@JCabralSAS - For the first two you have suggested, the pwencode will not work because the encoded password is framed inside the conopts command (java based). Neither will a macro variable when called inside the conopts command. So: PRIV_KEY_FILE_PWD={SAS002}706634535C9F3B793CCCB39C4F553FA2; <- will not be read by conopts nor PRIV_KEY_FILE_PWD=&password.; I tried using ODBC engine and while it works, you need to chmod the permissions for the odbc.ini path for users to read the file which means that they can get to the password using a terminal and running a command such as: cat /etc/odbc.ini and examine the odbc.ini file where the password is stored. For the third option you suggested users having their own private key files, this will be difficult to control from a security stand point. Normally, a username and password (snowflake account) is embedded in an authdomain and we assign AD groups to these authdomains. Similarly, if an RSA key is used, the key will be shared across an AD group else if each user has their own unique private key, these need to be mapped to the snowflake service account thru a jenkins pipeline job. In the end, this means that one snowflake service account gets mapped to multiple service keys instead of just one.
... View more
