Using Snowflake Data Sharing with Immuta
Audience: System Administrators, Governors, and Data Owners
Content Summary: This page describes the workflow of using Snowflake Data Sharing with Immuta project workspaces.
As you follow this tutorial, these callouts will have examples centered around the same use case and will further explain the steps necessary to meet the following compliance requirement:
Compliance Requirement: Users can only see data from their country.
1 - Create Immuta Policies
Use Case: Create Policies
The Immuta user will create a global data policy that restricts the rows users can see based on their
attributes, which identify their country. In the example below, users with the attribute
would only see rows that have
JP as a value in the
CREDIT POINT OF SALE column.
Using an attribute based access control (ABAC) model, build Immuta data policies using Immuta attributes and groups to fit your organization's compliance requirements.
2 - Create an Immuta Project
Use Case: Create Project
The Immuta user will create a project for the data share. In the example below, the user creates a Japan Data Share project that will only be shared with data consumers in Japan.
3 - Prepare the Project to Share
Because data consumers have the attribute "Country.JP", this will be the equalized entitlement added to the project. The Immuta user editing the equalized entitlement must also have the attribute "Country.JP" to ensure they have access to the data they will share.
A user with the same attributes or groups as the data consumer must edit the equalized entitlements to represent the appropriate attributes and groups of the data consumer.
4 - Create the Snowflake Data Share
Create the Snowflake Data Share pointing to the project workspace using the schema and role in the Native Snowflake Access section of the project information. Repeat this step for each data source you want to share.
The commands run in Snowflake should look similar to this:
CREATE SHARE "WORKSPACE_SCHEMA"; GRANT USAGE ON DATABASE "WORKSPACE_DATABASE" TO SHARE "WORKSPACE_SCHEMA"; GRANT REFERENCE_USAGE ON DATABASE "WORKSPACE_DATABASE" TO SHARE "WORKSPACE_SCHEMA"; GRANT USAGE ON SCHEMA "WORKSPACE_DATABASE"."WORKSPACE_SCHEMA" TO SHARE "WORKSPACE_SCHEMA"; GRANT SELECT ON VIEW "WORKSPACE_DATABASE"."WORKSPACE_SCHEMA"."DATA_SOURCE" TO SHARE "WORKSPACE_SCHEMA";