SnowPro Advanced: Security Engineer Question 386
Select 2Design and deploy containerized services using Snowpark Container ServicesA security engineering team is deploying an internal API as a Snowpark Container Services service. The API must read sensitive data from Snowflake tables and call an external tokenization endpoint on the internet. The company wants to follow least-privilege principles and ensure the service can reach only the approved external host while using Snowflake-native identity for data access. Which combination of steps should the team take?
- A
Create a service that runs with a dedicated service role, grant that role only the required privileges on the target database objects, and configure the service to use an external access integration that permits the approved endpoint.
- B
Embed a user name and password for a highly privileged Snowflake user in the container image so the application can connect to Snowflake directly and avoid service-to-Snowflake authorization issues.
- C
Create a network rule for the approved external host, create an external access integration that references that network rule, and allow the service to use that integration for outbound connectivity.
- D
Grant ACCOUNTADMIN to the role used by the service so the container can access all required schemas and external destinations without additional configuration.
- E
Rely on Snowflake's default outbound internet access from containers, because Snowpark Container Services services can call public endpoints unless outbound traffic is explicitly blocked.
Show answer and explanation
Correct answers: A, C
Explanation
The secure design is to separate Snowflake data authorization from outbound network authorization and apply least privilege to both. For data access, the service should run with a dedicated service role that has only the required privileges on the needed databases, schemas, and tables. For external connectivity, Snowflake uses external network access controls based on network rules and external access integrations. The team should define a network rule for the tokenization endpoint and create an external access integration that permits access only to that approved destination, then configure the service to use it. This approach matches Snowflake best practices for Snowpark Container Services and external network access: avoid embedded credentials, avoid overprivileged account roles, and explicitly authorize outbound connectivity to known destinations.
- A. Correct.
Correct. For Snowpark Container Services, using a dedicated service role aligns with least-privilege design. The service should be granted only the specific privileges it needs on Snowflake objects rather than broad account-level permissions. For outbound calls to external services, the service should use an external access integration, which is the supported mechanism to control and authorize outbound network access.
- B. Incorrect.
Incorrect. Embedding credentials for a powerful Snowflake user in a container image is a poor security practice and violates least-privilege and secret-management principles. Snowpark Container Services is designed to use Snowflake-native authorization patterns rather than hard-coded high-privilege credentials. This option also creates credential rotation and exposure risks.
- C. Correct.
Correct. External network access from Snowpark Container Services is controlled through external access integrations, which reference network rules defining allowed destinations. Restricting outbound access to the approved host through a network rule and integration is the appropriate security control for this scenario.
- D. Incorrect.
Incorrect. Granting ACCOUNTADMIN to a service role is excessive and contrary to security best practices. It does not replace the need to explicitly configure outbound network access through external access integrations and network rules. This distractor reflects the common misconception that broad administrative privileges can substitute for proper network and service configuration.
- E. Incorrect.
Incorrect. Snowpark Container Services does not rely on unrestricted default outbound internet access for approved production designs. Outbound access to external endpoints is governed through explicit configuration using external access integrations and network rules. Assuming open egress would violate the platform's controlled external connectivity model.