ARA-C01 Question 219
Single answerStagesA data engineering team loads daily CSV files from an Amazon S3 bucket into Snowflake. The source files contain sensitive customer data and must not be publicly exposed. The architects want Snowflake to read the files without embedding long-term cloud credentials in application code, and they want the solution to be easy to rotate and manage centrally. Which approach should the architect recommend?
- A
Create an external stage that references the S3 bucket and configure a STORAGE INTEGRATION for Snowflake to access the bucket
- B
Create an internal named stage and use PUT commands from the S3 bucket directly into Snowflake
- C
Create an external stage with AWS key ID and secret key hardcoded in the stage definition because it is the simplest option
- D
Create a temporary stage and grant the application role OWNERSHIP so it can access the S3 bucket through Snowflake
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use an external stage backed by Amazon S3 together with a Snowflake STORAGE INTEGRATION. This design aligns with Snowflake best practices for external stages because it separates cloud authentication from application logic and object definitions, improves credential governance, and simplifies rotation and auditing. In real-world architectures, external stages are used when data already resides in cloud object storage such as S3, while internal stages are used when files must first be uploaded into Snowflake-managed storage. Snowflake documentation on CREATE STAGE and storage integrations emphasizes using storage integrations for secure access to S3, Azure Blob Storage, and Google Cloud Storage rather than embedding credentials directly in stage definitions.
- A. Correct.
Correct. For Amazon S3, Snowflake best practice is to use an external stage with a STORAGE INTEGRATION. This avoids hardcoding cloud credentials in SQL or application code and centralizes trust and access management. Snowflake uses the integration to assume an IAM role or otherwise access approved storage locations securely. This is the recommended architecture for secure, manageable access to cloud object storage.
- B. Incorrect.
Incorrect. Internal stages store files inside Snowflake-managed storage and are populated using commands such as PUT from a local client context. PUT does not transfer files directly from S3 into an internal stage. If the source system is already using S3, an external stage is the appropriate construct for reading directly from that bucket.
- C. Incorrect.
Incorrect. Snowflake does support credential-based access patterns in some cases, but hardcoding AWS access keys in stage definitions is not the preferred architectural approach for a secure enterprise design. It increases operational risk, complicates rotation, and exposes secrets in SQL definitions and deployment tooling. The scenario explicitly asks to avoid embedding long-term cloud credentials.
- D. Incorrect.
Incorrect. Temporary stages are session-scoped Snowflake objects and do not provide a mechanism to access S3 on their own. Granting OWNERSHIP on a stage does not grant cloud-provider access. Access to external cloud storage must be established through supported external stage credentials or, preferably, a storage integration.