ADA-C01 Question 113
Single answerManage private connectivity between cloud providers and SnowflakeA financial services company runs Snowflake on AWS in us-east-1 and must ensure that analysts connecting from workloads inside the company's AWS VPC do not traverse the public Internet. The security team also wants to limit access so only approved VPC endpoints can reach Snowflake. The Snowflake account is Business Critical edition. Which approach should the Snowflake administrator implement?
- A
Configure AWS PrivateLink for the Snowflake account, create interface VPC endpoints in the customer VPC for the Snowflake service, and enforce connectivity using Snowflake network policies that allow only the approved private endpoint IDs.
- B
Create an AWS gateway VPC endpoint for Amazon S3 and update the Snowflake account URL to the S3 endpoint so all client traffic stays private.
- C
Set up SnowCD on each client host and use the privatelink-account URL without creating any cloud-side private connectivity resources, because SnowCD automatically establishes the private path.
- D
Use a site-to-site VPN from the customer VPC to Snowflake's cloud provider account and then restrict access with a network rule that references the VPN tunnel IP addresses.
Show answer and explanation
Correct answer: A
Explanation
The correct design is AWS PrivateLink. For Snowflake accounts that require private connectivity, Snowflake publishes service endpoints that customers consume through interface VPC endpoints in their own AWS VPCs. Clients then connect using the account's private connectivity URL, keeping traffic on the AWS network rather than the public Internet. When the requirement also includes restricting which private endpoints may connect, Snowflake supports network policies that can allowlist specific AWS VPCE IDs for PrivateLink-enabled connections. This is the practical control to ensure that only approved VPC endpoints can access the account. Relevant Snowflake documentation includes the private connectivity/privateLink guidance for AWS and network policy documentation covering allowed VPCE IDs for AWS PrivateLink scenarios.
- A. Correct.
Correct. For Snowflake on AWS, private connectivity from customer workloads is implemented with AWS PrivateLink. The customer creates interface VPC endpoints to Snowflake's published endpoint service, then uses the Snowflake private connectivity URL for clients. To further restrict access, Snowflake supports network policies that can allow access only from specified AWS VPCE IDs for AWS PrivateLink-enabled accounts. This meets both requirements: traffic avoids the public Internet and access is limited to approved private endpoints.
- B. Incorrect.
Incorrect. A gateway VPC endpoint for Amazon S3 only provides private access from a VPC to S3; it does not provide private connectivity to Snowflake's service endpoints. Snowflake client connections are not redirected through an S3 endpoint. This distractor reflects a common confusion between Snowflake stages that may use cloud storage and Snowflake service connectivity itself.
- C. Incorrect.
Incorrect. SnowCD is a diagnostic tool used to test connectivity to Snowflake endpoints; it does not provision or establish private connectivity. Using a privatelink URL alone is insufficient unless the required AWS PrivateLink resources and DNS configuration are in place. This option confuses validation tooling with the actual network architecture.
- D. Incorrect.
Incorrect. Customers do not build a direct site-to-site VPN into Snowflake-managed infrastructure as the standard method for Snowflake private service access. Snowflake private connectivity on AWS is provided through AWS PrivateLink, not customer-managed VPN tunnels to Snowflake. Also, network rules are not the mechanism described by Snowflake for restricting incoming client access by approved VPCE IDs in this scenario; network policies are.