Implementing and Managing Snowflake's Secure Data Sharing

Instruction: Describe the process of setting up secure data sharing in Snowflake and how you would manage it.

Context: This question evaluates the candidate's understanding and ability to implement Snowflake's secure data sharing capabilities, including setup, management, and best practices for security.

Updated

Official answer

For a same-region direct share, first prepare an approved secure view that exposes only the intended rows and columns. In this illustrative setup, all referenced objects are in partner_data, the view and consumer role already exist, and each command is run by a role with the required privileges.

Provider account:

CREATE SHARE retailer_share;
GRANT USAGE ON DATABASE partner_data TO SHARE retailer_share;
GRANT USAGE ON SCHEMA partner_data.approved
  TO SHARE retailer_share;
GRANT SELECT ON VIEW partner_data.approved.stock_v
  TO SHARE retailer_share;
ALTER SHARE retailer_share
  ADD ACCOUNTS = retailer_org.retailer_account;

Consumer account, using the actual provider account identifier:

CREATE DATABASE supplier_data
  FROM SHARE supplier_org.supplier_account.retailer_share;
GRANT IMPORTED PRIVILEGES ON DATABASE supplier_data
  TO ROLE retailer_analyst;

Adding the consumer uses ALTER SHARE ... ADD ACCOUNTS; it is not a GRANT USAGE on the share to a remote user. Current share-target management requires the documented account privilege as well as share ownership. Cross-database secure-view dependencies need additional supported reference privileges.

Test from the consumer: allowed data is visible, excluded rows/columns are inaccessible, and an unauthorized account has no access. Secure-view status alone does not define organization-specific entitlements. Verify policy behavior in the sharing context.

Review grants and contract/schema changes, monitor the evidence available to each side, and rehearse account removal. Do not promise that a provider sees every consumer query or can erase previous exports. Cross-region delivery requires separate supported distribution configuration.

Object grants to shares, share targets, consumer setup

Related Questions