SnowPro Advanced: Security Engineer Question 97
Single answerUnderstand best practice recommendations for secure connectivity from Snowflake to external systems:A financial services company uses Snowflake external stages to exchange regulated report files with an Amazon S3 bucket owned by a partner. The security team wants to reduce exposure of long-lived cloud credentials, ensure Snowflake can access only the required bucket location, and follow Snowflake best practices for secure connectivity to external systems. Which approach should the Snowflake security engineer recommend?
- A
Create an S3 storage integration in Snowflake, allow only the required S3 locations, and have the partner grant access to the Snowflake-generated AWS IAM user/role for that integration.
- B
Embed the partner's AWS access key ID and secret access key directly in the CREATE STAGE statement so Snowflake can authenticate without additional setup.
- C
Store the partner's AWS credentials in a table protected by masking policies, then use a task to dynamically inject them into COPY commands when needed.
- D
Use a password policy on Snowflake users that access the stage, because stronger Snowflake passwords are the primary control for securing Snowflake-to-S3 connectivity.
Show answer and explanation
Correct answer: A
Explanation
The best-practice recommendation is to use a storage integration for external cloud storage access. In AWS, this lets Snowflake assume access through a Snowflake-generated IAM principal instead of requiring hard-coded access keys in the stage definition. This reduces exposure to long-lived credentials and supports stronger separation of duties and easier credential governance. Limiting the integration to approved locations aligns with least-privilege design. Snowflake documentation for storage integrations and external stages consistently recommends integrations over directly supplied credentials when supported, especially for secure connectivity to external systems such as S3.
- A. Correct.
Correct. For secure connectivity from Snowflake to Amazon S3, Snowflake recommends using a storage integration rather than embedding cloud credentials in stage definitions. A storage integration uses a Snowflake-generated IAM principal and a trust relationship in AWS, which reduces the use of long-lived secrets. Restricting the integration to specific allowed locations also enforces least privilege by limiting access to only the required bucket path.
- B. Incorrect.
Incorrect. Embedding AWS access keys in a stage is less secure because it relies on long-lived static credentials that are harder to rotate, audit, and protect. This approach increases secret management risk and is not Snowflake best practice when a storage integration is available.
- C. Incorrect.
Incorrect. Masking policies protect query results, not secret management for external connectivity. Storing cloud credentials in a table and injecting them into commands still leaves the organization dependent on long-lived secrets and creates operational and audit risk. This is not a recommended pattern for securing Snowflake access to external cloud storage.
- D. Incorrect.
Incorrect. Password policies apply to Snowflake user authentication, not to Snowflake's authorization path for accessing S3. Even if user authentication is strong, it does not address the security of Snowflake-to-S3 connectivity. The main control here is secure cloud authentication and least-privilege access via a storage integration.