SnowPro Specialty: Gen AI Question 60
Single answerREST APIsA retail company built a customer-support workflow in Snowflake that summarizes long case notes with a third-party LLM exposed through a REST API. The workflow is implemented inside Snowflake and must process thousands of rows per hour. Security policy requires that API credentials are not embedded in SQL or application code, and the external service must be reachable only through approved network controls. Which approach best meets these requirements?
- A
Create an external access integration with a network rule for the API host, store the API credential in a Snowflake secret, and invoke the REST endpoint from a Python UDF or stored procedure using that secret.
- B
Store the API key in a Snowflake table, read it in a SQL query, and call the REST endpoint directly from a standard SQL statement for each row.
- C
Embed the API token as a string literal inside a Python UDF and allow outbound internet access by default, because Snowflake isolates execution environments automatically.
- D
Use a stage to store the API key in a text file and let Snowflake Cortex AISQL functions read the file and call the third-party REST endpoint.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake's supported external network access pattern: define a network rule for the approved REST API endpoint, create an external access integration, store the credential in a Snowflake secret, and call the service from supported handler code such as Python UDFs or stored procedures. This aligns with Snowflake best practices for secure outbound REST API access and credential handling. It also supports operational scalability better than ad hoc workarounds. Key concepts documented by Snowflake include external network access, secrets for credential storage, network rules for controlling allowed destinations, and using Python handlers when integrating with external services. Common misconceptions tested here are that SQL can directly call arbitrary REST endpoints, that secrets should be stored in tables or files, or that outbound internet access is implicitly unrestricted from Snowflake execution environments.
- A. Correct.
Correct. For outbound calls from Snowflake-hosted code to external REST services, Snowflake supports external network access through an external access integration combined with network rules and secrets. A Python UDF or stored procedure can retrieve the secret securely and use it to authenticate to the API. This approach satisfies the requirement to avoid hardcoding credentials and to restrict egress to approved destinations.
- B. Incorrect.
Incorrect. Snowflake SQL does not natively issue arbitrary REST calls directly from a standard SQL statement. In addition, storing API keys in a regular table is not the recommended security model for secrets management because it increases exposure and complicates least-privilege controls.
- C. Incorrect.
Incorrect. Hardcoding tokens in UDF code violates the stated security requirement and is a common anti-pattern. Also, outbound access is not simply open by default for this use case; Snowflake requires explicit configuration for external network access using integrations and network rules.
- D. Incorrect.
Incorrect. Stages are designed for file storage, not secure secret management for outbound API authentication in this pattern. Also, Cortex AISQL functions do not generally read API keys from staged files to call arbitrary third-party REST endpoints on your behalf.