SnowPro Advanced: Security Engineer Question 81
Single answerLeverage API authentication integrationsA security engineer needs to let a serverless application call the Snowflake SQL API without storing a Snowflake password or long-lived key material in the application. The company already uses an external OAuth 2.0 authorization server and wants short-lived access tokens issued by that provider to be accepted by Snowflake for API authentication. Which configuration should the engineer implement to meet this requirement?
- A
Create a SECURITY INTEGRATION of TYPE = EXTERNAL_OAUTH, configure the external issuer, audience, and token user mapping, then have the application obtain an OAuth access token from the external provider and present it to the SQL API.
- B
Create a SECURITY INTEGRATION of TYPE = API_AUTHENTICATION and use it directly for SQL API sign-in, because API authentication integrations replace OAuth for Snowflake programmatic access.
- C
Configure SCIM integration so the application can exchange SCIM bearer tokens for Snowflake session tokens when calling the SQL API.
- D
Use key-pair authentication for the application user, embed the private key in the serverless function, and rotate the key quarterly to satisfy the no long-lived credential requirement.
Show answer and explanation
Correct answer: A
Explanation
To let applications authenticate to Snowflake APIs with short-lived tokens from an external identity provider, the engineer should use an EXTERNAL_OAUTH security integration. This is the Snowflake feature designed for trusting and validating externally issued OAuth access tokens for access to Snowflake resources, including API-based access patterns. By contrast, API authentication integrations are intended for outbound authentication scenarios where Snowflake needs to authenticate to external API services, not inbound client authentication to Snowflake. SCIM is limited to provisioning, and key-pair authentication still relies on application-managed secret material. Snowflake documentation distinguishes these integration types clearly: EXTERNAL_OAUTH security integrations support external OAuth for client access to Snowflake, while API authentication integrations support OAuth and related authentication flows for external network access integrations and external service calls.
- A. Correct.
Correct. For Snowflake programmatic access using tokens issued by an external OAuth 2.0 provider, the correct pattern is to configure an EXTERNAL_OAUTH security integration. This lets Snowflake trust access tokens from the external authorization server after validating claims such as issuer and audience and mapping the token subject or another claim to a Snowflake user. The application then uses the bearer token when calling the SQL API, avoiding stored passwords and reducing reliance on long-lived secrets.
- B. Incorrect.
Incorrect. API authentication integrations are used to configure how Snowflake authenticates to external services' APIs, for example when Snowflake needs to obtain or use OAuth tokens to call an external endpoint. They are not the mechanism used by client applications to authenticate into Snowflake itself for SQL API access. For that use case, Snowflake supports mechanisms such as external OAuth, Snowflake OAuth, key-pair authentication, or programmatic access methods supported by the client/API.
- C. Incorrect.
Incorrect. SCIM integrations are for identity lifecycle management such as provisioning and deprovisioning users and roles, not for exchanging bearer tokens into Snowflake sessions for the SQL API. This distractor reflects a common confusion between identity provisioning and runtime authentication.
- D. Incorrect.
Incorrect. Key-pair authentication is a valid programmatic authentication method for some Snowflake clients, but embedding a private key in a serverless application still introduces managed key material that the scenario explicitly wants to avoid. Rotating quarterly does not make the credential short-lived. The requirement specifically states that short-lived tokens from the existing external OAuth provider should be accepted by Snowflake.