SnowPro Specialty: Gen AI Question 37
Single answerREST APIA data engineering team is building a Snowflake-native GenAI workflow that must call an external large language model provider from within Snowflake SQL. Security policy requires that credentials are not embedded in code, outbound access is restricted to approved destinations, and the API call must be reusable across multiple SQL statements. Which approach best meets these requirements?
- A
Create an external access integration to allow approved outbound network access, store the API credential in a secret, and invoke the REST API through a Python UDF or stored procedure that references both.
- B
Store the API key in a regular table, use a SQL UDF to concatenate the HTTP request, and let Snowflake route the request directly to the public endpoint without additional configuration.
- C
Create a stage containing a JSON file with the API key, then call the REST API from a JavaScript UDF because JavaScript UDFs can natively make outbound HTTP requests.
- D
Use a Streamlit in Snowflake app to call the external REST API, because Streamlit apps automatically inherit secure outbound access and can be invoked inline from any SQL query.
Show answer and explanation
Correct answer: A
Explanation
The best-practice Snowflake pattern for invoking an external REST API from within Snowflake is to use handler code, commonly Python, together with an external access integration and a secret. The external access integration restricts outbound traffic to approved network destinations, which satisfies governance requirements. Secrets keep credentials out of source code and support secure access at runtime. This approach is reusable because the Python UDF or stored procedure can be called from multiple SQL statements and workflows. This aligns with Snowflake documentation for external network access, secrets, and external access integrations, as well as secure design guidance for integrating with external services in GenAI workflows.
- A. Correct.
Correct. In Snowflake, calling an external REST API from handler code requires controlled outbound connectivity through an external access integration. Sensitive credentials should be managed with Snowflake secrets rather than embedded in code or stored in plain tables. A Python UDF or stored procedure is a practical reusable interface for SQL-based workflows that need to invoke the external service while complying with network and secret-management requirements.
- B. Incorrect.
Incorrect. This violates multiple best practices and platform requirements. API keys should not be stored in ordinary tables for runtime secret use, and Snowflake does not allow arbitrary direct HTTP calls from plain SQL UDF logic without the appropriate external access configuration. The misconception is that constructing an HTTP request string in SQL is sufficient to execute a network call.
- C. Incorrect.
Incorrect. Placing an API key in a staged file is not the recommended secure secret-management pattern for outbound API access. More importantly, JavaScript UDFs are not the standard mechanism for external network calls in this context. Snowflake's supported pattern for secure outbound REST access relies on external access integrations and secrets, typically used from supported handler runtimes such as Python.
- D. Incorrect.
Incorrect. Streamlit in Snowflake is useful for interactive applications, but it is not the right mechanism for a reusable SQL-invoked backend API integration. It also does not replace the need for proper outbound access controls and secret management for REST calls. The misconception here is treating Streamlit as a generic SQL-callable integration layer.