In Snowflake's encryption architecture, the account master key corresponds to one customer account.

• A. Each customer account
• B. Each database
• C. Each user
• D. Each file

Answer: (A)

Snowflake uses envelope encryption: data is encrypted with data keys, and those data keys are themselves encrypted with a higher-level account master key. That account master key is created for and scoped to a single customer account, providing isolation between different customers. Because it serves as the root key for all encryption within that account, it cannot be tied to a database, a user, or a single file. Rotating or re-wrapping happens at the account level, affecting all data in that account while keeping other accounts separate. This is why the account master key corresponds to one customer account.