ARA-C01 Question 94
Single answerAWS PrivateLinkA financial services company runs workloads in AWS and must connect application servers in a private VPC to Snowflake without sending traffic over the public internet. The security team also wants to restrict access so that only approved VPC endpoint IDs can reach the Snowflake account. The Snowflake account is hosted on AWS in the same region as the application. Which solution best meets these requirements?
- A
Configure AWS PrivateLink for the Snowflake account, create interface VPC endpoints in the application VPC for the Snowflake service, and configure Snowflake to allow only the approved VPCE IDs.
- B
Create a site-to-site VPN from the application VPC to Snowflake's AWS account, then use Snowflake network policies to allow the VPC CIDR ranges.
- C
Use an internet gateway with TLS termination on the application load balancer, and restrict access by allowing only the NAT gateway public IP addresses in Snowflake network policies.
- D
Deploy Snowflake in a customer-managed VPC using AWS Transit Gateway, then route private subnet traffic directly to Snowflake over the transit attachment.
Show answer and explanation
Correct answer: A
Explanation
For Snowflake on AWS, AWS PrivateLink is the recommended architecture when clients in a VPC must access Snowflake privately. This avoids exposure to the public internet by using AWS interface endpoints to connect to Snowflake's endpoint service within the same region. In addition, Snowflake supports restricting access to authorized AWS VPC endpoint IDs, which provides stronger control than relying only on source IP addresses. By contrast, VPN-based connectivity into Snowflake's managed environment is not a supported customer configuration, and Snowflake cannot be placed inside a customer VPC or attached to a customer Transit Gateway. Relevant Snowflake documentation includes the private connectivity guidance for AWS PrivateLink and the controls for restricting access using authorized VPC endpoint identifiers.
- A. Correct.
Correct. AWS PrivateLink is the supported pattern for private connectivity from an AWS VPC to Snowflake without traversing the public internet. On AWS, customers create interface VPC endpoints that connect privately to the Snowflake-provided endpoint service. Snowflake can also be configured to authorize specific AWS VPC endpoint IDs (VPCE IDs), which satisfies the requirement to restrict connectivity to approved endpoints only.
- B. Incorrect.
Incorrect. Snowflake does not support customers establishing a site-to-site VPN directly into Snowflake's managed AWS environment as a connectivity method. Also, allowing CIDR ranges with network policies is not equivalent to restricting by approved AWS PrivateLink VPC endpoint IDs.
- C. Incorrect.
Incorrect. This design still relies on public internet access, even if traffic is encrypted with TLS. Restricting Snowflake access by NAT gateway public IPs is an IP-based control, not a private connectivity model, and it does not satisfy the requirement to avoid public internet exposure.
- D. Incorrect.
Incorrect. Snowflake is a fully managed SaaS service and is not deployed into a customer-managed VPC. Customers cannot attach Snowflake to their own AWS Transit Gateway as if it were a workload they own. This option reflects a common misconception that Snowflake networking can be managed like customer-hosted EC2 applications.