使用Snowpark容器服务的应用端点访问被拒，需补充何种权限？

已完成Snowpark Container Service（SPCS）原生应用的应用包与应用创建，但访问服务端点app-url.snowflakecomputing.app时，报错：

Access denied. Insufficient privileges to use app-url.

以下是创建计算池与服务的设置脚本：

CREATE APPLICATION ROLE IF NOT EXISTS iqr_user;

CREATE SCHEMA IF NOT EXISTS core;
GRANT USAGE ON SCHEMA core TO APPLICATION ROLE iqr_user;

CREATE OR ALTER VERSIONED SCHEMA app_public;
GRANT USAGE ON SCHEMA app_public TO APPLICATION ROLE iqr_user;

-- Start App

CREATE OR REPLACE PROCEDURE app_public.start_app()
    RETURNS string
    LANGUAGE sql
    AS $$
BEGIN

    LET pool_name := (SELECT CURRENT_DATABASE()) || '_compute_pool';

   CREATE COMPUTE POOL IF NOT EXISTS IDENTIFIER(:pool_name)
      MIN_NODES = 1
      MAX_NODES = 1
      INSTANCE_FAMILY = CPU_X64_XS
      AUTO_RESUME = true;

   CREATE SERVICE IF NOT EXISTS core.iqr_service
    IN COMPUTE POOL identifier(:pool_name)
    FROM SPECIFICATION_FILE='service.yml';

    GRANT USAGE ON SERVICE core.iqr_service TO APPLICATION ROLE iqr_user;

RETURN 'Service started. Check status, and when ready, get URL';
END;
$$;

GRANT USAGE ON PROCEDURE app_public.start_app() TO APPLICATION ROLE iqr_user;

缺失的权限与修复步骤 #

• 授予计算池的USAGE权限：当前脚本仅为应用角色授予了服务的USAGE权限，但访问服务端点需要关联计算池的权限。需在存储过程中创建计算池后添加该授权，或单独执行：

  GRANT USAGE ON COMPUTE POOL identifier(:pool_name) TO APPLICATION ROLE iqr_user;
  

• 关联消费者角色与应用角色：如果是应用的消费者用户访问端点，需确保消费者所在的账户角色被授予应用内的iqr_user角色，执行语句：

  GRANT APPLICATION ROLE iqr_user ON APPLICATION <你的应用名称> TO ROLE <消费者角色>;
  

• 授予服务的PUBLIC_ACCESS权限：若服务需要公开访问，除了在service.yml中配置public: true的端点规则，还需为应用角色授予服务的PUBLIC_ACCESS权限：

  GRANT PUBLIC_ACCESS ON SERVICE core.iqr_service TO APPLICATION ROLE iqr_user;
  

内容的提问来源于stack exchange，提问作者Sajal