Question

A data engineering team runs an automated ELT pipeline using a dedicated Snowflake service account. Security policy prohibits interactive password prompts and requires MFA for all human logins, but the service account must authenticate non-interactively from a scheduled job. Which authentication method should the team configure for the service account, and what best practice applies?

Accepted Answer

Key pair authentication, generating an RSA key pair and periodically rotating keys using RSA_PUBLIC_KEY and RSA_PUBLIC_KEY_2

Answer

Password authentication with MFA enrolled, caching the MFA token in the job scheduler

Answer

SSO through the corporate identity provider, using the SAML assertion in the job configuration

Answer

OAuth with an interactive browser consent flow triggered at the start of each scheduled run