ADA-C01 Question 114
Single answerManage private connectivity between cloud providers and SnowflakeA company runs Snowflake on AWS and has disabled public internet access for outbound traffic from its application VPC. The security team requires all application-to-Snowflake traffic to remain on the AWS private network and wants to avoid exposing the Snowflake account URL over the public internet. The Snowflake administrator must enable private connectivity for users and applications connecting from the VPC. Which action should the administrator take?
- A
Create an AWS PrivateLink endpoint in the application VPC for the Snowflake service, then use the Snowflake-provided private connectivity URL for client connections.
- B
Configure a VPC peering connection between the application VPC and the Snowflake-managed VPC, then continue using the standard Snowflake account URL.
- C
Create an AWS Transit Gateway attachment to Snowflake and update route tables so clients can reach the Snowflake control plane privately.
- D
Allow outbound HTTPS to the public Snowflake account URL and enforce TLS mutual authentication to make the connection private.
Show answer and explanation
Correct answer: A
Explanation
To provide private connectivity to Snowflake on AWS, administrators use AWS PrivateLink rather than VPC peering or Transit Gateway. Snowflake exposes a provider service for private connectivity, and the customer creates interface endpoints in their VPC. Clients then connect using Snowflake's private URL instead of the standard public account URL. This satisfies requirements to keep traffic on the AWS private network and avoid internet exposure of the connection path. Snowflake documentation for private connectivity describes the cloud-provider-specific patterns: AWS PrivateLink for AWS-hosted accounts, Azure Private Link for Azure-hosted accounts, and Google Cloud Private Service Connect for GCP-hosted accounts. A key exam point is distinguishing transport security like TLS from actual private network connectivity; TLS alone does not make a public endpoint private.
- A. Correct.
Correct. For Snowflake on AWS, private connectivity from customer workloads is implemented using AWS PrivateLink. The customer creates interface VPC endpoints in their VPC that connect to the Snowflake-provided endpoint service, and clients use the private connectivity URL supplied by Snowflake. This keeps traffic on the AWS network and avoids using the public internet path for the account endpoint.
- B. Incorrect.
Incorrect. Snowflake does not support customer-managed VPC peering directly into Snowflake-managed infrastructure for private client connectivity. This is a common misconception because VPC peering is often used for private network access between AWS environments, but Snowflake private access on AWS is provided through AWS PrivateLink, not VPC peering.
- C. Incorrect.
Incorrect. AWS Transit Gateway is not the mechanism used to establish private connectivity from customer applications to Snowflake. Customers cannot attach Snowflake as if it were another VPC behind their Transit Gateway for this purpose. The supported pattern is PrivateLink with Snowflake-specific endpoint service details and private URLs.
- D. Incorrect.
Incorrect. TLS protects data in transit, but using the public Snowflake account URL still sends traffic over the public internet path unless private connectivity is specifically configured. Mutual TLS is also not the standard mechanism for converting a public endpoint into private network connectivity. The requirement is to keep traffic on the cloud provider private backbone, which requires PrivateLink in AWS.