SnowPro Associate: Platform Question 304
Single answer● Use of Pre-signed URLsA data engineering team stores daily partner extracts in an internal named stage in Snowflake. An external partner needs to download a specific file one time without being granted direct Snowflake access or cloud storage credentials. The team wants the simplest secure approach that allows temporary access to just that file. Which Snowflake feature should they use?
- A
Generate a pre-signed URL for the staged file and send the URL to the partner
- B
Create a storage integration for the partner so they can access the file directly in cloud storage
- C
Grant the partner USAGE on the stage and SELECT on the source table so they can download the file through Snowflake
- D
Create a secure view over the staged file and share it with the partner using Secure Data Sharing
Show answer and explanation
Correct answer: A
Explanation
Pre-signed URLs are the best fit when a staged file must be shared temporarily with someone who does not have Snowflake access. In Snowflake, a pre-signed URL can be generated for files in stages backed by supported cloud storage, enabling controlled, time-limited access to the exact file. This aligns with the principle of least privilege because the recipient gets access only to that file for a limited time, rather than broad access to a stage, Snowflake account, or cloud storage environment. By contrast, storage integrations are for Snowflake's access to external storage, grants on stages require Snowflake users and privileges, and Secure Data Sharing is for database objects rather than file downloads. Snowflake documentation on stages and GET_PRESIGNED_URL describes this capability and its intended use for temporary file access.
- A. Correct.
Correct. A pre-signed URL provides time-limited access to a specific file in a stage-backed cloud storage location without requiring the recipient to have Snowflake credentials or direct cloud provider credentials. This is the practical choice when a team needs to let an external party download a staged file temporarily and with minimal setup.
- B. Incorrect.
Incorrect. A storage integration is used by Snowflake to securely access external cloud storage on behalf of Snowflake, not as a lightweight way to grant an external partner one-time access to a single file. It is more administrative overhead and does not directly solve the requirement of sending a temporary download link to a non-Snowflake user.
- C. Incorrect.
Incorrect. Granting stage access would require the external partner to have a Snowflake user/account and appropriate privileges. The scenario explicitly says the partner should not be granted direct Snowflake access. Also, SELECT on the source table is unrelated to downloading an already staged file.
- D. Incorrect.
Incorrect. Secure Data Sharing is for sharing database objects such as tables, views, and secure views between Snowflake accounts. It is not the mechanism for sharing a single staged file for direct download. A staged file is not exposed through a secure view in the way described.