title: What is the use of encryption option for snowflake external stages?
body: <p><strong>In short:</strong></p>
  <p>Snowflake provides encryption option when we are creating an external stage. Below are the options (from <a href="https://docs.snowflake.com/en/sql-reference/sql/create-stage.html" rel="nofollow noreferrer">https://docs.snowflake.com/en/sql-reference/sql/create-stage.html</a>)</p>
  <pre><code>[ ENCRYPTION = ( [ TYPE = 'AWS_CSE' ] [ MASTER_KEY = '&lt;string&gt;' ] |
                     [ TYPE = 'AWS_SSE_S3' ] |
                     [ TYPE = 'AWS_SSE_KMS' [ KMS_KEY_ID = '&lt;string&gt;' ] |
                     [ TYPE = NONE ] ) ]
  </code></pre>
  <p>While we know AWS_CSE is used for client-side encryption (where data in encrypted/decrypted by client using Customer Owned Master key respectively during put/get into/from snowflake external stages), what is the use of AWS_SSE_S3 and AWS_SSE_KMS options?</p>
  <p><strong>In detail:</strong></p>
  <p>In our scenario, we have an S3 bucket (OUR_S3_BUCKET) with encryption set at bucket level as SSE-KMS, created an incoming directory and uploaded a file covid_data.csv.</p>
  <pre><code>S3://OUR_S3_BUCKET/incomig/covid_data.csv.
  </code></pre>
  <p>To access this file, we have created storage integration by referring to the S3 bucket and have created three external stage in Snowflake.</p>
  <pre><code>EXTERNAL STAGE 1 (without encryption):
  
  CREATE OR REPLACE STAGE TEST_STG_NOENC
  URL='S3://OUR_S3_BUCKET/incomig/'
  STORAGE_INTEGRATION = INBOUND_S3;
  
  EXTERNAL STAGE 2 (with AWS_SSE_S3):
  
  CREATE OR REPLACE STAGE TEST_STG_SSE_S3
  URL='S3://OUR_S3_BUCKET/incomig/'
  STORAGE_INTEGRATION = INBOUND_S3
  ENCRYPTION = ( TYPE = 'AWS_SSE_S3');
  
  EXTERNAL STAGE 3 (with AWS_SSE_MKS):
  
  CREATE OR REPLACE STAGE TEST_STG_SSE_KMS
  URL='S3://OUR_S3_BUCKET/incomig/'
  STORAGE_INTEGRATION = INBOUND_S3
  ENCRYPTION = ( TYPE = 'AWS_SSE_KMS'  KMS_KEY_ID = 'arn:aws:kms:region:account_no:key/KMS_KEY_ID');
  </code></pre>
  <p>We are able to access the covid_data.csv data by selecting from all three external stages.</p>
  <pre><code>select t.$1, t.$2, t.$3
      from @&lt;&lt;All 3 external stages&gt;&gt; (file_format =&gt; OUR_CSV_FILE_FORMAT ) t;
  </code></pre>
  <p>Even though our S3 bucket is encrypted using SSE_KMS, we are able to access the files using a stage (TEST_STG_NOENC) without encryption option.</p>
  <p>In these scenario, what is the use of AWS_SSE_S3 and AWS_SSE_KMS encryption options and how it helps?</p>