SnowPro Advanced: Security Engineer Question 232
Single answerRe-establish security configurations for external resources, for example trust relationships for external stagesA company uses a Snowflake storage integration named S3_INT for several Amazon S3 external stages. After a disaster recovery exercise, the security team recreates the IAM role in AWS that Snowflake was previously allowed to assume. Users can still query stage definitions in Snowflake, but all data loads from the S3 stages now fail with access-related errors. The Snowflake administrator must re-establish the trust relationship with the least disruption to existing stage objects. Which action should the administrator take?
- A
Run CREATE OR REPLACE STAGE on each external stage so Snowflake generates a new trust relationship automatically.
- B
Run DESCRIBE INTEGRATION on S3_INT, retrieve the Snowflake IAM user ARN and external ID, and update the trust policy on the newly recreated AWS IAM role to trust Snowflake again.
- C
Grant USAGE on the external stages to the loading role again, because stage grants are removed when the AWS IAM role is recreated.
- D
Alter each external stage to embed AWS access keys directly instead of using the storage integration, because trust relationships cannot be restored for recreated IAM roles.
Show answer and explanation
Correct answer: B
Explanation
This scenario tests the ability to recover external resource security configuration after an external cloud-side object is recreated. In Snowflake, S3 external stages commonly reference a storage integration. The integration persists in Snowflake, but if the AWS IAM role it depends on is recreated, the AWS trust policy must be updated so Snowflake can assume that new role again. The standard recovery approach is to inspect the integration with DESCRIBE INTEGRATION and use the Snowflake-generated IAM user ARN and external ID to rebuild the AWS trust relationship. This avoids replacing stage objects or changing application-facing definitions. Snowflake documentation for storage integrations and configuring secure access to S3 describes the use of STORAGE_AWS_IAM_USER_ARN and STORAGE_AWS_EXTERNAL_ID in the AWS trust policy. Best practice is to continue using storage integrations rather than embedding long-lived credentials in external stages.
- A. Incorrect.
Incorrect. Recreating the stage objects is not required to restore the AWS trust relationship when the storage integration still exists in Snowflake. The trust is established between Snowflake and the AWS IAM role used by the storage integration, not by replacing every stage. Replacing stages would be disruptive and unnecessary.
- B. Correct.
Correct. For an S3 storage integration, Snowflake provides values such as the Snowflake IAM user ARN and the external ID, which are used in the AWS IAM role trust policy. If the AWS role is recreated, its trust relationship must be reconfigured so Snowflake can assume the role again. Using DESCRIBE INTEGRATION is the practical way to retrieve the required details and restore access without modifying existing stage definitions that already reference the integration.
- C. Incorrect.
Incorrect. Object privileges in Snowflake, such as USAGE on stages, are independent of the AWS IAM role lifecycle. Recreating the AWS role does not remove Snowflake grants on stage objects. This option reflects a common confusion between Snowflake RBAC and cloud-provider IAM trust configuration.
- D. Incorrect.
Incorrect. External stages that use a storage integration are specifically designed to avoid embedding cloud credentials in stage definitions. Moving to direct credentials is not a best practice and is not necessary to recover from a recreated IAM role. The correct remediation is to restore the AWS trust relationship for the integration.