SnowPro Associate: Platform Question 364
Single answer○ Use a private data shareA data provider needs to give a business partner read-only access to a set of reporting tables in Snowflake without copying the data. The partner already has its own Snowflake account. The provider also wants to ensure the partner can query only the shared objects and cannot modify them. Which action should the provider take?
- A
Create a private data share containing the required database objects, then add the partner's Snowflake account to the share so the partner can create a database from it
- B
Create a database role with SELECT privileges on the reporting tables, then grant the role directly to the partner's users in their Snowflake account
- C
Unload the reporting tables to an external stage and grant the partner read access to the cloud storage location
- D
Clone the reporting database into the partner's account so they can query the cloned copy without affecting the provider's source data
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use a private data share. In Snowflake, secure data sharing allows a provider to share selected database objects with a consumer account without moving or copying the underlying data. The consumer creates a database from the share and can query the data read-only. This is a core Snowflake capability and is the recommended best practice when both organizations already use Snowflake. Roles are not granted across accounts, and exporting to cloud storage introduces unnecessary data copies and operational overhead. Cloning is useful within Snowflake for creating zero-copy copies of objects, but it is not the mechanism for direct cross-account sharing to a separate customer account. Relevant Snowflake documentation includes topics on Secure Data Sharing, CREATE SHARE, GRANT ... TO SHARE, and consumers creating a database from a share.
- A. Correct.
Correct. A private data share is the standard Snowflake mechanism for securely sharing live data between Snowflake accounts without physically copying it. The provider creates a share, grants USAGE/SELECT on the necessary objects to the share, and adds the consumer account to that share. The consumer then creates a read-only database from the share. Because shared databases are read-only to the consumer, the partner cannot modify the provider's data.
- B. Incorrect.
Incorrect. Database roles and account roles cannot be granted directly across separate Snowflake accounts in this way. Roles are scoped within an account. For cross-account data access without copying data, Snowflake uses shares and shared databases, not direct role grants to users in another account.
- C. Incorrect.
Incorrect. Unloading data to external storage creates a separate copy of the data and requires managing cloud storage permissions outside the native Snowflake sharing model. This does not meet the requirement to avoid copying the data, and it is not the recommended approach when both parties already have Snowflake accounts.
- D. Incorrect.
Incorrect. A clone is a Snowflake object created within a Snowflake environment under the account performing the clone, but private data sharing is the intended method for exposing live, read-only data to another Snowflake account. Cloning also does not describe the standard provider-to-consumer sharing workflow and would not be used by the provider to directly place a clone into another independent customer account.