Connect a Snowflake Host with Username and Password

This page details how to use the /data v1 API to connect a Snowflake host to Immuta using username and password authentication. This connection works with a single set of credentials rather than configuring an integration and registering data sources separately. To manage your host, see the Manage a host reference guide.

Requirements

To complete this guide, you must be a user with the following:

  • Immuta permissions:

    • APPLICATION_ADMIN

    • CREATE_DATA_SOURCE

  • Snowflake permissions:

    • CREATE DATABASE ON ACCOUNT WITH GRANT OPTION

    • CREATE ROLE ON ACCOUNT WITH GRANT OPTION

    • CREATE USER ON ACCOUNT WITH GRANT OPTION

    • MANAGE GRANTS ON ACCOUNT WITH GRANT OPTION

    • APPLY MASKING POLICY ON ACCOUNT WITH GRANT OPTION

    • APPLY ROW ACCESS POLICY ON ACCOUNT WITH GRANT OPTION

Complete the following steps to connect a Snowflake host:

  1. Use the /integrations/scripts/create endpoint to receive a script.

  2. Run the script in Snowflake.

  3. Use the /data/connection endpoint to finish creating the connection to your host and Immuta.

Step 1: Generate the script

POST /integrations/scripts/create

Copy the request and update the <placeholder_values> with your connection details. Then submit the request.

Find descriptions of the editable attributes in the table below and of the full payload in the Integration configuration payload reference guide. All values should be included and those you should not edit are noted.

curl -X 'POST' \
    'https://<your-immuta-url>/integrations/scripts/create' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
    "": "Snowflake",
    "": false,
    "config": {
      "host": "<your-Snowflake-hostname-url>",
      "warehouse": "<your-Snowflake-warehouse>",
      "database": "<your-Snowflake-database>",
      "": {"enabled": true},
      "": {"enabled": false},
      "": {"enabled": false},
      "": "userPassword",
      "username": "<new-Snowflake-username>",
      "password": "<new-Snowflake-password>"
    }
    }'

Payload parameters

AttributeDescriptionRequired

config.host string

The URL of your Snowflake account.

Yes

config.username string

The new username of the system account that can act on Snowflake objects and configure the host. The system account will be created by the script in step two.

Yes

config.password string

The password of the system account that can act on Snowflake objects and configure the host. The system account will be created by the script in step two.

Yes

config.warehouse string

The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.

Yes

config.database string

Name of a new empty database that the Immuta system user will manage and store metadata in.

Yes

Step 2: Run the script in Snowflake

Step one will return a script. Copy the script and run it in your Snowflake environment as a user with the permissions listed in the requirements section.

The script will create an Immuta system user that will authenticate using the username and password you specified in step one. This new system user will have the permissions listed on the Snowflake integration reference guide. Additionally, the script will create the database you specified in step one.

Step 3: Create the host in Immuta

POST /data/connection

Copy the request and update the <placeholder_values> with your connection details. Note that the connection details here should match the ones used in step one. Then submit the request.

Find descriptions of the editable attributes in the table below and of the full payload in the Snowflake object table. All values should be included and those you should not edit are noted.

Test run

Opt to test and validate the create connection payload using a dry run:

POST /data/connection/test

curl -X 'POST' \
    'https://<your-immuta-url>/data/connection' \
    -H 'accept: application/json' \
    -H 'Content-Type: application/json' \
    -H 'Authorization: <your-bearer-token>' \
    -d '{
     connectionKey: "<your-connection-key-name>",
     : {
       : "Snowflake",
       hostname: "<your-Snowflake-hostname-url>",
       port: <your-Snowflake-port>,
       warehouse: "<your-Snowflake-warehouse>",
       role: "<your-Snowflake-role>",
       : "userPassword",
       username: "<your-Snowflake-username>",
       password: "<your-Snowflake-password>",
     },
     settings: {
         : false
     },
     options: {
       : true
     },
     : {
       : "Snowflake",
       : false,
       config: {
         : "userPassword",
         : "<your-Snowflake-username>",
         : "<your-Snowflake-password>",
         : "<your-Snowflake-hostname-url>",
         : <your-Snowflake-port>,
         : "<your-Snowflake-warehouse>",
         : "<your-Snowflake-database>",
         : { enabled: false },
         : { enabled: true },
         : { enabled: false },
         : { enabled: false },
         : { exclude: [] }
       }
     }
    }'
    

Payload parameters

AttributeDescriptionRequired

connectionKey string

A unique name for the host connection.

Yes

connection object

Configuration attributes that should match the values used when getting the script from the integration endpoint.

Yes

connection.hostname string

The URL of your Snowflake account. This is the same as host.

Yes

connection.port integer

The port to use when connecting to your Snowflake account host. Defaults to 443.

Yes

connection.warehouse string

The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.

Yes

connection.role string

The privileged Snowflake role used by the Immuta system account when configuring the Snowflake host. At minimum, it must be able to see the data that Immuta will govern.

Yes

connection.username string

The username of the system account that can act on Snowflake objects and configure the host.

Yes

connection.password string

The password of the system account that can act on Snowflake objects and configure the host.

Yes

nativeIntegration object

Configuration attributes that should match the values used when getting the script from the integration endpoint.

Yes

nativeIntegration.config.username string

Same as connection.username

Yes

nativeIntegration.config.password string

Same as connection.password

Yes

nativeIntegration.config.host string

Same as connection.hostname

Yes

nativeIntegration.config.port integer

Same as connection.port

Yes

nativeIntegration.config.warehouse string

Same as connection.warehouse

Yes

nativeIntegration.config.database string

Name of a new empty database that the Immuta system user will manage and store metadata in.

Yes

Response schema

AttributeDescription

objectPath string

The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element will be the associated connectionKey.

bulkId string

A bulk ID that can be used to search for the status of background jobs triggered by this request.

Example response

{
  objectPath: ['<your-connection-key-name>'],
  bulkId: "a-new-uuid"
}

Last updated

Self-managed versions

2024.32024.22024.12023.4

Copyright © 2014-2024 Immuta Inc. All rights reserved.