SnowPro Specialty: Native Apps free question 6 / 10 · Domain 2: Build Snowflake Native Applications
A consumer administrator created a reference to the table SALES.ORDERS for an app while using the role etl_role, which then had SELECT and INSERT on the table. Months later, etl_role loses INSERT on that table. What does the consumer access page say about the app's access?
- SELECT stays and INSERT goes, as the app holds a copy of each grant
- Unchanged, since the reference gave the app its own table privileges
- Unchanged until the next upgrade, which checks every reference again
- The reference is no longer valid until the privileges are restored
Show the answer and explanation
Answer: D
Why this is correct
The section "Manually authorize access to objects" says a consumer can create a reference for an object to associate with the app if they have the requested privileges on the object; for example, if SELECT and INSERT are required on a table, the consumer must create the reference using a role that has SELECT and INSERT on the table. A reference does not grant any privileges on the object. If the role used to create the reference loses privileges on the object, the reference is no longer valid. The consumer must then either restore the required privileges to the role that created the reference, or recreate the reference using a role with the required privileges.
Why the other options are wrong
"Unchanged, since the reference gave the app its own table privileges" … The page says a reference does not grant any privileges on the object. It depends on the privileges of the role that created it.
"SELECT stays and INSERT goes, as the app holds a copy of each grant" … The app does not hold its own copies of the grants. The page treats the reference as a whole: when the creating role loses privileges, the reference is no longer valid.
"Unchanged until the next upgrade, which checks every reference again" … The page ties validity to the creating role's privileges at once, not to an upgrade.
Create references with a stable role
Because the reference rides on the creating role's privileges, consumers should create references with a role whose grants are not routinely changed. SHOW REFERENCES lists the privileges the consumer role must have for each reference.