Which object type is granted permissions for reading a table?

Snowflake's security model is built on Role-Based Access Control (RBAC). In this model, privileges, such as the SELECT privilege required for reading a table, are granted to roles. Roles are then assigned to users. This approach allows for systematic and scalable management of access rights. While it is technically possible to grant a privilege directly to a user, the standard and recommended practice is to grant privileges to roles, which act as a collection of permissions that can be assigned to multiple users.

A. User: While privileges can be granted directly to a user, this bypasses the RBAC model and is not the standard or recommended practice for managing permissions at scale.
C. Attribute: An attribute is a characteristic or property of an object (e.g., a column name) and is not an entity to which permissions can be granted.
D. Schema: A schema is a securable object that contains other objects like tables. Permissions are granted on a schema (e.g., USAGE), not to a schema.

1. Snowflake Documentation: Overview of Access Control.

Section: Securable Objects, Privileges, Roles, and Users

Quote: "In the Snowflake model, access to securable objects is allowed via privileges assigned to roles, which are in turn assigned to other roles or users." This explicitly states that privileges are assigned to roles.

2. Snowflake Documentation: GRANT .

Section: Syntax

Details: The command syntax is GRANT ON TO ROLE . This shows that the ROLE is the primary object type to which privileges are granted.

3. Snowflake University: Hands-On Essentials - Data Warehousing.

Section: Module 4: Snowflake Access Control

Details: This courseware emphasizes that the best practice for managing security is to create a hierarchy of roles and grant privileges to these roles, which are then assigned to users. This reinforces the concept that roles are the central component for permission grants.