ADA-C01 Question 245
Single answerCreate and manage Snowflake storage integrationA company stores raw data files in an Amazon S3 bucket and wants multiple Snowflake external stages to use a single, centrally managed credential instead of embedding cloud credentials in each stage. The security team also requires that Snowflake be restricted to reading only from specific S3 locations within the bucket. As the Snowflake administrator, which action should you take to meet these requirements with the least ongoing maintenance?
- A
Create a STORAGE INTEGRATION object configured for S3, define the allowed S3 locations on the integration, grant USAGE on the integration, and reference it from the external stages.
- B
Create each external stage with AWS_KEY_ID and AWS_SECRET_KEY credentials directly in the stage definition, and restrict access by granting USAGE only on the stages.
- C
Create a FILE FORMAT object that specifies the permitted S3 paths, then attach that file format to all external stages that access the bucket.
- D
Create a SECURITY INTEGRATION for S3 access, then assign it to the external stages to centralize the cloud credential and path restrictions.
Show answer and explanation
Correct answer: A
Explanation
The best practice for Snowflake external access to Amazon S3 is to use a STORAGE INTEGRATION rather than hard-coded cloud credentials in stage definitions. Storage integrations centralize trust configuration and reduce credential exposure. They also support restricting access to approved storage locations through integration properties such as allowed locations, which aligns with the requirement to limit Snowflake access to specific S3 paths. External stages then reference the integration, making the design easier to manage across multiple stages. This approach is consistent with Snowflake documentation for CREATE STORAGE INTEGRATION, CREATE STAGE, and the recommended pattern for secure access to external cloud storage.
- A. Correct.
Correct. A storage integration is the Snowflake object designed to delegate access to cloud storage for external stages without embedding cloud credentials in each stage. For Amazon S3, the integration can be configured with allowed locations such as STORAGE_ALLOWED_LOCATIONS so administrators can restrict which buckets or paths can be accessed. External stages can then reference the integration using STORAGE_INTEGRATION =
, which centralizes credential management and reduces operational overhead. Granting USAGE on the integration is also required for roles that need to create or use stages referencing it. - B. Incorrect.
Incorrect. Embedding AWS keys directly in each external stage is an older, less maintainable pattern and does not provide centralized credential management. It also increases secret sprawl and administrative burden when credentials must be rotated. Granting USAGE on the stages controls Snowflake object access, but it does not satisfy the requirement to centrally manage cloud credentials or enforce path restrictions through a shared integration.
- C. Incorrect.
Incorrect. A file format defines how Snowflake interprets file contents, such as CSV, JSON, compression, and delimiters. It does not control cloud authentication, authorization, or allowed S3 paths. Someone might choose this option because file formats are commonly associated with stages, but they are unrelated to storage credential management.
- D. Incorrect.
Incorrect. Security integrations are used for features such as federated authentication, OAuth, external API authentication, and some security-related trust configurations, but they are not the object used to connect external stages to S3 storage. For cloud storage access by stages, Snowflake uses storage integrations, not security integrations.