ARA-C01 Question 313
Single answerDriversA global company is standardizing how several internal Java and Python applications connect to Snowflake. Security requires MFA for all interactive users, but the applications must run unattended in CI/CD pipelines and nightly batch jobs. The architecture team also wants to minimize long-term credential exposure and avoid rewriting SQL logic in the applications. Which approach should the architect recommend?
- A
Use Snowflake JDBC and Python Connector with key-pair authentication through a dedicated service user for each application, and keep SQL execution in the application code or parameterized statements.
- B
Use browser-based SSO authentication in the JDBC and Python drivers for the service accounts so the jobs inherit MFA and can run non-interactively.
- C
Use username/password authentication for shared service accounts embedded in application configuration files, and rotate the passwords quarterly.
- D
Replace the drivers with SnowSQL scripts launched from the applications because SnowSQL is the only Snowflake client that supports secure non-interactive execution.
Show answer and explanation
Correct answer: A
Explanation
For unattended application connectivity to Snowflake, architects should distinguish between interactive users and service accounts. MFA and browser-based SSO are appropriate for human access patterns, but automated applications typically require non-interactive authentication. Snowflake client drivers, including JDBC and the Python Connector, support key-pair authentication for service users, which is a recommended pattern to reduce password exposure while enabling automation. This also allows teams to continue using SQL through standard drivers without redesigning applications around a different client. In Snowflake documentation, key-pair authentication is specifically positioned for programmatic access, while SSO/browser-based authentication is intended for interactive sign-in experiences.
- A. Correct.
Correct. For unattended workloads, Snowflake drivers such as JDBC and the Python Connector support key-pair authentication, which is a common best practice for service users because it avoids interactive login flows and reduces reliance on long-lived passwords. This approach fits CI/CD and scheduled jobs. It also preserves existing SQL-based application logic because the applications can continue to use SQL through the drivers rather than being redesigned around another interface.
- B. Incorrect.
Incorrect. Browser-based SSO is designed for interactive authentication and is not appropriate for headless batch jobs or CI/CD pipelines. MFA requirements for human users do not imply that unattended service accounts should use interactive browser flows. This option reflects a common misconception that all authentication should be forced through SSO regardless of workload type.
- C. Incorrect.
Incorrect. While username/password authentication is technically possible, embedding passwords in application configuration creates higher operational and security risk than key-pair authentication. Quarterly rotation helps but does not address the core issue of storing reusable secrets. This is a plausible but weaker design compared to key-pair authentication for non-interactive service accounts.
- D. Incorrect.
Incorrect. SnowSQL can be used for automation, but it is not the only secure non-interactive client, and replacing application drivers with command-line script execution would add unnecessary complexity. Snowflake drivers already support secure programmatic connectivity patterns suitable for applications and pipelines.