ADA-C01 Question 246
Single answerExternal stagesA data engineering team stores daily CSV files in an Amazon S3 bucket and uses a Snowflake external stage named RAW_S3_STAGE to load them. The security team has rotated the AWS IAM credentials that were embedded in the stage definition. Since the rotation, COPY INTO commands that reference @RAW_S3_STAGE fail with authentication errors. The team wants to restore access quickly while following Snowflake security best practices and minimizing future operational impact from credential rotation. Which action should the Snowflake administrator take?
- A
Run ALTER STAGE RAW_S3_STAGE to update the AWS_KEY_ID and AWS_SECRET_KEY values in the stage definition with the new IAM credentials.
- B
Drop and recreate the stage so Snowflake refreshes its cached S3 permissions automatically.
- C
Reconfigure the external stage to use a STORAGE INTEGRATION mapped to the S3 bucket, then update the AWS trust relationship and bucket policy to allow the Snowflake IAM user or role.
- D
Convert the external stage to an internal named stage and use PUT to upload the S3 files into Snowflake before each load.
Show answer and explanation
Correct answer: C
Explanation
The best answer is to move the external stage from inline AWS credentials to a STORAGE INTEGRATION. In Snowflake, external stages can access S3 using either direct credentials or a storage integration, but storage integrations are the recommended best practice because they avoid hardcoding secrets in stage definitions and simplify secure cloud access management. For S3, this requires creating or using a STORAGE INTEGRATION, granting it access to the appropriate S3 locations, and configuring the AWS IAM trust relationship and bucket policy to allow Snowflake's IAM principal. This design reduces the need to touch Snowflake objects whenever credentials are rotated. In contrast, manually updating AWS_KEY_ID and AWS_SECRET_KEY may fix the immediate outage but creates ongoing maintenance and security risk. Relevant Snowflake documentation includes guidance on CREATE STAGE, ALTER STAGE, and CREATE STORAGE INTEGRATION for Amazon S3, which consistently recommends storage integrations over direct cloud credentials.
- A. Incorrect.
This can restore access in the short term if the stage was originally created with inline AWS credentials, because ALTER STAGE supports changing stage properties. However, embedding cloud credentials directly in a stage is not the recommended long-term approach. Snowflake best practice is to use a STORAGE INTEGRATION for S3 access so credential rotation is handled through cloud trust configuration rather than manually updating secrets in stage definitions. Because the question asks for a solution that also minimizes future operational impact and follows security best practices, this is not the best answer.
- B. Incorrect.
This is incorrect. Recreating the stage is unnecessary for credential rotation and does not inherently solve authentication problems unless the recreated definition uses valid access configuration. There is no special benefit from dropping and recreating the stage just to refresh permissions. The problem is the authentication method, not a stale stage object.
- C. Correct.
This is correct. For Amazon S3 external stages, Snowflake recommends using a STORAGE INTEGRATION instead of embedding AWS keys in the stage definition. A storage integration uses a Snowflake-managed IAM entity and an established trust relationship in AWS, which improves security and reduces operational overhead when credentials change. After configuring the integration, the stage can reference STORAGE_INTEGRATION =
, and AWS-side trust and bucket permissions must allow Snowflake access to the target bucket or path. - D. Incorrect.
This is incorrect. Internal stages and PUT are used to upload files from a local client to Snowflake-managed storage, not to directly reference files already stored in S3 as part of an external stage architecture. This would add unnecessary operational work, change the ingestion pattern, and does not address the root cause in the most appropriate way.