ARA-C01 Question 320
Single answerAPI endpointsA company is building an internal provisioning service that must create Snowflake users, grant roles, and rotate service credentials across multiple Snowflake accounts. The security team requires all automation to use programmatic interfaces, to avoid interactive sessions, and to keep traffic on private network paths wherever possible. The architect is evaluating Snowflake API endpoints to support this design.
Which approach best meets these requirements while remaining aligned with Snowflake best practices?
- A
Use the Snowflake SQL API over a private connectivity endpoint such as AWS PrivateLink, Azure Private Link, or Google Cloud Private Service Connect, and authenticate the service with supported non-interactive credentials.
- B
Use Snowsight URLs as the primary endpoint because they provide the same administrative functions as APIs and are intended for automation workloads.
- C
Use only the Snowflake REST APIs for all administrative operations, because every SQL statement and account management task is exposed through a single REST endpoint family.
- D
Connect through the public Snowflake account URL and embed a username and password in the provisioning application, because private connectivity is only supported for web UI access.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a supported programmatic endpoint, specifically the Snowflake SQL API for SQL-driven administration, combined with private connectivity where the cloud platform and Snowflake account configuration support it. In real-world Snowflake architectures, many provisioning tasks such as CREATE USER, ALTER USER, GRANT ROLE, and related administrative actions are executed as SQL statements by a service principal or other non-interactive identity with carefully scoped privileges. Snowflake documents the SQL API as an HTTPS-based interface for executing SQL statements, and Snowflake also documents private connectivity options including AWS PrivateLink, Azure Private Link, and Google Cloud Private Service Connect for keeping traffic on private paths.
The distractors reflect common mistakes: using Snowsight for machine automation, assuming one REST API family covers all possible operations, or hardcoding user credentials and sending traffic only over public endpoints. For architect-level design, the key is selecting supported API endpoints appropriate for automation, combining them with secure authentication patterns and private connectivity controls when required by enterprise security standards.
- A. Correct.
Correct. The SQL API is a Snowflake programmatic endpoint designed for executing SQL statements over HTTPS, which can support automation patterns such as creating users, granting roles, and issuing SQL-based administrative commands where the executing role has the required privileges. Snowflake also supports private connectivity options, including AWS PrivateLink, Azure Private Link, and Google Cloud Private Service Connect, to keep traffic off the public internet where available and appropriately configured. Using supported non-interactive authentication methods aligns with automation and security best practices better than relying on interactive logins.
- B. Incorrect.
Incorrect. Snowsight is a web-based user interface, not the recommended API endpoint for provisioning automation. While administrators can perform management tasks in Snowsight, it is intended for human interaction rather than service-to-service automation. Treating browser-based URLs as automation endpoints is a common misconception and does not satisfy the requirement to use programmatic interfaces.
- C. Incorrect.
Incorrect. Snowflake offers multiple programmatic interfaces, but it is not accurate to say that every SQL statement and every account management function is exposed through a single REST endpoint family. In practice, architects typically use a combination of supported interfaces depending on the task, and many administrative operations are performed by executing SQL through a supported client or the SQL API. The statement overgeneralizes Snowflake's API surface and could lead to an implementation plan based on capabilities that are not uniformly available in one endpoint set.
- D. Incorrect.
Incorrect. Embedding usernames and passwords in an application is not aligned with security best practices, especially for credential rotation and privileged automation. In addition, private connectivity is not limited to web UI access; Snowflake supports private connectivity for account access patterns used by clients and programmatic interfaces when properly configured. This option fails both the security requirement and the network-path requirement.