ARA-C01 Question 88
Single answerExternal accessA financial services company wants a Python stored procedure in Snowflake to call an external fraud-scoring REST API during batch processing. The security team requires that: (1) outbound traffic is limited only to the fraud provider's approved endpoint, (2) API credentials are not hard-coded in the procedure, and (3) the procedure can use those credentials securely at runtime. Which design best meets these requirements?
- A
Create a network rule that allows the fraud API host, create a secret containing the API credential, create an external access integration that references both the network rule and the secret, and allow the stored procedure to use that integration and retrieve the secret at runtime.
- B
Store the API key in a table encrypted with Snowflake-managed encryption, and let the Python stored procedure call the external endpoint directly as long as the account has outbound internet connectivity.
- C
Create a storage integration for the fraud provider endpoint, grant the stored procedure usage on the integration, and pass the API key as a procedure argument from the orchestration tool.
- D
Create an API integration for the fraud provider, map the external function to the REST endpoint, and invoke the external function from inside the Python stored procedure to avoid managing secrets separately.
Show answer and explanation
Correct answer: A
Explanation
The best design is to use Snowflake external network access for the Python stored procedure. In practice, this means defining a network rule that restricts egress to the approved fraud-scoring API host, creating a secret object to hold the API credential securely, and creating an external access integration that references the allowed network rule and the authorized secret. The stored procedure is then configured to use that integration and access the secret at runtime through supported secret-handling mechanisms. This is the Snowflake best-practice pattern for secure outbound calls from UDFs and stored procedures because it enforces least privilege for both network destinations and credential use. By contrast, storage integrations are for cloud storage access, API integrations are primarily for external functions and related integrations, and storing credentials in tables or passing them as arguments does not provide the same control model as secrets plus external access integration. Refer to Snowflake documentation on External Network Access, CREATE NETWORK RULE, CREATE SECRET, and CREATE EXTERNAL ACCESS INTEGRATION.
- A. Correct.
Correct. For outbound access from handler code such as Python stored procedures and UDFs, Snowflake uses external network access with an external access integration. The integration can reference allowed network locations via network rules and can authorize specific secrets for use by the handler. This satisfies endpoint restriction and secure credential handling without hard-coding secrets in code.
- B. Incorrect.
Incorrect. Even if data in a table is encrypted at rest, storing API credentials in a table for retrieval by application code is not the recommended secure pattern for external network access. More importantly, outbound access is not enabled simply because Snowflake has internet connectivity; the handler must use an external access integration with an allowed network rule. This option misses the required network allowlist control and proper secret management model.
- C. Incorrect.
Incorrect. A storage integration is used for secure access to cloud storage services such as S3, GCS, or Azure Blob/ADLS, not for arbitrary outbound REST calls from Python stored procedures. Passing the API key as a procedure argument also increases exposure risk and does not meet the requirement to avoid hard-coding or insecure credential handling.
- D. Incorrect.
Incorrect. API integrations are used with external functions and related features, not to enable general outbound HTTP requests from Python stored procedures. While external functions can call remote services, this option changes the architecture and does not describe the required external access integration pattern for handler code. It also incorrectly implies that using an API integration removes the need to manage credentials appropriately for this stored procedure scenario.