Study guide
2.3 Cloud Storage Integrations & IAM Trust Policies
SnowPro Advanced: Architect ARA-C01
Track your progress as you read
Finished sections get a check mark.
1 Introduction: The ARA-C01 Exam
About the SnowPro Advanced: Architect (ARA-C01) Exam
2 Chapter 1: Account Strategy & Organization Architecture
1.1 Multi-Account Strategy & Snowflake Organizations 1.2 Snowflake Parameter Hierarchy & Configuration 1.3 Database and Schema Design Architecture
3 Chapter 2: Identity, Access Control & Storage Integrations
2.1 Role-Based Access Control Architecture & Hierarchy 2.2 Secondary Roles, Object Ownership & Delegated Administration 2.3 Cloud Storage Integrations & IAM Trust Policies 2.4 Identity Federation, SSO, SCIM & Authentication Policies
4 Chapter 3: Governance, Data Privacy, Network Security & Compliance
3.1 Column-Level Masking & Row Access Policies 3.2 Object Tagging, Tag-Based Masking & Audit Governance 3.3 Encryption, Key Management & Tri-Secret Secure 3.4 Aggregation Policies, Projection Policies & External Tokenization 3.5 Network Policies, Network Rules, External Access & Private Connectivity 3.6 Snowflake Editions & Compliance Architecture (PCI DSS, PII & PHI)
5 Chapter 4: Data Modeling in Snowflake
4.1 Dimensional Modeling: Star vs. Snowflake Schemas 4.2 Data Vault 2.0 Architecture in Snowflake 4.3 Relational Constraints & Query Optimizer Integration
6 Chapter 5: Data Sharing & Collaboration Solutions
5.1 Direct Data Sharing Architecture & Security 5.2 Managed Reader Accounts for External Consumers 5.3 Snowflake Marketplace, Data Exchange & Clean Rooms
7 Chapter 6: Multi-Cloud, Multi-Region & Business Continuity
6.1 Database & Account Replication Mechanics 6.2 Disaster Recovery Architecture & Client Redirect 6.3 Cross-Cloud Auto-Fulfillment & Listing Replication 6.4 Data Protection: Time Travel, Fail-safe & Storage Costs
8 Chapter 7: Environments, Lakehouse, DevOps & AI/ML Applications
7.1 Multi-Tier Environment Strategy & Zero-Copy Cloning 7.2 Data Lakehouse Architecture & Apache Iceberg 7.3 DataOps, CI/CD & Snowflake Git Integration 7.4 AI/ML Pipelines & Applications: Cortex AI, ML Functions, Snowpark Container Services, Streamlit & Native Apps
9 Chapter 8: Data Ingestion Architecture
8.1 Bulk Ingestion Architecture: COPY INTO Optimization 8.2 Snowpipe Continuous Automated Ingestion 8.3 Snowpipe Streaming & Real-Time Ingestion 8.4 Data Unloading Architecture & Cloud Export Patterns 8.5 Schema Detection, Schema Evolution & Source-Change Architecture
10 Chapter 9: Continuous Pipelines & Stream Transformation
9.1 Change Data Capture (CDC) with Snowflake Streams 9.2 Task Orchestration, DAGs & Serverless Scheduling 9.3 Declarative Data Pipelines with Dynamic Tables 9.4 Views, Materialized Views & Transformation Table Design
11 Chapter 10: Semi-Structured Data & Ecosystem Tooling
10.1 Semi-Structured Data: VARIANT, OBJECT & ARRAY Processing 10.2 Snowflake Ecosystem Connectors, Drivers & SQL API 10.3 Snowpark, User-Defined Functions & Stored Procedures
12 Chapter 11: Virtual Warehouse Architecture & Concurrency
11.1 Virtual Warehouse Architecture, Sizing & Credit Economics 11.2 Multi-Cluster Warehouses & Concurrency Scaling Policies 11.3 Warehouse Types & Query Acceleration Service
13 Chapter 12: Query Profiling & Performance Diagnostics
12.1 Query Profile Deep-Dive & Bottleneck Analysis 12.2 Memory Spilling, Warehouse Queuing & Timeout Governance 12.3 Three-Tier Caching Architecture & Result Reuse
14 Chapter 13: Storage Optimization, Cost Governance & Observability
13.1 Micro-Partitioning & Automatic Clustering 13.2 Search Optimization Service (SOS) & Point Lookup Acceleration 13.3 Resource Monitors, Financial Governance & Usage Observability 13.4 Warehouse Monitoring, Alerts, Event Tables & Performance Explorer
2.3 Cloud Storage Integrations & IAM Trust Policies
Key Takeaways Explain This Topic AI
Storage Integrations decouple Snowflake external stages from cloud credentials by establishing cryptographically verified, federated IAM trust relationships.
For AWS S3, Snowflake generates STORAGE_AWS_IAM_USER_ARN and STORAGE_AWS_EXTERNAL_ID, which must be configured in the AWS IAM Role trust relationship policy.
For Azure (Microsoft Entra ID), an administrator grants consent through AZURE_CONSENT_URL and assigns the Snowflake app Storage Blob Data Reader for load-only access or Storage Blob Data Contributor when Snowflake must also write (unload).
For Google Cloud Storage, Snowflake generates a dedicated service account (STORAGE_GCP_SERVICE_ACCOUNT) that must be granted bucket permissions, typically through a custom IAM role with get/list permissions for loading plus create/delete for unloading.
External stages linked to a storage integration are strictly confined by the integration's STORAGE_ALLOWED_LOCATIONS and STORAGE_BLOCKED_LOCATIONS path parameters.
Last updated: September 2026
2.3 Cloud Storage Integrations & IAM Trust Policies
In early cloud warehouse architectures, loading data from external cloud object storage (Amazon S3, Azure Blob / ADLS Gen2, Google Cloud Storage) required embedding explicit cloud credentials—such as AWS access keys, secret keys, or Azure SAS tokens—directly within SQL CREATE STAGE or COPY INTO commands. This legacy approach represented a severe security risk: credentials were often logged in plaintext in QUERY_HISTORY , lacked automatic rotation, and prevented unified auditing.
To establish enterprise-grade security, Snowflake utilizes Storage Integrations . A Storage Integration is a first-class, account-level Snowflake object that delegates identity verification and authorization directly to cloud hyperscaler Identity & Access Management (IAM) services. +-----------------------------------------------------------------------------------------+
- | Snowflake Cloud Platform |
- | |
- | +--------------------+ +-----------------------+ +------------------+ |
- | | Virtual Warehouse | ------> | External Named Stage | ------> | STORAGE | |
- | | (Compute Engine) | | (URL = 's3://...') | | INTEGRATION | |
- | +--------------------+ +-----------------------+ +------------------+ |
- +-----------------------------------------------------------------------------│-----------+
- │ (Cloud Trust)
- ▼
- +-----------------------------------------------------------------------------------------+
- | Cloud Hyperscaler (AWS / Azure / GCP) |
- | |
- | +------------------------+ Trust Relationship Handshake +-----------------+ |
- | | Hyperscaler IAM Role / | <====================================> | Secure Cloud | |
- | | Service Principal | (External ID / Tenant Consent) | Storage Bucket | |
- | +------------------------+ +-----------------+ |
- +-----------------------------------------------------------------------------------------+
- The AWS S3 Integration Architecture: The IAM Trust Handshake
Configuring an external stage pointing to Amazon S3 via a storage integration requires a strict, two-phase cryptographic handshake between Snowflake's underlying AWS account and the customer's AWS account. This prevents the classic Confused Deputy Problem in cloud multi-tenant architectures.
- The Complete AWS S3 Configuration Handshake -- Phase 1: Snowflake Admin creates the Storage Integration
- USE ROLE ACCOUNTADMIN;
- CREATE OR REPLACE STORAGE INTEGRATION s3_customer_data_int
- TYPE = EXTERNAL_STAGE
- STORAGE_PROVIDER = 'S3'
- ENABLED = TRUE
- STORAGE_AWS_ROLE_ARN = 'arn:aws:iam::123456789012:role/snowflake_s3_readwrite_role'
- STORAGE_ALLOWED_LOCATIONS = ('s3://mycompany-analytics-prod/raw/', 's3://mycompany-analytics-prod/stages/')
- STORAGE_BLOCKED_LOCATIONS = ('s3://mycompany-analytics-prod/raw/confidential/');
- - Phase 2: Inspect Snowflake-generated identity parameters
- DESC INTEGRATION s3_customer_data_int;
Executing DESC INTEGRATION outputs two non-configurable, dynamically generated property values that the AWS administrator must capture:
STORAGE_AWS_IAM_USER_ARN : The Amazon Resource Name of Snowflake's internal AWS identity (e.g., arn:aws:iam::987654321098:user/abc1-b-user ).
STORAGE_AWS_EXTERNAL_ID : A unique, account-and-integration-specific string generated by Snowflake (e.g., AB12345_SFCRole=2_a1b2c3d4... ). // Phase 3: Customer AWS Admin updates the AWS IAM Role Trust Relationship Policy
- {
- "Version": "2012-10-17",
- "Statement": [
- {
- "Sid": "SnowflakeAssumeRolePolicy",
- "Effect": "Allow",
- "Principal": {
- "AWS": "arn:aws:iam::987654321098:user/abc1-b-user"
- },
- "Action": "sts:AssumeRole",
- "Condition": {
- "StringEquals": {
- "sts:ExternalId": "AB12345_SFCRole=2_a1b2c3d4..."
- }
- }
- }
- ]
- } // Phase 4: AWS IAM Permissions Policy attached to snowflake_s3_readwrite_role
- {
- "Version": "2012-10-17",
- "Statement": [
- {
- "Effect": "Allow",
- "Action": [
- "s3:GetObject",
- "s3:GetObjectVersion",
- "s3:ListBucket",
- "s3:GetBucketLocation"
- ],
- "Resource": [
- "arn:aws:s3:::mycompany-analytics-prod",
- "arn:aws:s3:::mycompany-analytics-prod/*"
- ]
- },
- {
- "Effect": "Allow",
- "Action": [
- "s3:PutObject",
- "s3:DeleteObject",
- "s3:DeleteObjectVersion"
- ],
- "Resource": "arn:aws:s3:::mycompany-analytics-prod/stages/*"
- }
- ]
- }
- AWS KMS Encryption Configuration
If the S3 bucket is encrypted using AWS Key Management Service (AWS KMS) (Customer Managed Keys / CMK):
The IAM role ( STORAGE_AWS_ROLE_ARN ) must have an attached policy granting kms:Decrypt , kms:GenerateDataKey , and kms:DescribeKey .
The KMS Key Policy in AWS must explicitly grant permission to the target IAM role to perform cryptographic operations. Without this, queries against external stages return an access denied error during decryption.
Azure Blob & ADLS Gen2 Integration Architecture
Integrating Snowflake with Microsoft Azure Storage (Blob Storage or Azure Data Lake Storage Gen2) relies on Azure Active Directory (Microsoft Entra ID) Enterprise Applications and Service Principals.
- Step-by-Step Azure Integration Workflow -- Step 1: Create the Azure Storage Integration in Snowflake
- USE ROLE ACCOUNTADMIN;
- CREATE OR REPLACE STORAGE INTEGRATION azure_adls_int
- TYPE = EXTERNAL_STAGE
- STORAGE_PROVIDER = 'AZURE'
- ENABLED = TRUE
- AZURE_TENANT_ID = 'c1234567-89ab-cdef-0123-456789abcdef'
- STORAGE_ALLOWED_LOCATIONS = ('azure://myadlsaccount.blob.core.windows.net/telemetry/raw/');
- - Step 2: Retrieve the Consent URL and Application Name
- DESC INTEGRATION azure_adls_int;
Executing DESC INTEGRATION on an Azure integration exposes:
AZURE_CONSENT_URL : A dedicated Microsoft login URL containing a permissions consent request.
AZURE_MULTI_TENANT_APP_NAME : The Snowflake client application identifier registered within Azure (e.g., SnowflakePACProd... ). Azure Active Directory Handshake Flow:
- 1. DESC INTEGRATION -> Capture AZURE_CONSENT_URL
- 2. An Azure administrator navigates to AZURE_CONSENT_URL in a web browser
- 3. Administrator clicks "Accept" to grant Snowflake's Multi-Tenant App permission in the Azure Tenant
- 4. Azure Admin opens Azure Portal -> Storage Account / ADLS Container -> Access Control (IAM)
- 5. Role Assignment: Assign AZURE_MULTI_TENANT_APP_NAME the "Storage Blob Data Contributor" role
- Azure RBAC Roles: Reader vs Contributor
Storage Blob Data Reader: Sufficient if the Snowflake stage is read-only (used exclusively for COPY INTO <table> ingestion).
Storage Blob Data Contributor: Required when Snowflake must also write to the container (unloading with COPY INTO <location> , or purging loaded files).
Snowpipe auto-ingest on Azure is configured separately: a notification integration of TYPE = QUEUE with NOTIFICATION_PROVIDER = AZURE_STORAGE_QUEUE reads Event Grid messages from a storage queue, and its Snowflake app needs the Storage Queue Data Contributor role on that queue.
Exam Trap: Assigning Azure's built-in Reader or Contributor roles at the resource group level does NOT confer data-plane access. Snowflake requires the explicit Storage Blob Data... RBAC roles to read/write blobs.
Google Cloud Storage (GCS) Integration Architecture
Integrating Snowflake with Google Cloud Storage follows a streamlined model using Google Cloud IAM Service Accounts provisioned and managed by Snowflake. -- Step 1: Create the GCS Storage Integration
USE ROLE ACCOUNTADMIN;
- CREATE OR REPLACE STORAGE INTEGRATION gcs_lake_int
- TYPE = EXTERNAL_STAGE
- STORAGE_PROVIDER = 'GCS'
- ENABLED = TRUE
- STORAGE_ALLOWED_LOCATIONS = ('gcs://mygcp-lake-bucket/sensors/');
- - Step 2: Retrieve the Snowflake-generated GCP Service Account
- DESC INTEGRATION gcs_lake_int;
Inspecting the integration reveals STORAGE_GCP_SERVICE_ACCOUNT (e.g., v7abcd0000-sf@prod3-us-central1.iam.gserviceaccount.com ). GCP Cloud IAM Configuration:
- 1. Open GCP Console -> Cloud Storage -> Buckets -> Select 'mygcp-lake-bucket'
- 2. Navigate to Permissions Tab -> Grant Access
- 3. New Principal: Paste the value from STORAGE_GCP_SERVICE_ACCOUNT
4. Grant the service account a role with the needed permissions. Snowflake's documentation recommends a custom IAM role:
- Loading: storage.buckets.get, storage.objects.get, storage.objects.list
- Unloading and purging: add storage.objects.create and storage.objects.delete
Secure Stage Creation & Location Bounding
Once a storage integration is configured and the cloud IAM trust handshake is established, database administrators create External Named Stages that reference the integration, completely abstracting cloud credentials from end users. -- Creating an External Stage referencing a Storage Integration
USE ROLE SYSADMIN;
- CREATE OR REPLACE STAGE analytics_db.raw.s3_sensor_stage
- STORAGE_INTEGRATION = s3_customer_data_int
- URL = 's3://mycompany-analytics-prod/raw/sensors/'
- FILE_FORMAT = (TYPE = 'PARQUET' COMPRESSION = 'SNAPPY');
- - Granting access to the stage to an Access Role
- GRANT USAGE ON STAGE analytics_db.raw.s3_sensor_stage TO ROLE AR_ANALYTICS_INGEST;
- Stage Path Validation: Allowed vs Blocked Locations
Snowflake strictly enforces URL containment rules between the stage definition and the parent storage integration:
Containment Rule: The URL parameter of any stage linking to the integration must match or be an exact subpath of at least one path defined in STORAGE_ALLOWED_LOCATIONS .
Exclusion Rule: If the stage URL matches any path or subpath defined in STORAGE_BLOCKED_LOCATIONS , stage creation or execution fails immediately with an authorization violation.
Storage Integration Parameter Example Configuration Permitted Stage URL? Rationale
STORAGE_ALLOWED_LOCATIONS ('s3://prod-bucket/data/') s3://prod-bucket/data/orders/ Allowed: Subpath of permitted directory.
STORAGE_ALLOWED_LOCATIONS ('s3://prod-bucket/data/') s3://prod-bucket/logs/ Blocked: Path is outside allowed prefixes.
STORAGE_BLOCKED_LOCATIONS ('s3://prod-bucket/data/hr/') s3://prod-bucket/data/hr/salaries/ Blocked: Subpath of an explicitly blocked location.