Implementing Data Sharing and Collaboration in Snowflake
Instruction: Describe how you would set up and manage secure data sharing between two independent organizations using Snowflake, ensuring that each organization can only access data relevant to them. Include considerations for data governance, security, and compliance.
Updated
Official answer
Agree on the data contract first: permitted organizations, fields, row scope, freshness, onward use, retention and incident contacts. Minimize exposed data and test a consumer-specific view of it before granting access.
For a direct share, the provider creates the share, grants the required database/schema/object access, and adds the intended consumer account. The consumer creates an imported database from that share and grants access to its own roles. The provider does not administer the consumer's users or account roles.
A secure view protects its definition and supports controlled sharing, but “secure” does not automatically filter rows for each organization. Implement explicit account-to-entitlement logic using supported sharing-context functions, or expose separately scoped objects. Test authorized, unauthorized and missing-entitlement cases from the consumer context. Avoid assuming provider and consumer role names have the same identity.
Within a region, direct sharing can expose provider data without making a separate consumer copy. Cross-region/cloud distribution requires the appropriate replication or fulfillment mechanism and has freshness and cost implications. Consumers also need compute to query shared data.
Monitor access and schema compatibility, review entitlements, and rehearse revocation. Revoking a share stops future access through that share; it cannot erase data already exported or otherwise copied. Address those copies in the agreement and controls.
Consume imported data, secure sharing objects, replication overview