SnowPro Specialty: Gen AI Question 72
Single answerREST APIsA data engineering team is building a Snowflake Native App that lets analysts summarize support tickets by calling an external large language model through a REST API. The security team requires that API credentials are not embedded in application code, outbound access is restricted to only the approved provider endpoint, and calls must be made from SQL in Snowflake. Which Snowflake approach best meets these requirements?
- A
Store the API key in a table, then use a Python UDF to read the key and call the provider directly over the internet
- B
Create a network rule for the provider host, create a secret for the API credential, create an external access integration that references both, and use a function or procedure that accesses the secret
- C
Create an API integration and use it to invoke the REST API from a SQL SELECT statement without any additional objects
- D
Put the API key in a session variable and call the REST API through a standard external function without configuring outbound network access
Show answer and explanation
Correct answer: B
Explanation
The best answer is the pattern based on external network access: network rule + secret + external access integration + handler code that retrieves the secret securely. In Snowflake, this is the appropriate approach when code running in Snowflake, such as a Python or Java UDF/stored procedure, must call an external REST API. It satisfies three key operational requirements in the scenario: secure credential storage, restricted outbound destinations, and invocation from SQL.
Why not the alternatives:
- Secrets should not be stored in tables or session variables for this use case. Snowflake provides secret objects specifically for sensitive values.
- API integrations and external functions are a separate pattern typically used when routing through managed API infrastructure rather than making direct outbound REST calls from Snowflake runtime code.
Relevant Snowflake best-practice areas include documentation for external network access, network rules, secrets, and external access integrations. Candidates should recognize the distinction between calling external services through external functions versus using external network access from Snowpark-based handlers.
- A. Incorrect.
Incorrect. Storing API keys in a table is not the recommended secure pattern because it exposes sensitive credentials to broader data-plane access patterns and increases the risk of accidental disclosure. In addition, direct outbound internet access from handler code is not something you should assume is allowed without the proper Snowflake configuration. For calling external REST endpoints from Snowflake code, the supported secure pattern is to use external network access with secrets and an external access integration.
- B. Correct.
Correct. This is the recommended Snowflake pattern for calling external REST APIs from Snowpark code, stored procedures, or UDFs while meeting security requirements. A network rule restricts allowed egress destinations, a secret stores credentials securely, and an external access integration binds the allowed network locations and secrets. The function or procedure can then retrieve the secret at runtime instead of hardcoding credentials. This directly addresses the requirements for secure secret management, endpoint restriction, and SQL-driven invocation.
- C. Incorrect.
Incorrect. API integrations are associated with specific Snowflake capabilities such as external functions and certain service integrations, but they are not a drop-in mechanism that by themselves let SQL directly call arbitrary REST APIs. For direct outbound calls from handler code to an external REST endpoint, you need external network access objects such as a network rule, secret, and external access integration.
- D. Incorrect.
Incorrect. Session variables are not an appropriate secure store for API credentials, especially in shared or production workloads. Also, a standard external function does not avoid the need for proper integration setup; external functions require API Gateway/proxy-style infrastructure and an API integration, which is a different pattern from direct REST calls from Snowflake handler code. This option mixes concepts and fails the stated security and architecture requirements.