SnowPro Advanced: Security Engineer Question 43
Single answerManage secure programmatic access:A security engineer is reviewing how a CI/CD platform connects to Snowflake to run automated DDL deployments. The current integration uses a shared Snowflake user with a long-lived password stored in the CI/CD secret store. The company wants to reduce credential management overhead, improve auditability, and align with a policy that prohibits static database passwords in automation whenever possible. The CI/CD platform can obtain short-lived OAuth access tokens from the company identity provider. Which approach should the security engineer recommend to provide the MOST secure and maintainable programmatic access to Snowflake?
- A
Configure Snowflake to trust the external OAuth identity provider, map the CI/CD workload to a dedicated Snowflake service user, and have the pipeline request short-lived OAuth tokens for authentication
- B
Keep the shared Snowflake user, but rotate its password daily through the CI/CD platform and restrict the user to a dedicated role
- C
Create key pair authentication for a shared Snowflake user and embed the private key directly in the build script so the pipeline does not need to retrieve secrets at runtime
- D
Use a generic human administrator account with MFA disabled for API access, because CI/CD tools cannot complete interactive MFA challenges
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake External OAuth with short-lived tokens issued by the organization's identity provider. This is the most secure and maintainable option given the scenario because it removes dependency on static Snowflake passwords, reduces secret management burden, and supports stronger identity federation for workloads. A dedicated Snowflake user or service principal mapping for the CI/CD workload improves auditability and least-privilege role assignment. Snowflake documentation and security best practices for programmatic access generally favor federated or cryptographic approaches over shared passwords, especially for automation. Key pair authentication is also a strong option in many environments, but in this case External OAuth is superior because the platform already supports short-lived token acquisition and the company specifically wants to avoid static database passwords whenever possible.
- A. Correct.
Correct. External OAuth is designed for programmatic authentication using tokens issued by a trusted external identity provider. In this scenario, the CI/CD platform already obtains short-lived OAuth access tokens, so configuring Snowflake External OAuth avoids static Snowflake passwords and improves maintainability. Mapping the workload to a dedicated Snowflake principal also improves auditability compared to a shared human account. This aligns with best practices to use short-lived credentials and workload-specific identities where possible.
- B. Incorrect.
Incorrect. Daily password rotation is better than leaving a static password unchanged, but it still relies on password-based authentication and ongoing secret distribution. It does not meet the goal of eliminating static database passwords from automation whenever possible. It also adds operational overhead and leaves the organization managing password lifecycle instead of using token-based federation.
- C. Incorrect.
Incorrect. Key pair authentication is a valid option for secure programmatic access and is generally stronger than password authentication, but embedding the private key directly in the build script is a poor security practice because it hardcodes a long-lived secret into automation. In this scenario, the organization already has the ability to issue short-lived OAuth tokens, which is more aligned with the stated policy and reduces secret management overhead further.
- D. Incorrect.
Incorrect. Using a generic human administrator account for automation is a significant security and auditability problem. It violates least privilege, weakens accountability, and disabling MFA on a human admin account to support automation is not an acceptable design. Snowflake supports non-interactive programmatic access patterns such as External OAuth and key pair authentication specifically to avoid this anti-pattern.