A data engineer needs to unload data from a Snowflake table to an external stage that references an Amazon S3 bucket. The engineer wants to ensure that the unloaded files are encrypted using a customer-managed key in AWS KMS. Which COPY INTO <location> parameter should be used to specify the KMS key?
When unloading to an external S3 stage, the ENCRYPTION parameter with TYPE = 'AWS_SSE_KMS' and MASTER_KEY set to the KMS key ARN enables server-side encryption with a customer-managed KMS key. This is the correct syntax to specify the KMS key for the unloaded files, ensuring they are encrypted as required.
Why this answer
To unload data to an external S3 stage with a customer-managed KMS key, the ENCRYPTION parameter must include TYPE = 'AWS_SSE_KMS' and MASTER_KEY set to the KMS key ARN. This ensures server-side encryption with the specified key. Other options either use S3-managed keys, Snowflake-managed encryption, or omit the necessary key parameter, failing to meet the requirement.
Exam trap
The trap here is confusing S3-managed encryption (AWS_SSE_S3) with customer-managed KMS encryption (AWS_SSE_KMS) and forgetting to include the MASTER_KEY parameter.