COF-C03 Question 15
Single answerSnowflake CLIA data engineer needs to run a repeatable deployment script from a CI/CD runner using Snowflake CLI. The runner must authenticate non-interactively, and the team does not want to place a plaintext password in the pipeline configuration. Which approach best meets these requirements?
- A
Configure a Snowflake CLI connection that uses key-pair authentication for the Snowflake user, and run the deployment commands with that connection in the pipeline.
- B
Use SSO authentication in Snowflake CLI so the CI/CD runner can open a browser window and complete interactive login each time the job starts.
- C
Store the Snowflake user password directly in the snowflake.toml file so the CLI can read it automatically during pipeline execution.
- D
Use the Snowflake web interface to save a worksheet, then have the CI/CD runner call the worksheet through the CLI without any Snowflake authentication.
Show answer and explanation
Correct answer: A
Explanation
The key requirement is secure, non-interactive authentication for automation. In Snowflake, key-pair authentication is a common approach for service-style access from scripts and CI/CD pipelines because it avoids manual login flows and reduces reliance on plaintext passwords. Snowflake CLI supports named connections, which can be used by commands in a repeatable deployment process. By contrast, SSO is generally intended for interactive sign-in, and plaintext passwords in config files are not aligned with security best practices. Candidates should recognize that Snowflake CLI is designed to support scripted operational workflows, but it still requires a valid Snowflake authentication method. Refer to Snowflake documentation for Snowflake CLI connection configuration and Snowflake key-pair authentication best practices.
- A. Correct.
Correct. For automation and CI/CD use cases, Snowflake CLI can use a defined connection with non-interactive authentication. Key-pair authentication is a standard best practice because it avoids embedding a plaintext password in pipeline configuration while still allowing the CLI to authenticate programmatically as a Snowflake user.
- B. Incorrect.
Incorrect. SSO is typically designed for interactive user authentication and often requires browser-based login. That makes it a poor fit for unattended CI/CD jobs, where the runner must execute without human interaction.
- C. Incorrect.
Incorrect. Although a password-based connection can work technically, storing a plaintext password in configuration is not the best approach for secure automation. The scenario explicitly says the team does not want plaintext passwords in the pipeline, so this does not meet the requirement.
- D. Incorrect.
Incorrect. Snowflake CLI still needs to authenticate to Snowflake before it can execute commands. Saving a worksheet in the web UI does not eliminate the need for authentication from the CI/CD runner, and the described approach is not how CLI-based deployment automation is typically implemented.