A user can change object parameters using which of the following roles?

In Snowflake, the ability to alter object parameters is governed by role-based access control. The ACCOUNTADMIN role is the highest-level role and possesses the authority to modify any object within the account.

Beyond the ACCOUNTADMIN role, any other role can modify an object's parameters if it has the necessary privileges. The most common and comprehensive privilege for this is OWNERSHIP. The role that creates an object is its owner by default and thus can alter it. For example, the SYSADMIN role typically creates and owns objects like warehouses and databases. The phrase "USER with PRIVILEGE" correctly represents any user acting through a role that has been granted the required privilege (e.g., OWNERSHIP) on a specific object.

A. ACCOUNTADMIN, SECURITYADMIN: The SECURITYADMIN role's primary function is managing users, roles, and grants, not modifying object properties unless explicitly granted ownership.

B. SYSADMIN, SECURITYADMIN: While SYSADMIN often owns and can alter objects, SECURITYADMIN does not have this inherent capability, making this combination incorrect.

D. SECURITYADMIN, USER with PRIVILEGE: The SECURITYADMIN role lacks the inherent privilege to alter object parameters, making this option incorrect despite the valid inclusion of a privileged user.

---

1. Snowflake Documentation: Overview of Access Control.

Section: Object Ownership

Content: "The role that owns a database object is a special role that has full control over the object. This inherent control cannot be transferred to another role. However, the ownership of most types of objects can be transferred to another role." This confirms that the owner (a "USER with PRIVILEGE") can alter objects.

2. Snowflake Documentation: System-Defined Roles.

Section: ACCOUNTADMIN

Content: "Role that encapsulates the SYSADMIN and SECURITYADMIN system-defined roles. It is the top-level role in the system and should be used to perform initial system set-up and manage account-level objects and security." This establishes ACCOUNTADMIN's ability to manage all objects.

Section: SECURITYADMIN

Content: "Role that can create, monitor, and manage users and roles, as well as control and monitor access to objects in the account." This highlights its focus on security management, not object alteration.

3. Snowflake Documentation: SQL Command Reference - ALTER WAREHOUSE

Section: Required Privileges

Content: "A role used to execute this SQL command must have the following privileges at a minimum: OWNERSHIP or MODIFY on the warehouse." This provides a concrete example that a specific privilege is required for a non-ACCOUNTADMIN role to alter an object.