SnowPro Advanced: Security Engineer Question 87
Single answerLeverage Snowflake secrets for secure authentication with external endpoints:A security engineer needs to let a Python UDF call an external tokenization service over HTTPS without hardcoding credentials in code or storing them in a table. The UDF should use Snowflake-managed objects to securely store the API credential and only allow outbound calls to the approved host. Which implementation best meets these requirements?
- A
Create a SECRET to store the API credential, create a NETWORK RULE that allows the tokenization service host, create an EXTERNAL ACCESS INTEGRATION that references the network rule and the secret, and configure the Python UDF to use that external access integration and secret.
- B
Store the API key in a secure view accessible only to the UDF owner, and create an EXTERNAL ACCESS INTEGRATION that references the HTTPS endpoint directly without a network rule.
- C
Encrypt the API key with a Snowflake key, store the ciphertext in an internal stage, and let the Python UDF decrypt it at runtime before calling the external endpoint.
- D
Create a SECURITY INTEGRATION for the tokenization service credentials and attach it directly to the Python UDF, because security integrations are the supported mechanism for outbound authentication from handler code.
Show answer and explanation
Correct answer: A
Explanation
The best-practice design is to use Snowflake secrets together with external network access. In Snowflake, outbound calls from Python UDFs and procedures are controlled through an EXTERNAL ACCESS INTEGRATION, which references one or more NETWORK RULE objects defining allowed destinations and can allow specific SECRET objects for authentication. This provides two important security controls: credentials are stored outside code in a managed secret object, and egress is limited to explicitly approved external hosts. This is preferable to storing credentials in tables, views, stages, or source code. Snowflake documentation for external network access and secrets describes using NETWORK RULE, SECRET, and EXTERNAL ACCESS INTEGRATION together for secure authentication to external endpoints.
- A. Correct.
Correct. For handler code such as Python UDFs or stored procedures to call external endpoints securely, Snowflake uses external network access with three main components: a NETWORK RULE to define allowed destinations, a SECRET to store authentication material, and an EXTERNAL ACCESS INTEGRATION to bind approved network locations and allowed secrets. The UDF then references the integration and secret so credentials are not embedded in code and outbound access is restricted to approved hosts.
- B. Incorrect.
Incorrect. Storing an API key in a view does not use Snowflake secrets and increases exposure risk because the credential is represented as queryable data rather than a purpose-built secret object. In addition, external network access requires a NETWORK RULE; the integration does not simply reference an arbitrary endpoint directly without one.
- C. Incorrect.
Incorrect. Although encrypting sensitive data is a common pattern elsewhere, this is not the Snowflake-recommended mechanism for outbound authentication from UDF handler code. The question specifically requires Snowflake-managed objects for secure credential storage and endpoint restriction. SECRET objects and EXTERNAL ACCESS INTEGRATION are the supported design, whereas custom ciphertext management in a stage adds complexity and does not provide the native control model expected for external access.
- D. Incorrect.
Incorrect. SECURITY INTEGRATION objects are used for specific security-related integrations such as SSO, SCIM, API authentication patterns, and other external security configurations, but they are not the object used by Python UDF handler code to retrieve outbound API credentials for arbitrary HTTPS calls. For this use case, Snowflake secrets plus external access integration are the correct mechanism.