SnowPro Associate: Platform Question 307
Single answer● Use of Pre-signed URLsA data engineering team stores CSV files in an external Amazon S3 stage used by Snowflake. A business analyst needs to download one specific file directly from the stage for a one-time review, but the analyst should not be granted direct S3 access or broad stage privileges. Which Snowflake feature is the best fit for this requirement?
- A
Generate a pre-signed URL for the staged file so the analyst can download it temporarily without direct cloud storage credentials
- B
Grant the analyst OWNERSHIP on the stage so they can access the file through the cloud provider console
- C
Create a permanent secure share that exposes the file in the external stage to the analyst
- D
Use Time Travel to retrieve the file version and send the analyst the query ID
Show answer and explanation
Correct answer: A
Explanation
The best solution is to generate a pre-signed URL for the specific file. In Snowflake, pre-signed URLs provide temporary access to staged files and are commonly used when a user needs to download a file without being granted direct access to the underlying cloud storage account. This aligns with security best practices by limiting access scope and duration. The key applied concept is that pre-signed URLs solve a file distribution problem for staged data, while alternatives like broad privilege grants, secure sharing, or Time Travel address different use cases. This matches Snowflake documentation and best practices around stages, file access, and least-privilege access control.
- A. Correct.
Correct. A pre-signed URL is designed for temporary, controlled access to a specific staged file without requiring the recipient to have direct credentials for the underlying cloud storage. This is a practical way to let someone download a file from an external or internal stage for a limited time.
- B. Incorrect.
Incorrect. Granting OWNERSHIP on the stage is excessive and violates least-privilege principles. It would provide broad control over the stage rather than temporary access to a single file. Also, Snowflake stage privileges do not simply translate into direct cloud console access for the analyst.
- C. Incorrect.
Incorrect. Secure data sharing is used to share database objects such as tables, secure views, and certain other Snowflake objects across accounts. It is not the mechanism for giving a user a temporary downloadable link to one staged file.
- D. Incorrect.
Incorrect. Time Travel is used to access historical data versions for supported Snowflake objects such as tables, schemas, and databases. It is not used to generate downloadable links for files in a stage, and a query ID would not provide file download access.