this machine is disabled for file encryption

The encrypted random key is stored with the file’s metadata. The random encryption key, in turn, is encrypted with the customer’s master key.īoth the encrypted file and the encrypted random key are uploaded to the cloud storage service. The client (provided by the cloud storage service) generates a random encryption key and encrypts the file before uploading it into cloud storage.

The Snowflake customer creates a secret master key, which remains with the customer. No third-party service can see data in the clear. The runtime components decrypt the data in memory for query processing. Only the user and the Snowflake runtime components can read the data. In all of these steps, all data files are encrypted. The user downloads data files from the stage and decrypts the data on the client side. Results are optionally encrypted using client-side encryption when unloaded into a customer-managed stage, and are automaticallyĮncrypted when unloaded to a Snowflake-provided stage.

Query results can be unloaded into a stage. In Snowflake, all data at rest is always encrypted. The data is transformed into Snowflake’s proprietary file format and stored in a cloud storage container (“data at rest”). The user loads the data from the stage into a table. Snowflake) stage (option B), data files are automatically encrypted by the client on the local machine prior to being transmitted to the internal stage. We recommend client-side encryption for data files staged external to Snowflake but if the data is not encrypted, Snowflake immediately encrypts the data when it is loaded into a table. If the stage is a customer-managed container in a cloud storage service (option A), the user may optionally encrypt the data files using client-side encryption (see Client-Side Encryption for more information). A user uploads one or more data files to a stage.

This machine is disabled for file encryption