SnowPro Advanced: Security Engineer Question 79
Single answerUse network rules to manage allowed external endpointsA security engineer needs to let a Python UDF call an external REST API hosted at api.vendor-example.com over HTTPS, while preventing the code from reaching any other internet destinations. The engineer has already created a secret for the API credential and an external access integration. During testing, the UDF fails because outbound access is blocked. Which configuration change should the engineer make so the UDF can reach only the approved endpoint?
- A
Create a network rule in EGRESS mode with TYPE = HOST_PORT for api.vendor-example.com on port 443, and associate that rule with the external access integration.
- B
Create a network policy that allows api.vendor-example.com, then assign the policy to the user running the UDF.
- C
Add api.vendor-example.com to an ingress network rule and attach it to the external access integration.
- D
Grant the UDF owner role USAGE on the secret; no network rule is required if the secret is referenced by the function.
Show answer and explanation
Correct answer: A
Explanation
Snowflake external network access requires multiple components to work together: a secret for credentials if needed, an external access integration, and one or more network rules that define which external destinations are allowed. To restrict a Python UDF to a single HTTPS endpoint, the correct design is to create an EGRESS network rule with TYPE = HOST_PORT for the specific hostname and port 443, then include that rule in the external access integration used by the function. This is the documented least-privilege approach for managing allowed external endpoints. Network policies are for controlling client access into Snowflake, not outbound connectivity from handler code. Likewise, ingress rules do not apply when Snowflake-initiated code is calling an external API. Best practice is to allow only the exact host and required port rather than broader domains or unrestricted egress.
- A. Correct.
Correct. For external network access from Snowpark code, Python UDFs, and procedures, Snowflake uses external access integrations together with network rules that define the allowed outbound destinations. To permit access to a specific external API endpoint, the engineer should create a network rule in EGRESS mode, typically using TYPE = HOST_PORT, listing api.vendor-example.com:443, and then reference that network rule from the external access integration. This follows the principle of least privilege by allowing only the required host and port.
- B. Incorrect.
Incorrect. Network policies in Snowflake control how clients connect into Snowflake, such as restricting source IP addresses for user sessions. They do not control outbound traffic from a UDF or stored procedure to external services. This is a common confusion because both network policies and network rules involve network restrictions, but they apply to different traffic directions and use cases.
- C. Incorrect.
Incorrect. Ingress-related configuration is used for controlling inbound connectivity scenarios, not outbound calls from Snowflake code to external services. For a UDF calling a REST API, the destination must be defined in an EGRESS network rule. Choosing ingress here reflects a misunderstanding of the traffic direction involved in external access integrations.
- D. Incorrect.
Incorrect. Secret permissions are necessary so the code can retrieve credentials securely, but they do not grant network connectivity. External network access remains blocked unless the destination is explicitly allowed through a network rule and the relevant external access integration. Someone might choose this option if they assume authentication configuration alone enables the connection.