An organization is migrating large datasets from on-premises storage to Snowflake using Snowball. Which TWO steps are mandatory to ensure the data is encrypted and accessible within the Snowflake account?
Trap 1: Use a public network connection to stream data directly into…
Snowball is specifically designed for environments where network throughput is insufficient for bulk data transfer. Relying on a public network defeats the purpose of utilizing a physical device for migration and does not fulfill the requirement of utilizing the secure Snowflake Snowball import workflow process.
Trap 2: Provide the encryption key to Snowflake support for decryption upon…
Snowflake does not handle decryption keys manually through support channels. The customer must use the key within the Snowflake SQL environment during the COPY command execution. Relying on manual intervention from support is not a supported or secure method for loading encrypted data into a target table.
Trap 3: Create a temporary internal stage to serve as an intermediary for…
Snowball data is loaded into an internal stage automatically as part of the ingestion process. Creating an additional intermediary stage adds unnecessary complexity and redundant storage costs, and it does not align with the standard workflow for importing physical device data directly into Snowflake destination tables.
- A
Encrypt the data using a customer-managed key before loading onto the Snowball device.
Mandatory encryption using a customer-managed key ensures that data remains unreadable by unauthorized parties during transit. Snowflake requires the specific encryption key to be provided during the loading process so that the data can be decrypted correctly when moved from the stage into the destination tables.
- B
Use a public network connection to stream data directly into Snowflake stages.
Why it fails: Snowball is specifically designed for environments where network throughput is insufficient for bulk data transfer. Relying on a public network defeats the purpose of utilizing a physical device for migration and does not fulfill the requirement of utilizing the secure Snowflake Snowball import workflow process.
- C
Provide the encryption key to Snowflake support for decryption upon device arrival.
Why it fails: Snowflake does not handle decryption keys manually through support channels. The customer must use the key within the Snowflake SQL environment during the COPY command execution. Relying on manual intervention from support is not a supported or secure method for loading encrypted data into a target table.
- D
Execute a COPY INTO command specifying the encryption key and the stage location.
The COPY INTO command must explicitly reference the stage that points to the imported Snowball data. By providing the encryption key in the command, the engine decrypts the data as it loads, ensuring that the target table receives the data in a clear-text or decrypted state.
- E
Create a temporary internal stage to serve as an intermediary for Snowball data.
Why it fails: Snowball data is loaded into an internal stage automatically as part of the ingestion process. Creating an additional intermediary stage adds unnecessary complexity and redundant storage costs, and it does not align with the standard workflow for importing physical device data directly into Snowflake destination tables.