SnowPro Specialty: Gen AI Question 71
Single answerREST APIsA data engineering team is building a Snowflake-based GenAI application that must call an external large language model through a REST API from inside Snowflake SQL. The security team requires that API credentials are not hard-coded in SQL, outbound access is restricted to only the approved provider endpoint, and developers should be able to invoke the API from SQL functions in a governed way. Which Snowflake approach best meets these requirements?
- A
Create an external access integration to allow the approved network destination, store the API credential in a secret, and reference both from a user-defined function or procedure that makes the REST call
- B
Store the API key in a Snowflake table, then use a Python UDF to read the key and call any HTTPS endpoint needed at runtime
- C
Embed the API key directly in the SQL statement and use a SQL UDF, because SQL UDFs natively perform arbitrary REST requests without additional configuration
- D
Create an API integration and use it directly from a Python UDF for outbound REST calls to the LLM provider
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use an external access integration plus a secret, referenced by handler code in a Snowflake UDF or stored procedure. This is the Snowflake pattern for secure outbound REST API access from Snowflake-managed code. It lets administrators explicitly control which external network locations are reachable and keeps sensitive credentials out of SQL text and source code. This is especially important in GenAI workloads where developers often call model inference endpoints hosted outside Snowflake. A common misconception is to use API integrations for any external call, but for direct outbound requests from Python/Java handlers, Snowflake documentation points to external network access with external access integrations and secrets. Another common mistake is storing API keys in tables or hard-coding them in SQL, both of which weaken security and governance. Candidates should recognize the distinction between secure outbound REST access patterns and other Snowflake integration constructs when designing GenAI applications.
- A. Correct.
Correct. For outbound calls from Snowflake handler code to external services, Snowflake uses external network access controls through an external access integration. Secrets are used so credentials such as API keys are not embedded in code. A UDF or stored procedure can then reference the allowed integration and secret to make the REST API call in a governed way. This aligns with the stated requirements: no hard-coded credentials, restricted outbound destinations, and SQL-accessible invocation.
- B. Incorrect.
Incorrect. Storing API keys in a table does not provide the intended secret-management pattern and increases the risk of credential exposure through queries, grants, or accidental logging. In addition, outbound access should not be open to any HTTPS endpoint at runtime. Snowflake expects approved external connectivity to be governed through an external access integration and secrets, not ad hoc key retrieval from tables.
- C. Incorrect.
Incorrect. Embedding the API key directly in SQL violates the security requirement. Also, SQL UDFs do not natively issue arbitrary REST API requests on their own. External REST access from Snowflake code requires the appropriate external network access configuration and supported handler language pattern, rather than plain SQL alone.
- D. Incorrect.
Incorrect. API integrations in Snowflake are used for specific integration scenarios such as external functions, cloud storage, or other supported integrations, but they are not the mechanism used by Python UDFs or procedures for direct outbound REST calls. For this use case, the relevant feature is external access integration combined with secrets.