True or False: When you create a custom role, it is a best practice to immediately grant that role to ACCOUNTADMIN.

The statement is false. Snowflake's security best practices, based on the principle of least privilege and a structured role hierarchy, recommend granting custom roles to the SYSADMIN role, not the ACCOUNTADMIN role. The ACCOUNTADMIN role is the most powerful role and should be used sparingly for account-level management. The SYSADMIN role is intended for creating and managing objects like warehouses, databases, and schemas. By granting a new custom role to SYSADMIN, you maintain the intended hierarchy (ACCOUNTADMIN > SYSADMIN > custom role), and ACCOUNTADMIN will inherit the privileges of the new role through SYSADMIN.

The option "True" is incorrect because granting a custom role directly to ACCOUNTADMIN bypasses the recommended role hierarchy. While technically possible, it is not a best practice as it consolidates permissions under the most powerful role, contrary to the principle of least privilege and the intended separation of duties between ACCOUNTADMIN (account management) and SYSADMIN (object management).

1. Snowflake Documentation: "Creating a role hierarchy"

In the section on creating a role hierarchy, the documentation explicitly states the recommended practice: "To set up this hierarchy, execute the following statements: use role securityadmin; grant role customrole1 to role sysadmin; ... Snowflake recommends granting all custom roles to the SYSADMIN role."

Source: Snowflake Inc. (2024). Configuring Access Control. Snowflake Documentation. Retrieved from https://docs.snowflake.com/en/user-guide/security-access-control-configure#creating-a-role-hierarchy

2. Snowflake Documentation: "Overview of Access Control"

This section describes the system-defined roles and their intended purposes. It outlines that ACCOUNTADMIN is for account-level tasks, while SYSADMIN has permissions to create warehouses, databases, and all database objects. This separation of duties supports granting custom object-related roles to SYSADMIN.

Source: Snowflake Inc. (2024). Overview of Access Control. Snowflake Documentation. Retrieved from https://docs.snowflake.com/en/user-guide/security-access-control-overview#system-defined-roles