ARA-C01 Question 44
Single answerStorage integrationsA company stores raw data files in an Amazon S3 bucket and wants Snowflake users to load and unload data without embedding AWS credentials in stages or user sessions. The security team requires that Snowflake be granted access only to a specific S3 path used for analytics exports and imports, and they want an approach that is centrally managed and reusable across multiple stages. Which solution best meets these requirements?
- A
Create a STORAGE INTEGRATION for S3, configure STORAGE_ALLOWED_LOCATIONS to the required bucket path, grant the IAM role trust to Snowflake using the generated IAM user ARN and external ID, and create stages that reference the integration.
- B
Create an external stage with AWS_KEY_ID and AWS_SECRET_KEY embedded in the stage definition, then restrict user access by granting USAGE on the stage only to approved roles.
- C
Create a FILE FORMAT that points to the S3 bucket path and use it in COPY INTO commands so that credentials do not need to be stored in Snowflake objects.
- D
Create a NOTIFICATION INTEGRATION for S3 and attach it to the stage so Snowflake can securely read and write files in the approved path.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use a Snowflake storage integration for Amazon S3. Storage integrations are designed to provide secure, centralized, and reusable access to cloud storage for external stages, removing the need to embed long-term cloud credentials in stage definitions or ad hoc commands. In AWS, the typical pattern is: create the storage integration in Snowflake, retrieve the generated IAM user ARN and external ID from DESCRIBE INTEGRATION, configure an AWS IAM role with a trust policy for Snowflake, and grant the required S3 permissions only to the approved bucket or prefix. Snowflake best practice is also to use STORAGE_ALLOWED_LOCATIONS to limit which paths can be accessed through the integration. This supports least-privilege design and simplifies governance when multiple stages need the same controlled access. Relevant Snowflake documentation includes the sections on CREATE STORAGE INTEGRATION, configuring an Amazon S3 storage integration, external stages, and DESCRIBE INTEGRATION.
- A. Correct.
Correct. A storage integration is the recommended Snowflake mechanism for delegating cloud storage access without hard-coding cloud credentials in stages or COPY commands. For Amazon S3, Snowflake provides an IAM user ARN and external ID that the customer uses in the AWS trust policy for an IAM role. The integration can be centrally managed and reused by multiple external stages. Setting STORAGE_ALLOWED_LOCATIONS restricts which S3 locations can be referenced through the integration, aligning with the requirement to limit access to a specific path.
- B. Incorrect.
Incorrect. Although embedding AWS credentials in an external stage can work technically, it violates the requirement to avoid embedding cloud credentials in Snowflake objects or sessions. Restricting stage privileges controls which Snowflake users can use the stage, but it does not address centralized credential management or the security team's requirement to avoid stored access keys.
- C. Incorrect.
Incorrect. A file format defines parsing and formatting rules such as CSV, JSON, compression, and delimiters. It does not provide authentication or authorization to cloud storage. This option reflects a common misconception that file formats and stages serve similar purposes; in reality, storage access must be configured through a stage using either credentials or a storage integration.
- D. Incorrect.
Incorrect. A notification integration is used for messaging/event services, such as auto-ingest with cloud messaging or outbound notifications, not for granting read/write access to S3 storage locations. It does not replace a storage integration for external stage access.