SnowPro Advanced: Security Engineer Question 107
Single answerImplement, configure, and manage the customer-managed key component of Tri-Secret SecureA financial services company uses Snowflake Business Critical Edition with Tri-Secret Secure enabled in AWS. The security team must implement a customer-managed key (CMK) so that: (1) Snowflake data is unreadable if the company disables its key, (2) key usage is centrally audited in AWS, and (3) the solution minimizes operational risk during future key rotation. Which action should the Snowflake security engineer take?
- A
Create an AWS KMS multi-Region key, grant Snowflake permissions to use the key, and configure Snowflake to use the key ARN for Tri-Secret Secure so Snowflake combines its key material with the customer-managed key.
- B
Generate a client-side key pair in Snowflake, upload the private key to an internal secrets manager, and register the public key in Snowflake so encrypted micro-partitions depend on the customer key.
- C
Store a symmetric master key in an internal HSM, export the raw key material to Snowflake, and schedule quarterly uploads so Snowflake can re-encrypt all existing data with the latest version.
- D
Enable periodic automatic rotation for the Snowflake account master key only, because Tri-Secret Secure does not support integration with a cloud-provider key management service for customer-controlled revocation.
Show answer and explanation
Correct answer: A
Explanation
Tri-Secret Secure adds a customer-managed key component to Snowflake's encryption architecture so access to encrypted data depends on multiple key elements, including a key controlled by the customer. In AWS, this is implemented using AWS KMS. The customer creates and manages the KMS key, authorizes Snowflake to use it, and can audit key usage with native AWS logging such as CloudTrail. A major benefit is customer-controlled revocation: if the KMS key is disabled or access is revoked, Snowflake cannot decrypt data protected under Tri-Secret Secure. From an operational perspective, using the supported cloud KMS integration is the best practice because it avoids unsupported manual key handling and reduces rotation risk. Snowflake documentation for Tri-Secret Secure and customer-managed keys emphasizes using the cloud provider's KMS integration, proper grants/policies for Snowflake access, and relying on the provider's key lifecycle capabilities rather than trying to manage raw key material directly.
- A. Correct.
Correct. In AWS, the customer-managed component of Tri-Secret Secure is implemented with AWS KMS. The customer creates and manages the KMS key, grants Snowflake access to use it, and configures Snowflake with the KMS key identifier/ARN. Snowflake then uses Tri-Secret Secure's combined key model so data access depends on both Snowflake-managed and customer-managed key material. This satisfies the requirement for customer-controlled revocation by disabling or restricting the KMS key, provides centralized auditing through AWS KMS/CloudTrail, and reduces operational risk because KMS rotation is handled through the key service rather than manual key export/import workflows.
- B. Incorrect.
Incorrect. This describes Snowflake key pair authentication concepts, not Tri-Secret Secure encryption key management. Public/private key pairs are used for user authentication to Snowflake, not for encrypting Snowflake storage with a customer-managed key. Choosing this option reflects a common confusion between authentication keys and encryption keys.
- C. Incorrect.
Incorrect. Tri-Secret Secure does not require exporting raw symmetric key material from a customer HSM into Snowflake for manual upload and periodic replacement. The customer-managed key component is integrated through the supported cloud key management service. Exporting raw master keys and manually re-uploading them is both operationally risky and not the supported implementation pattern for Tri-Secret Secure.
- D. Incorrect.
Incorrect. Tri-Secret Secure is specifically designed to incorporate a customer-managed key from the cloud provider's key management service, enabling customer-controlled revocation. Rotating only Snowflake-managed keys would not meet the requirement that the company can make data unreadable by disabling its own key. This option incorrectly states that cloud KMS integration is not supported.