ARA-C01 Question 87
Single answerExternal accessA financial services company wants a Python UDF in Snowflake to call an external fraud-scoring REST API during query execution. The security team requires that outbound traffic be restricted to only the approved API host, and the API key must not be hard-coded in the function definition. The architect must design the solution so developers can use the UDF without being granted direct access to the stored secret value. Which configuration best meets these requirements?
- A
Create a network rule that allows the fraud API host, create a secret to store the API key, create an external access integration that references both the network rule and the allowed secret, and define the Python UDF to use that external access integration and secret.
- B
Create a storage integration for the fraud API endpoint, store the API key in a session variable, and define the Python UDF to read the session variable at runtime.
- C
Create an API integration for the fraud API endpoint, store the API key in a table protected by row access policies, and define the Python UDF to query the table for the key before making the REST call.
- D
Create a network policy that permits egress to the fraud API host, store the API key in an internal stage file, and define the Python UDF to read the file and call the endpoint directly.
Show answer and explanation
Correct answer: A
Explanation
For outbound calls from Snowflake handler code, such as Python UDFs and stored procedures, the supported design uses external network access. The core components are: a network rule defining allowed external destinations, a secret storing the credential material, and an external access integration that references the allowed network rules and secrets. The function or procedure then specifies the external access integration and secret so the handler can securely authenticate to the remote service. This approach satisfies least-privilege requirements by limiting egress to approved hosts and avoiding hard-coded credentials in source code. In contrast, storage integrations and network policies serve different purposes, and API integrations are associated with external functions rather than the external access feature for UDFs/procedures. This aligns with Snowflake documentation on External Network Access, Secrets, Network Rules, and CREATE EXTERNAL ACCESS INTEGRATION best practices.
- A. Correct.
Correct. Snowflake external network access for UDFs and stored procedures requires an external access integration. To restrict outbound access, the integration references one or more network rules that specify allowed destinations. To avoid hard-coding credentials, Snowflake secrets are used to store values such as API keys, and the external access integration can allow specific secrets. The Python UDF then references the integration and secret, allowing the handler code to retrieve the credential securely at runtime without exposing the value directly to developers who use the function.
- B. Incorrect.
Incorrect. Storage integrations are used for access to external cloud storage, not for outbound REST calls from UDFs or stored procedures. Session variables are also not an appropriate secure credential store for this use case and would expose operational complexity and risk. This option confuses external storage access with external network access.
- C. Incorrect.
Incorrect. API integrations in Snowflake are used for features such as external functions, not for enabling outbound network access from Python UDFs. Also, storing the API key in a table means the function logic must retrieve sensitive data through SQL, which does not align with Snowflake's secret mechanism for external access and increases exposure risk even if table access is controlled.
- D. Incorrect.
Incorrect. Network policies in Snowflake govern client access to Snowflake, such as restricting which IP addresses can connect, not egress destinations for handler code. Storing an API key in a stage file is not the recommended secure pattern for credentials used by external access from UDFs. This option mixes unrelated security controls with an unsafe credential approach.