QuestionQ124

Secure Data Sharing and Consumption

An Architect is collaborating with a healthcare company’s Enterprise data-governance team to review how company-sensitive data is protected in Snowflake. Physicians in the company network can query views. Two views exist: one displays mental-health information, and the other displays physical-health information:

create view mental_health_view as select * from patients where category = 'MentalHealth';  
  
create view physical_health_view as select * from patients where category = 'PhysicalHealth';  

Most physicians do not have direct access to the table. Instead, they are assigned one of two roles:

  1. MentalHealth, which has privileges to read from mental_health_view; or
  2. PhysicalHealth, which has privileges to read from physical_health_view.

A physician with the PhysicalHealth role wants to determine whether any mental-health patients exist in the table and runs the following query:

select * from physical_health_view where 1/iff(category = 'MentalHealth', 0, 1) = 1;  

How will this query affect the sensitive data?

Explanation

Standard (non-secure) views can permit optimizer predicate reordering or pushdown. The division expression may be evaluated before the PhysicalHealth view filter; if a mental-health row exists, it produces a division-by-zero error. No mental-health row is returned, but the error lets the user infer that at least one mental-health patient exists. Snowflake documents this exact behavior and notes that it depends on the optimizer’s plan and the view definition.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!