Register a Snowflake Connection

Register your Snowflake data

New connections

The new connections flow documented here is available and released to select tenants.

Requirements

• APPLICATION_ADMIN Immuta permission
• The Snowflake user registering the connection and running the script must have the following privileges:

  • CREATE DATABASE ON ACCOUNT WITH GRANT OPTION
  • CREATE ROLE ON ACCOUNT WITH GRANT OPTION
  • MANAGE GRANTS ON ACCOUNT WITH GRANT OPTION

Set up the Immuta system account

Complete the following actions in Snowflake:

1. Create a new user in Snowflake to be the Immuta system account. Immuta will use this system account continuously to orchestrate Snowflake policies and maintain state between Immuta and Snowflake.
2. Create a Snowflake role with a minimum of the following privileges:

   • USAGE on all databases and schemas with registered data sources.
   • REFERENCES on all tables and views registered in Immuta.
   • SELECT on all tables and views registered in Immuta.
3. Grant the new Snowflake role to the system account you just created.

Register a connection

To register a Snowflake connection, follow the instructions below.

1. Click Data and select the Connections tab in the navigation menu.
2. Click the + Add Connection button.
3. Select the Snowflake data platform tile.
4. Enter the connection information:

   • Display Name: The display name represents the unique name of your connection and will be used as prefix in the name for all data objects associated with this connection. It will also appear as the display name in the UI and will be used in all API calls made to update or delete the connection. Avoid the use of periods (.) or restricted words in your connection name.
   • Host: The URL of your Snowflake account.
   • Port: Your Snowflake port.
   • Warehouse: The warehouse the Immuta system account user will use to run queries and perform Snowflake operations.
   • Role: Enter the role with the listed privileges.
   • Immuta Database: The new, empty database for Immuta to manage. The script in the last step of registering the connection will create this database. This is where system views, user entitlements, row access policies, column-level policies, procedures, and functions managed by Immuta will be created and stored.
5. Opt to configure an HTTP proxy for this connection by selecting Enable and entering the required details:

   • Proxy Host: Enter the full proxy URL.
   • Proxy Port: Enter the proxy port.
   • Proxy Username: Enter the username for the proxy connection.
   • Proxy Password: Enter the password for the proxy connection.
6. Select an authentication method from the dropdown menu and enter the authentication information for the Immuta system account you created.

OAuth M2M (Client Secret)

1. Fill out the Client ID, which is the subject of the generated token. It is also known as sub (subject).
2. Fill out the Authority URL, which is the authority URL of your identity provider.
3. Fill out the Scope, which is the scope of operations and roles allowed by the secret. Use session:role-any.
4. Fill out the Client Secret, which is the client secret Immuta will use to connect to your application.

OAuth M2M (Certificate)

1. Fill out the Client ID, which is the subject of the generated token. It is also known as sub (subject).
2. Fill out the Authority URL, which is the authority URL of your identity provider.
3. Fill out the Scope, which is the scope of operations and roles allowed by the secret. Use session:role-any.
4. Enter the Certificate Thumbprint. This identifies the corresponding key to the token and is often abbreviated as x5t or is called kid (key identifier).
5. Opt to fill out the Resource field with a URI of the resource where the requested token will be used.
6. Upload the Private Key, which is the client certificate that is used to sign the authorization request.

Key Pair (Unencrypted)

1. Complete the Username field. This user must be assigned the public key in Snowflake.
2. Click Private Key, and upload the Snowflake private key pair file.

Key Pair (Encrypted)

1. Complete the Username field. This user must be assigned the public key in Snowflake.
2. Click Private Key, and upload the Snowflake private key pair file.
3. When using an encrypted private key, enter the Password.

1. Click Next.
2. Configure the Policy settings:

   1. Opt to enable Impersonation. If you enable it, enter the Impersonation Role that will be used to impersonate other users in Snowflake.
   2. Opt to exclude specific users from policy by adding them to the Exclude User Group Pattern. This field cannot be changed after the connection is created.
3. Click Next.
4. Opt to Enable Audit.
5. Click Next.
6. Opt to Enable Object Sync, which will keep your connection objects up to date with your Snowflake environment.

   1. Select the Start Time for when the first object sync job will run each day.
   2. Select the Run Frequency to determine how frequently object sync will run each day.
   3. Opt to Run Object Sync on Create to create all the data objects for your connection. If you do not select this option, you must run object sync manually or wait for the scheduled object sync for your connection's data objects.
7. Click Save connection.
8. Copy the provided script and run it in Snowflake as a user with the privileges listed in the requirements section. Running this script grants the following privileges to the Immuta system account and creates the new Immuta database in Snowflake:

   1. CREATE ROLE ON ACCOUNT WITH GRANT OPTION
   2. MANAGE GRANTS ON ACCOUNT WITH GRANT OPTION
   3. APPLY MASKING POLICY ON ACCOUNT WITH GRANT OPTION
   4. APPLY ROW ACCESS POLICY ON ACCOUNT WITH GRANT OPTION
9. Click Validate Connection.
10. If the connection is successful, click Finish. If there are any errors, check the connection details and credentials to ensure they are correct and try again.