Creating and managing shares in Snowflake - Step-by-Step CLI Walkthrough

Introduction

Sharing data securely between Snowflake accounts can be tricky. Snowflake shares let you share data without copying it, saving time and storage.

When you want to share a table with a partner company without moving data.

When you need to give read-only access to a dataset to another team.

When you want to share data across different Snowflake accounts in your organization.

When you want to update shared data instantly without resending files.

When you want to control exactly which data objects are shared.

Commands

This command creates a new share named 'my_share' to start sharing data objects.

Terminal

CREATE SHARE my_share;

Expected Output

Statement executed successfully.

Allows the share to access the database 'my_database' so its objects can be shared.

Terminal

GRANT USAGE ON DATABASE my_database TO SHARE my_share;

Expected Output

Statement executed successfully.

Gives read-only access to the table 'my_table' inside the share.

Terminal

GRANT SELECT ON TABLE my_database.public.my_table TO SHARE my_share;

Expected Output

Statement executed successfully.

Adds the Snowflake account with ID '123456789' as a consumer of the share.

Terminal

ALTER SHARE my_share ADD ACCOUNTS = ('123456789');

Expected Output

Statement executed successfully.

Lists all shares in your account to verify 'my_share' was created and configured.

Terminal

SHOW SHARES;

Expected Output

name     | created_on          | owner

my_share | 2024-06-01 12:00:00 | ACCOUNTADMIN

Key Concept

If you remember nothing else from this pattern, remember: a share lets you give controlled, read-only access to your data without copying it.

Common Mistakes

Trying to share a table without granting usage on its database first.

The share cannot access the table if it does not have permission on the database.

Always grant USAGE on the database to the share before granting access to tables.

Not adding consumer accounts to the share after creating it.

No one can access the shared data if no accounts are added as consumers.

Use ALTER SHARE to add the consumer account IDs explicitly.

Granting write permissions on shared objects.

Shares only support read-only access; write permissions are not allowed.

Only grant SELECT or USAGE privileges on shared objects.

Summary

Create a share with CREATE SHARE to start sharing data.

Grant USAGE on the database and SELECT on tables to the share.

Add consumer accounts with ALTER SHARE to let others access the data.

Use SHOW SHARES to verify your shares and their settings.

Practice

1. What is the primary purpose of creating a share in Snowflake?

easy

A. To move data from one database to another

B. To create a backup of your data

C. To share data with other accounts without copying it

D. To encrypt data for security

Solution

1. Step 1: Understand the concept of shares in Snowflake

   Shares allow data to be shared between accounts without duplicating the data itself.

2. Step 2: Identify the main use case of shares

   Sharing data without copying saves storage and ensures data consistency.

3. Final Answer:

   To share data with other accounts without copying it -> Option C

4. Quick Check:

   Shares = Data sharing without copying [OK]

Hint: Shares share data directly, no copying needed [OK]

Common Mistakes:

• Thinking shares create data backups
• Confusing shares with data movement
• Assuming shares encrypt data automatically

2. Which Snowflake command correctly creates a share named my_share?

easy

A. ADD SHARE my_share;

B. MAKE SHARE my_share;

C. NEW SHARE my_share;

D. CREATE SHARE my_share;

Solution

1. Step 1: Recall the syntax for creating shares in Snowflake

   The correct command to create a share is CREATE SHARE <share_name>;.

2. Step 2: Compare options with correct syntax

   Only CREATE SHARE my_share; uses the correct CREATE SHARE syntax.

3. Final Answer:

   CREATE SHARE my_share; -> Option D

4. Quick Check:

   CREATE SHARE = correct command [OK]

Hint: Use CREATE SHARE to start a new share [OK]

Common Mistakes:

• Using MAKE or NEW instead of CREATE
• Forgetting the semicolon at the end
• Confusing ADD SHARE with creating

3. Given the commands:

CREATE SHARE my_share;
GRANT USAGE ON DATABASE sales_db TO SHARE my_share;
ALTER SHARE my_share ADD ACCOUNTS = ('account_123');

What does account_123 gain access to?

medium

A. Full access to all objects in sales_db

B. Only metadata about sales_db

C. Usage access to the sales_db database objects shared

D. No access until a role is granted

Solution

1. Step 1: Analyze the GRANT USAGE ON DATABASE to share

   Granting USAGE on a database to a share allows consumers to view database metadata (e.g., SHOW DATABASES, USE DATABASE) but not schemas, tables, or other internal objects.

2. Step 2: Understand the effect of adding accounts

   Adding account_123 to the share provides access limited to the granted privileges: database metadata only, as no schema or table privileges are granted.

3. Final Answer:

   Only metadata about sales_db -> Option B

4. Quick Check:

   GRANT USAGE ON DATABASE = metadata access only [OK]

Hint: GRANT USAGE on DB shares DB metadata only; need schema/table grants for data [OK]

Common Mistakes:

• Assuming full access to all objects in sales_db
• Thinking DB USAGE grants access to internal objects like tables
• Believing roles must be granted separately

4. You run:

CREATE SHARE my_share;
GRANT SELECT ON TABLE sales TO SHARE my_share;

But get an error. What is the likely cause?

medium

A. The table name must be fully qualified with database and schema

B. Shares cannot have privileges granted directly on tables

C. You need to add accounts to the share before granting privileges

D. You must grant privileges on the database, not the table

Solution

1. Step 1: Check the syntax for granting privileges on objects to shares

   Privileges on tables must be granted using fully qualified names: database.schema.table.

2. Step 2: Identify the missing qualification in the command

   The command uses just sales without database and schema, causing an error.

3. Final Answer:

   The table name must be fully qualified with database and schema -> Option A

4. Quick Check:

   Fully qualify table names when granting [OK]

Hint: Always use database.schema.table for grants [OK]

Common Mistakes:

• Granting on database instead of table
• Trying to grant privileges before adding accounts
• Assuming shares can't have table privileges

5. You want to share specific tables from two different databases with multiple accounts. Which approach is best?

hard

A. Create separate shares per database and add accounts to each share accordingly

B. Create one share, grant usage on both databases, and add all tables to it

C. Copy tables into one database, then create a single share

D. Grant privileges directly to accounts without using shares

Solution

1. Step 1: Understand share scope and management

   Shares are scoped to a single database, so sharing tables from different databases requires separate shares.

2. Step 2: Evaluate options for managing multiple accounts and databases

   Creating separate shares per database allows clear control and easier management of access.

3. Step 3: Consider drawbacks of other options

   Copying tables wastes storage; granting privileges directly is less secure and scalable.

4. Final Answer:

   Create separate shares per database and add accounts to each share accordingly -> Option A

5. Quick Check:

   Shares are per database, use multiple shares [OK]

Hint: Use one share per database for multi-db sharing [OK]

Common Mistakes:

• Trying to share multiple databases in one share
• Copying data instead of sharing
• Granting privileges directly to accounts bypassing shares