SnowPro Specialty: Native Apps free question 1 / 10 · Domain 1: Design Snowflake Native Applications
A provider granted USAGE on shared_schema and SELECT on shared_table TO SHARE IN APPLICATION PACKAGE. After installing the app, a consumer wants an analyst role to read that table's data. What does the shared data page describe as the way to give the analyst access?
- The provider grants SELECT on shared_table to the consumer account
- The consumer grants SELECT on shared_table to the analyst's role
- The analyst queries it through the application package name instead
- The setup script creates a view over it and grants it to an app role
Show the answer and explanation
Answer: D
Why this is correct
The section "About shared data in a Snowflake Native App" says consumers cannot access shared content directly. Instead, a provider creates a secure view in the setup script of the application package and grants the consumer access to the secure view. The section "Allow consumers to access shared objects in an app" gives the steps: the setup script installs views within a versioned schema and grants access to those views with an application role. Its example creates the application role app_user, a versioned schema, a view that selects from shared_schema.shared_table, and grants SELECT on the view to the application role. The consumer then grants that application role to the analyst's role.
Why the other options are wrong
"The consumer grants SELECT on shared_table to the analyst's role" … Consumers cannot access shared content directly, and roles in the consumer account can't query shared content directly. Only objects that the app owns, such as views, procedures, functions and tasks, can reach it.
"The provider grants SELECT on shared_table to the consumer account" … On this page, grants on shared content go to the application package with TO SHARE IN APPLICATION PACKAGE, and by default objects shared with the package are not visible to consumers. A grant to the consumer account is not the described path.
"The analyst queries it through the application package name instead" … The page says you can't use the name of the application package to refer to shared objects from within the app. Code in the app uses the schema and object name, or the name of the app.
Why a view in between
The view decides which columns and rows the consumer sees, and because it lives in a versioned schema, each version of the app carries its own definition. Policies that protect the data are also recommended on these proxy views, so that they cannot be changed after installation.