SnowPro Specialty: Gen AI Question 168
Single answerSet up the Snowflake environmentA data engineering team is preparing a new Snowflake environment for an internal generative AI application that will use Cortex functions from SQL and Python worksheets. The security team requires least-privilege access and wants to avoid granting broad account-level administrator roles to developers. Which setup should the Snowflake administrator implement so the developers can successfully build and test the application while meeting the security requirement?
- A
Grant developers the ACCOUNTADMIN role so they can create all required objects and use Cortex functions without additional configuration.
- B
Create a custom developer role, grant it usage on the required warehouse, database, schema, and compute pool, and grant the SNOWFLAKE.CORTEX_USER database role to that custom role.
- C
Grant developers only the PUBLIC role, because Cortex functions are available to all authenticated users by default.
- D
Assign the SYSADMIN role directly to all developers, because Cortex access requires a system-defined administrative role rather than a custom role.
Show answer and explanation
Correct answer: B
Explanation
For Snowflake Gen AI workloads, environment setup should follow role-based access control and least-privilege principles. Developers need access to the underlying objects they will use, such as warehouses, databases, and schemas, but they do not need broad account-wide administrative roles. Access to Snowflake Cortex functions is controlled through the SNOWFLAKE.CORTEX_USER database role, which can be granted to a custom role used by the development team. This approach matches Snowflake security best practices by separating platform administration from application development and limiting privileges to only what is necessary. Relevant Snowflake documentation includes guidance on access control and role-based access, as well as the Snowflake Cortex documentation describing required privileges and the use of the SNOWFLAKE.CORTEX_USER database role.
- A. Incorrect.
Incorrect. Although ACCOUNTADMIN could allow broad setup and troubleshooting, it violates least-privilege principles and is not required for day-to-day development of generative AI applications. Snowflake best practice is to avoid using powerful built-in admin roles for routine developer access.
- B. Correct.
Correct. A custom role can be granted the specific object privileges developers need, such as USAGE on the warehouse, database, and schema, plus access to any additional required resources. To use Snowflake Cortex LLM functions, access is granted through the SNOWFLAKE.CORTEX_USER database role, which should be granted to the custom role rather than giving developers excessive administrative privileges. This aligns with least-privilege design.
- C. Incorrect.
Incorrect. The PUBLIC role does not automatically provide access to Cortex functions or to the necessary warehouses, databases, and schemas for development. This option reflects a common misconception that built-in AI features are universally available without explicit privilege grants.
- D. Incorrect.
Incorrect. SYSADMIN is also broader than necessary and is not required simply to use Cortex functions. Snowflake supports granting privileges to custom roles, and Cortex access is controlled through the appropriate database role rather than requiring assignment of a high-level system administrator role.