SnowPro Advanced: Security Engineer Question 75
Single answer1.4 Manage external access integrations.A security engineer is reviewing a Python UDF that calls a third-party tokenization service from Snowflake. The development team says the function should only be able to reach that specific API endpoint, and secrets used for authentication must be centrally controlled rather than hard-coded in code. The team has already created a NETWORK RULE that allows the vendor host and a SECRET object containing the API credential. Which configuration should the security engineer implement next to meet these requirements?
- A
Create an EXTERNAL ACCESS INTEGRATION that references the allowed NETWORK RULE and the permitted SECRET, then configure the UDF to use that integration.
- B
Grant the developer role USAGE on the NETWORK RULE and SECRET, then the UDF will automatically be allowed to call the external API.
- C
Create a STORAGE INTEGRATION for the vendor endpoint and attach the SECRET to the integration so the UDF can authenticate externally.
- D
Embed the API credential in the Python UDF code and rely on the NETWORK RULE alone to restrict outbound connectivity.
Show answer and explanation
Correct answer: A
Explanation
For Snowflake external network access from supported handlers, the core control point is the EXTERNAL ACCESS INTEGRATION. In practice, administrators define a NETWORK RULE to restrict egress destinations, create SECRET objects for credentials, and then create an EXTERNAL ACCESS INTEGRATION that lists the allowed network rules and allowed secrets. The UDF or stored procedure is then created or altered to use that integration. This design enforces least privilege for outbound connectivity and keeps credentials out of application code. Common mistakes include assuming object grants alone enable connectivity, confusing STORAGE INTEGRATION with EXTERNAL ACCESS INTEGRATION, or embedding secrets directly in code. These patterns align with Snowflake documentation and security best practices for managing external network access and secrets.
- A. Correct.
Correct. External network access from Snowflake handlers such as Python UDFs and stored procedures is governed through an EXTERNAL ACCESS INTEGRATION. The integration can reference allowed network rules and allowed authentication secrets, providing centralized control over which external destinations can be reached and which secrets can be used. The UDF or procedure must then be configured to use that integration. This matches the stated requirements: limit egress to the approved endpoint and avoid hard-coded credentials.
- B. Incorrect.
Incorrect. Granting privileges on a NETWORK RULE and SECRET does not by itself authorize outbound access from a UDF. Snowflake requires an EXTERNAL ACCESS INTEGRATION to explicitly allow egress and define which secrets may be used. This option reflects a common misconception that object privileges alone enable runtime external connectivity.
- C. Incorrect.
Incorrect. A STORAGE INTEGRATION is used for access to cloud storage services such as S3, Azure Blob Storage, or Google Cloud Storage, not for arbitrary outbound API calls from handler code. External API access for UDFs and procedures is managed through EXTERNAL ACCESS INTEGRATION, not STORAGE INTEGRATION.
- D. Incorrect.
Incorrect. Hard-coding credentials in handler code violates the requirement for centralized secret management and is not a security best practice. While a NETWORK RULE can help constrain destinations, it does not solve secure credential handling. Snowflake provides SECRET objects specifically so credentials can be managed separately from code and authorized through an external access integration.