ADA-C01 Question 247
Single answerExternal stagesA company stores daily CSV files in an Amazon S3 bucket and loads them into Snowflake. The security team requires that long-term AWS access keys not be embedded in SQL objects, and the data engineering team wants to simplify future key rotation without recreating stages. An administrator must create an external stage that points to the S3 location and supports secure access. Which approach should the administrator use?
- A
Create a STORAGE INTEGRATION for S3, grant the Snowflake-generated IAM user access to the bucket, and create the external stage using the integration.
- B
Create the external stage with AWS_KEY_ID and AWS_SECRET_KEY specified directly in the stage definition so Snowflake can authenticate to S3 without additional AWS configuration.
- C
Create an internal stage and configure a FILE FORMAT that references the S3 bucket, because file formats can securely store cloud credentials separately from the stage.
- D
Create the external stage with temporary AWS STS credentials embedded in the stage definition, because Snowflake automatically refreshes those credentials when they expire.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use a STORAGE INTEGRATION with the S3 external stage. This is the Snowflake best practice for secure access to cloud storage because it removes the need to place AWS keys directly in SQL definitions and simplifies ongoing credential management. In practice, the administrator creates the storage integration, retrieves the Snowflake IAM principal information, grants the required S3 permissions in AWS, and then creates the stage with the STORAGE_INTEGRATION parameter and the S3 URL. This aligns with Snowflake documentation on creating S3 storage integrations and external stages, which emphasizes using integrations for improved security, centralized credential management, and easier administration compared with embedding credentials directly in stage objects.
- A. Correct.
Correct. For S3 external stages, a STORAGE INTEGRATION is the recommended approach when you want to avoid embedding cloud credentials in SQL objects. Snowflake uses the integration along with an AWS IAM trust relationship and permissions granted to the Snowflake-generated IAM user or role, depending on the integration model. This improves security and operational maintainability, especially for credential rotation, because the stage continues to reference the integration rather than hard-coded keys.
- B. Incorrect.
Incorrect. Although directly specifying AWS credentials in a stage can work technically in some configurations, it does not meet the stated security requirement of avoiding embedded long-term access keys in SQL objects. It also increases operational burden because rotating credentials may require updating stage definitions or related objects.
- C. Incorrect.
Incorrect. Internal stages are Snowflake-managed storage and do not point to S3 buckets. A FILE FORMAT defines how data files are parsed, such as CSV delimiters or compression, but it does not store or manage cloud authentication details. This option confuses storage location configuration with file parsing configuration.
- D. Incorrect.
Incorrect. Temporary credentials can be used in some workflows, but embedding them in the stage definition is not a good long-term solution for a persistent external stage. Snowflake does not automatically refresh arbitrary STS credentials embedded in a stage definition. Once those credentials expire, access fails until the stage is altered with new credentials.