SnowPro Advanced: Security Engineer Question 77
Single answerCreate, implement and manage external access integrations:A security engineer needs to enable a Python UDF in Snowflake to call an internal HR REST API hosted outside Snowflake. The organization requires that outbound access be tightly controlled so the function can reach only the approved API host, and API credentials must not be hard-coded in the function. The engineer has already stored the API token in a Snowflake secret. Which additional configuration is required to securely allow the UDF to access the API?
- A
Create a network rule that allowlists the HR API host and create an external access integration that references both the network rule and the secret; then associate that integration and secret with the UDF.
- B
Create a storage integration for the HR API endpoint and grant the UDF USAGE on the integration so it can send HTTPS requests externally.
- C
Create a security integration for the HR API and embed the secret value in the UDF definition so Snowflake can inject it at runtime.
- D
Grant the developer role IMPORTED PRIVILEGES on the secret and configure the UDF with EXECUTE AS OWNER; Snowflake will automatically allow outbound connections to the API.
Show answer and explanation
Correct answer: A
Explanation
To let Snowflake handler code call an external API, you must configure external network access explicitly. The key components are: (1) a network rule that defines the permitted outbound host(s), (2) an external access integration that references the network rule and permits use of the relevant secret, and (3) the UDF or stored procedure definition referencing that integration and secret. This design enforces egress control and avoids hard-coded credentials, aligning with Snowflake security best practices and the documented model for external access integrations, network rules, and secrets.
- A. Correct.
Correct. For external network calls from Snowpark code or external network access-capable UDFs/procedures, Snowflake requires an external access integration. That integration references one or more network rules defining the allowed outbound destinations and can also allow access to specific secrets. The UDF/procedure must then explicitly reference the integration and the secret so credentials are not embedded in code. This is the secure, least-privilege pattern Snowflake documents for external network access.
- B. Incorrect.
Incorrect. Storage integrations are used for access to external cloud storage locations such as S3, Azure Blob Storage, or GCS, not for making outbound HTTPS calls from UDFs or procedures. A REST API endpoint is not configured through a storage integration.
- C. Incorrect.
Incorrect. Security integrations in Snowflake are used for federated authentication, OAuth, SCIM, and related identity/security configurations. They do not provide outbound network allowlisting for handler code. Also, embedding a secret value directly in the UDF definition violates the requirement to avoid hard-coded credentials; Snowflake secrets are specifically designed to prevent that.
- D. Incorrect.
Incorrect. EXECUTE AS OWNER affects privilege execution context, but it does not automatically authorize outbound network connectivity. External network access is blocked unless explicitly allowed through an external access integration tied to network rules. IMPORTED PRIVILEGES is also unrelated to using a secret in this scenario.