SnowPro Specialty: Gen AI Question 76
Single answerREST APIsA team is building a customer-support assistant in Snowflake and needs to call an external LLM provider through a REST API from SQL. Security requires that API credentials are not hard-coded in application code, and networking requires outbound access to be explicitly controlled. The team also wants the SQL function to return only the model's text response to downstream queries. Which approach best satisfies these requirements?
- A
Create a network rule for the LLM provider endpoint, create a secret for the API credential, create an external access integration that references both, and implement the REST call in a Python UDF or stored procedure that reads the secret and returns the parsed response text.
- B
Store the API key in a regular Snowflake table, call the provider directly from a SQL UDF using the table value, and rely on Snowflake role-based access control alone to restrict outbound requests.
- C
Use a stage to store a JSON file containing the API key and endpoint URL, then invoke the REST API from a JavaScript UDF without configuring any external access objects because HTTPS traffic is allowed by default.
- D
Create an API integration and use it directly from a SQL scalar function to invoke the external LLM provider, because API integrations are the standard mechanism for outbound REST calls from UDFs.
Show answer and explanation
Correct answer: A
Explanation
The best-practice solution is to use Snowflake External Network Access for outbound REST API calls from supported handler code. In practice, this means defining a network rule to limit which external endpoints can be reached, storing the API credential in a Snowflake secret rather than hard-coding it, and creating an external access integration that permits the handler to use the approved network destinations and secrets. The handler code, commonly in a Python UDF or stored procedure, performs the HTTP request and extracts only the desired response field before returning it to SQL consumers. This pattern aligns with Snowflake guidance for secure external access from UDFs and procedures and is preferable to storing credentials in tables or stages. It also avoids confusion with API integrations, which serve different purposes than direct outbound REST calls from handler code.
- A. Correct.
Correct. For outbound calls from Snowflake handler code to external REST services, the supported pattern is to use External Network Access. This typically includes: a network rule that defines the allowed external host(s), a secret to securely store credentials such as an API key, and an external access integration that authorizes use of the network rule and secret. The REST call is then implemented in supported handler code such as a Python UDF or stored procedure, which can retrieve the secret securely and parse the JSON response so only the needed text is returned. This directly addresses security, controlled egress, and response shaping requirements.
- B. Incorrect.
Incorrect. Storing API keys in a regular table is not the recommended secure mechanism for secrets management in Snowflake for outbound external access. It also does not satisfy the requirement for explicitly controlled outbound networking. Role-based access control governs object access inside Snowflake, but it does not replace the need for network rules and an external access integration for outbound calls from handler code.
- C. Incorrect.
Incorrect. A stage is not the appropriate secret-management mechanism for API credentials in this scenario, and outbound HTTPS access is not implicitly open for UDFs or stored procedures. Snowflake requires explicit configuration for external network access. The misconception here is assuming that if the target is HTTPS, no additional egress controls are needed.
- D. Incorrect.
Incorrect. API integrations in Snowflake are used for specific integration patterns such as external functions or cloud storage/service integrations, but they are not the mechanism used by Python/Java/Scala handler code for direct outbound REST calls. For this use case, Snowflake documents External Network Access with network rules, secrets, and external access integrations.