COF-C02 · Question #661
True or False: When you create a custom role, it is a best practice to immediately grant that role to ACCOUNTADMIN.
The correct answer is B. False. Snowflake best practice is to grant custom roles to SYSADMIN, not ACCOUNTADMIN. Granting to SYSADMIN ensures the role fits properly within the role hierarchy, allowing SYSADMIN to manage all objects owned by the custom role. ACCOUNTADMIN has the highest level of privileges and…
Question
True or False: When you create a custom role, it is a best practice to immediately grant that role to ACCOUNTADMIN.
Options
- ATrue
- BFalse
How the community answered
(47 responses)- A13% (6)
- B87% (41)
Explanation
Snowflake best practice is to grant custom roles to SYSADMIN, not ACCOUNTADMIN. Granting to SYSADMIN ensures the role fits properly within the role hierarchy, allowing SYSADMIN to manage all objects owned by the custom role. ACCOUNTADMIN has the highest level of privileges and should be used sparingly - only for account-level administrative tasks. Over-assigning roles to ACCOUNTADMIN bypasses the principle of least privilege.
Topics
Community Discussion
No community discussion yet for this question.