A security team forbids storing cloud provider access keys in any SQL object and requires that an external stage reach an Amazon S3 bucket using a managed identity rather than embedded credentials. Which Snowflake object lets the external stage authenticate to the bucket this way?
- AA file format object, because the file format holds the cloud identity used to reach the bucket so the external stage can authenticate to S3 without keys in the stage definition
- BA network policy, because attaching the bucket to a network policy grants the external stage an identity-based path to S3 that avoids placing access keys in the stage
- CA secure view over the bucket, because defining the external stage on top of a secure view lets Snowflake reach S3 through a managed role instead of embedded credentials
- DA storage integration, because it references a cloud IAM role so the external stage authenticates to S3 through that managed identity with no access keys stored in the stage Correct
Why A is wrong: A file format only describes how to parse files and carries no cloud credentials or identity, so it cannot authenticate the stage to S3 as claimed.
Why B is wrong: A network policy restricts inbound IP ranges to the account and has no role in cloud storage authentication, so it cannot provide the identity-based access described.
Why C is wrong: A secure view controls access to query results inside Snowflake and cannot be placed over a bucket, so it offers no path to authenticate an external stage.
Why D is correct: A storage integration delegates to a cloud IAM role and keeps credentials out of the stage definition, which is precisely the keyless managed-identity access the security team requires.