage into a table. In practice, the role would also need appropriate privileges on the target database, schema, table, and warehouse, but the stage-specific privilege needed to access the staged files is READ.
- C. Incorrect.
Incorrect. OPERATE is not the privilege used for reading files from a stage. This distractor is plausible because OPERATE exists for certain Snowflake objects, such as warehouses and tasks, but it is not the correct privilege for stage file access.
- D. Incorrect.
Incorrect. SELECT applies to queryable objects such as tables and views, not stages. Someone might choose this because data is ultimately being loaded into a table, but reading from a stage is governed by stage privileges, not SELECT.