Lab 18 · Domain 5 · You are Priya
Live secure share from Alpine (provider) to another account (consumer).
Hands-on is provider-side: create share, grant USAGE + SELECT on a SHARE_DEMO view.
Reader accounts, Marketplace, Native Apps, and Clean Rooms are exam see-cards.
ALPINE_PRODUCT_SHARE, view SHARE_DEMO.V_PRODUCT_CATALOG,
grants of USAGE on DB/schema + SELECT on the view, SHOW SHARES.
Note: a real consumer needs a different Snowflake account (or a reader account you create).
Episode 18 · Share day
No dumpingCUSTOMERS. Share a curated view inSHARE_DEMO— products only. Live access, revoke-able.
Exam line: a share is not a copy. Consumer queries your data in place. Their warehouse burns their credits when they run SQL.
Provider stores; consumer computes. That’s the usual Core answer for “who pays?”
You pick accounts and grant objects. Hands-on today.
GRANT SELECT ON VIEW … TO SHAREProvider creates a limited account so a partner can query shared data without buying full Snowflake.
Discoverable offering (free/paid) vs private direct share to known accounts.
Native App: package logic + data as an app. Clean room: parties analyze without freely sharing raw rows.
Before Step 1
If I ADD my own account to the share, do I finish the consumer half in this lab?
No — shares are cross-account. Today we prove provider setup. Consumer needs another account or a reader account. Exam still asks the provider grant order.
What this does: Builds a safe product catalog view — nothing from CUSTOMERS.
USE ROLE ROLE_CORE_LAB_ADMIN;
USE WAREHOUSE WH_CORE_XS;
USE DATABASE ALPINE_RETAIL;
USE SCHEMA SHARE_DEMO;
CREATE OR REPLACE VIEW V_PRODUCT_CATALOG AS
SELECT 1 AS PRODUCT_ID, 'Trail Jacket' AS PRODUCT_NAME, 129.00 AS LIST_PRICE
UNION ALL SELECT 2, 'Alpine Cap', 24.00
UNION ALL SELECT 3, 'Summit Pack', 89.00;Before Step 2
Same RBAC ladder as roles — you can’t SELECT a table you can’t walk to.
Exactly. USAGE on database and schema, then SELECT on the view — all TO SHARE. Missing USAGE is a classic exam/setup fail.
What this does: Creates the share container and grants the path + SELECT into it.
CREATE SHARE IF NOT EXISTS ALPINE_PRODUCT_SHARE
COMMENT = 'Alpine Retail catalog share for Core lab';
GRANT USAGE ON DATABASE ALPINE_RETAIL
TO SHARE ALPINE_PRODUCT_SHARE;
GRANT USAGE ON SCHEMA ALPINE_RETAIL.SHARE_DEMO
TO SHARE ALPINE_PRODUCT_SHARE;
GRANT SELECT ON VIEW ALPINE_RETAIL.SHARE_DEMO.V_PRODUCT_CATALOG
TO SHARE ALPINE_PRODUCT_SHARE;What this does: Lists the share and its grants. Consumer delivery is a commented next step.
SHOW SHARES LIKE 'ALPINE_PRODUCT_SHARE';
SHOW GRANTS TO SHARE ALPINE_PRODUCT_SHARE;
-- Different account locator required for a real consumer:
-- ALTER SHARE ALPINE_PRODUCT_SHARE
-- ADD ACCOUNTS = <org_name>.<account_name>;Say: No — secure sharing is live access to provider-stored data (via granted objects). It is not a nightly export. Revoking or removing an account cuts access without chasing CSV copies.
Say: Typically the consumer’s virtual warehouse credits. The provider pays for storing the shared data. (Don’t say the provider’s WH runs the consumer’s SELECT.)
Say: A provider-managed Snowflake account so a partner can consume shared data without owning a full paid Snowflake account. Still a separate account identity for sharing.
Say: Multiple parties want joint analysis without freely exposing raw customer-level rows to each other — controlled, privacy-preserving collaboration (exam awareness, not deep admin).
Say: Direct share: you ADD known accounts. Marketplace listing: discoverable/commercial offering in the Marketplace. Same collaboration family; different discovery and commercial path.
ALPINE_PRODUCT_SHARE, put a safe catalog in
SHARE_DEMO.V_PRODUCT_CATALOG, and granted USAGE + SELECT to the share.
A live consumer needs another account or a reader account — this lab is provider-side.
Shares aren’t copies; consumers pay compute; listings and clean rooms are the C03 awareness layer.
Outcome: Domain 5 collaboration complete — time for the mock exam.”