Enterprises using open-table formats increasingly face a trade-off between simpler managed storage and direct control of the keys protecting sensitive data. Snowflake has narrowed that gap by making customer-managed encryption generally available for its managed Apache Iceberg storage, adding a governance control without requiring organizations to run the underlying storage layer themselves.
For CIOs, that distinction matters as data platforms serve more teams, more external engines and more regulated workloads. A storage choice that reduces setup work but limits key control can complicate an organization’s security architecture and its separation-of-duties model.
Snowflake Inc. (NYSE: SNOW) said its Snowflake customer-managed encryption for Iceberg storage capability is available for accounts hosted on AWS or Azure. It lets qualified customers encrypt data written to a Snowflake-managed storage volume with a customer-managed key created in the applicable cloud key-management service. The feature applies to Snowflake storage for Apache Iceberg tables, where Snowflake stores and manages the table files and metadata internally.
The change matters for organizations that want to use Iceberg’s open table format while reducing the operational work of configuring and granting access to an external cloud-storage location. Snowflake recommends its managed-storage option for Snowflake-managed Iceberg tables, and its Horizon Catalog can expose those tables to external query engines as well as to Snowflake’s own query engine. That architecture can simplify data-platform operations, but it also makes encryption control a more important part of the service boundary.
The new option extends Snowflake’s Tri-Secret Secure model to those managed Iceberg volumes. Snowflake describes that model as combining a Snowflake-maintained key with a customer-managed key to create a composite master key for the account’s encryption-key hierarchy. The composite key protects the keys that ultimately encrypt data rather than directly encrypting raw files.
For teams adopting the capability, the implementation is not a one-click setting. Snowflake says administrators register, verify and activate a customer-managed key through dedicated system functions for Snowflake-managed volumes. Activation takes effect immediately for data written after the key is activated. The company also says the feature requires Business Critical Edition or higher, is not enabled by default and requires a request to Snowflake Support to enable it for an account.
Those limits keep the control squarely in a security-and-governance workflow. Snowflake’s documentation cautions that if a customer-managed key in the composite hierarchy is revoked, Snowflake can no longer decrypt the data. That gives enterprises stronger authority over access to their managed Iceberg data, but it also makes key lifecycle practices, separation of duties and recovery procedures central operational requirements.
The rollout is limited to AWS and Azure-hosted accounts. Snowflake-managed Iceberg storage is available on those platforms, while support for accounts hosted on Google Cloud remains in private preview, according to the company. Organizations with multicloud data estates will therefore need to account for the platform boundary when standardizing controls around Iceberg tables.
Snowflake’s new option does not remove the security obligations created by managed storage; it shifts a critical control to the customer while retaining the service’s operational convenience. Compared with the legacy choice between fully customer-managed external storage and provider-managed volumes under provider-controlled keys, enterprises can now pair managed Iceberg operations with a more direct encryption-control model—provided their key-management discipline is ready for the responsibility.