SnowPro Advanced: Security Engineer Question 45
Single answerImplement key-pair authenticationA security engineer is enabling key-pair authentication for a service account used by an ETL application. The account already exists in Snowflake and must continue to authenticate non-interactively after the change. The engineer generates a 2048-bit RSA key pair and wants to configure Snowflake so the application can authenticate with the private key while minimizing disruption during future key rotation. Which action should the engineer take in Snowflake to correctly implement this requirement?
- A
Assign the RSA public key to the service user with ALTER USER ... SET RSA_PUBLIC_KEY='<public_key>' and configure the client to use the matching private key.
- B
Store the private key in a Snowflake stage, grant the service user READ access, and reference that staged file in the connection string.
- C
Set the PASSWORD parameter to the PEM-formatted private key so Snowflake can validate the key pair during login.
- D
Create a network policy that allows only the ETL server IP address, which automatically enables key-pair authentication for the user.
Show answer and explanation
Correct answer: A
Explanation
To implement key-pair authentication in Snowflake, you generate an RSA key pair, assign the public key to the Snowflake user, and configure the client or driver to use the corresponding private key. For service accounts, this is a common best practice because it supports non-interactive authentication without embedding passwords in jobs. Snowflake supports storing the public key in user properties such as RSA_PUBLIC_KEY and also provides RSA_PUBLIC_KEY_2 to help with key rotation, allowing a second public key to be added before cutover. This reduces disruption during rotation because the application can switch private keys while Snowflake temporarily trusts both associated public keys. Relevant Snowflake documentation includes the topics on key-pair authentication and ALTER USER user parameters.
- A. Correct.
Correct. In Snowflake key-pair authentication, Snowflake stores the user's RSA public key in the user object, and the client proves possession of the corresponding private key during authentication. This is configured with ALTER USER ... SET RSA_PUBLIC_KEY = '<public_key>' (or RSA_PUBLIC_KEY_2 for rotation). The ETL application is then configured to use the matching private key. This is the standard implementation pattern for non-interactive service accounts.
- B. Incorrect.
Incorrect. Snowflake does not implement key-pair authentication by retrieving a private key from an internal or external stage. The private key must remain under the client's control and should be stored securely outside Snowflake, such as in a secrets manager or protected filesystem. Staging the private key in Snowflake would also be a security anti-pattern.
- C. Incorrect.
Incorrect. The PASSWORD parameter is for password-based authentication, not for registering cryptographic key material. Snowflake validates key-pair authentication using the public key stored on the user and a signature generated by the client's private key. Replacing the password with a private key would not configure key-pair authentication.
- D. Incorrect.
Incorrect. A network policy can restrict where connections originate, but it does not enable or configure key-pair authentication. Network policies and key-pair authentication are separate controls and are often used together for defense in depth, but one does not replace the other.