QuestionQ81

Implement Data Protection and Recovery

A Data Engineer is assisting with a security audit and must identify every table accessed by USER1 during the last month.

Which query can be used to satisfy this requirement?

Explanation

In the SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY view, the base_objects_accessed column records every base object a query touched, including tables reached indirectly through views or other referencing objects — the complete picture a security audit of table access requires. Lateral-flattening that array exposes each object's objectName and objectDomain, so the results can be restricted to objectDomain = 'Table', to queries started within the last 30 days, and to the audited user, with DISTINCT deduplicating table names. The direct_objects_accessed column lists only objects named directly in the query text, so tables read through a view would be missed, and the QUERY_HISTORY view contains no object-access array to flatten.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!