Share security and governance in Snowflake - Step-by-Step Execution

Process Flow - Share security and governance

Create Share

↓

Add Objects to Share

↓

Grant Access to Consumers

↓

Consumer Uses Share

↓

Monitor and Govern Usage

↓

Revoke or Modify Access

This flow shows how a data share is created, objects added, access granted, used by consumers, monitored, and access managed.

Execution Sample

Snowflake

CREATE SHARE my_share;
GRANT USAGE ON DATABASE my_db TO SHARE my_share;
GRANT USAGE ON SCHEMA my_db.my_schema TO SHARE my_share;
GRANT SELECT ON ALL TABLES IN SCHEMA my_db.my_schema TO SHARE my_share;
GRANT IMPORTED PRIVILEGES ON DATABASE my_shared_db TO ROLE consumer_role;

This code creates a share, adds database and schema objects, grants select permissions, and (consumer side) grants imported privileges to enable querying.

Process Table

Step	Action	Object Affected	Permission/State Change	Result
1	CREATE SHARE my_share	Share my_share	Created	Share object ready to add data
2	GRANT USAGE ON DATABASE my_db TO SHARE my_share	Database my_db	Usage granted to share	Share can reference database
3	GRANT USAGE ON SCHEMA my_db.my_schema TO SHARE my_share	Schema my_schema	Usage granted to share	Schema included in share
4	GRANT SELECT ON ALL TABLES IN SCHEMA my_db.my_schema TO SHARE my_share	Tables in my_schema	Select granted to share	Share can expose table data
5	GRANT IMPORTED PRIVILEGES ON DATABASE my_shared_db TO ROLE consumer_role	consumer_role	Imported privileges granted	Consumer can query shared data
6	Consumer queries shared data	Shared tables	Read access	Data accessed securely
7	Monitor usage	Share usage logs	Track queries	Governance enforced
8	Revoke or modify access	Share or consumer	Permissions updated	Access controlled as needed

💡 Access is controlled and monitored to maintain security and governance.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	Final
my_share	None	Created	Has usage on my_db	Includes my_schema	Has select on tables	Granted to consumer_account	Active and shared
consumer_account_access	None	None	None	None	None	Granted imported privileges	Can query shared data

Key Moments - 3 Insights

Why do we grant USAGE on the database to the share before adding schemas?

Granting USAGE on the database (see step 2) allows the share to reference objects inside it. Without this, adding schemas or tables to the share (steps 3 and 4) would fail.

How does granting SELECT on tables to the share affect consumer access?

Granting SELECT on tables (step 4) lets the share expose data. The consumer must then grant imported privileges on the shared database (step 5) to actually query the data.

What is the purpose of monitoring usage after sharing?

Monitoring usage (step 7) helps track who accessed data and how. This supports governance by ensuring data is used properly and securely.

Visual Quiz - 3 Questions

Look at the execution table, at which step is the share first able to reference the database?

A Step 1

B Step 2

C Step 3

D Step 5

💡 Hint

Check the 'Permission/State Change' column for when USAGE on database is granted to the share.

According to the variable tracker, what is the state of 'consumer_account_access' after step 4?

A Granted imported privileges

B Can query shared data

C None

D Has select on tables

💡 Hint

Look at the 'consumer_account_access' row and the column 'After Step 4' in the variable tracker.

If we revoke imported privileges from the consumer account, which step in the execution table would reflect this change?

A Step 8

B Step 7

C Step 6

D Step 5

💡 Hint

Step 8 mentions revoking or modifying access.

Concept Snapshot

Snowflake Share Security & Governance:
- Create a share to group data objects.
- Grant USAGE on database to share before adding schemas.
- Grant USAGE on schema to share.
- Grant SELECT on tables to share to expose data.
- Consumer grants imported privileges on shared DB to roles.
- Monitor usage for governance.
- Revoke or modify access to control security.

Full Transcript

This visual execution traces how Snowflake data sharing works for security and governance. First, a share is created. Then, usage permission on the database is granted to the share so it can reference objects. Next, usage on schema and select on tables are granted to the share. Consumer creates a database from the share and grants imported privileges to a role, allowing secure data access. Usage is monitored to enforce governance. Finally, access can be revoked or modified to maintain security. Variables track the share state and consumer access through each step. Key moments clarify why permissions must be granted in order and how monitoring supports governance. Quizzes test understanding of when permissions are granted and how access changes affect usage.