COF-C03 Question 247
Single answerStorage integrationA data engineering team wants Snowflake to load daily CSV files from an Amazon S3 bucket into a table by using an external stage. The security team does not allow embedding cloud credentials in stage definitions and wants access to be limited to a specific bucket path. Which approach should the Snowflake administrator take to meet these requirements?
- A
Create a STORAGE INTEGRATION object for S3, configure the IAM trust relationship and allowed storage locations, then create the external stage referencing the integration.
- B
Create an internal stage and attach an AWS IAM role directly to the stage so Snowflake can read from the S3 bucket without credentials.
- C
Create the external stage with AWS_KEY_ID and AWS_SECRET_KEY in the stage definition, then restrict access by granting USAGE only on the stage.
- D
Create a FILE FORMAT object with the S3 bucket URL and IAM role, then reference that file format from the COPY INTO command.
Show answer and explanation
Correct answer: A
Explanation
For Snowflake access to Amazon S3 without embedding secrets, the best practice is to use a storage integration with an external stage. The storage integration stores a secure reference to cloud access configuration and supports restricting access through parameters such as allowed storage locations. In AWS, Snowflake provides IAM user or role information that is used to establish a trust relationship, allowing Snowflake to assume an IAM role to access only the approved S3 paths. This is more secure and easier to govern than putting AWS keys directly into stage definitions. Snowflake documentation for storage integrations and creating external stages emphasizes using storage integrations for S3, Azure, and GCS to avoid hard-coded credentials and to centralize cloud storage access management.
- A. Correct.
Correct. A storage integration is the recommended Snowflake mechanism for accessing cloud storage without placing cloud credentials in stage definitions. For Amazon S3, the administrator creates the STORAGE INTEGRATION, configures STORAGE_ALLOWED_LOCATIONS to limit accessible paths, and sets up the AWS IAM trust relationship so Snowflake can assume the role. The external stage then references the storage integration, satisfying both the security and scope requirements.
- B. Incorrect.
Incorrect. Internal stages store files in Snowflake-managed storage, not in the customer's S3 bucket. Also, you do not attach an AWS IAM role directly to an internal stage for reading from S3. To access customer-managed S3 storage, you use an external stage, typically with a storage integration.
- C. Incorrect.
Incorrect. Although older credential-based approaches can work technically for external stages, they violate the stated requirement not to embed cloud credentials in stage definitions. Granting USAGE on the stage controls Snowflake object access for users and roles, but it does not replace cloud-side restrictions such as limiting bucket paths through the integration configuration and IAM policy.
- D. Incorrect.
Incorrect. A FILE FORMAT object defines how data files are parsed, such as CSV delimiters, headers, and compression settings. It does not store the S3 bucket location or IAM role for cloud access. Storage access is configured in an external stage and, for secure credentialless access, through a storage integration.