SnowPro Advanced: Security Engineer Question 96
Single answerUnderstand best practice recommendations for secure connectivity from Snowflake to external systems:A security engineer is reviewing how a Snowflake account accesses an external cloud storage location used by production pipelines. The team currently stores long-lived cloud provider access keys in application code and wants to reduce credential exposure while still allowing Snowflake to read and write only the required path in the bucket. Which approach is the MOST secure and aligned with Snowflake best practices for connectivity to external systems?
- A
Create a storage integration and grant the associated cloud IAM principal access only to the required bucket/path, then use that integration for the external stage.
- B
Embed the cloud storage access key and secret directly in the CREATE STAGE statement so Snowflake can authenticate without any extra cloud configuration.
- C
Use a Snowflake user with a strong password to connect to the bucket, because Snowflake usernames and passwords are easier to rotate than cloud IAM permissions.
- D
Create a network policy that allows only corporate IP addresses, and then continue using the existing long-lived cloud access keys in the pipeline code.
Show answer and explanation
Correct answer: A
Explanation
For secure connectivity from Snowflake to external systems, Snowflake best practices emphasize reducing or eliminating embedded secrets and using integrations that delegate authentication through the external platform's native security model. For cloud storage access, storage integrations are the preferred approach because they let Snowflake authenticate through a cloud IAM entity rather than static credentials. This supports centralized credential management, easier rotation, and stronger least-privilege controls. In this scenario, the additional requirement to limit access to only the necessary bucket/path further reinforces the need to scope the cloud IAM permissions narrowly. Relevant Snowflake guidance includes the documentation for storage integrations and external stages, which describes using integrations instead of directly supplying cloud credentials wherever possible.
- A. Correct.
Correct. A storage integration is the recommended Snowflake mechanism for secure access to supported cloud storage services such as Amazon S3, Google Cloud Storage, and Azure Blob Storage. It avoids embedding long-lived secrets in code or object definitions and instead relies on a cloud IAM trust relationship. Following least-privilege principles, the associated IAM role/service principal should be scoped only to the specific bucket or path required by the stage.
- B. Incorrect.
Incorrect. Although credentials can be specified directly in some stage definitions, embedding long-lived access keys in SQL objects increases secret exposure and operational risk. It also makes rotation harder and is not the preferred security model when storage integrations are available. This option reflects a common legacy pattern, not a best-practice recommendation.
- C. Incorrect.
Incorrect. External cloud storage does not authenticate with a Snowflake username and password. This option confuses Snowflake user authentication with authentication to an external system. Secure connectivity to external storage should use the cloud provider's IAM mechanisms through a Snowflake integration rather than Snowflake user credentials.
- D. Incorrect.
Incorrect. Network policies help restrict who can connect to Snowflake from specific IP addresses, but they do not secure Snowflake's authentication to external cloud storage. Continuing to rely on long-lived cloud keys in code does not address the main risk in the scenario. This option mixes an account access control with external system credential management.