Snowflake encryption scenario

0
votes

I have a use case to encrypt the data while loading from S3 bucket to Snowflake tables. The S3 bucket is enabled with SSE-S3. The files in S3 is additionally encrypted using KMS key before they are pushed to S3 (which I like to call as double encryption). I wanted to understand how Snowflake works on decryption of these data files. To be specific, is the data in transit (while undergoing auto-ingest) also encrypted.

Secondly, if the external stage in Snowflake is configured with the same KMS key id encryption = (type = 'AWS_SSE_KMS' kms_key_id = 'xxxx-yyyy' will Snowflake decrypt the data files and make it readable upon querying the table on which the files are loaded?

Thanks in advance

1
encryptionsnowflake-cloud-data-platform

1 Answers

0
votes

Snowflake supports either client-side encryption or server-side encryption. Either can be configured to decrypt files staged in S3 buckets.

Client-side encryption:

AWS_CSE: Requires a MASTER_KEY value. The master key must be a 128-bit or 256-bit key in Base64-encoded form.

For more information, see the AWS documentation for client-side encryption. Note that for client-side encryption, Snowflake supports using a master key stored in Snowflake; using a master key stored in AWS Key Management Service (AWS KMS) is not supported.

Server-side encryption:

AWS_SSE_S3: Requires no additional encryption settings. AWS_SSE_KMS: Accepts an optional KMS_KEY_ID value.

For more information, see the AWS documentation for server-side encryption.

Using AWS Key Management Service (KMS) to manage keys requires configuring an IAM policy. For information, see the KMS documentation.

Details: https://docs.snowflake.com/en/user-guide/data-load-s3-encrypt.html#aws-data-file-encryption