arrow-left

All pages
gitbookPowered by GitBook
1 of 1

Loading...

Register a Snowflake Connection

The connection API is a REST API which allows users to register a Snowflake connection to Immuta with a single set of credentials rather than configuring an integration and creating data sources separately. Then Immuta can manage and enforce access controls on your data through that connection. To manage your connection, see the Manage a connection reference guide.

hashtag
Requirements

The following permissions and personas are used in the registration process:

  • APPLICATION_ADMIN Immuta permission

  • The Snowflake user registering the connection and running the script must have the following privileges:

    • CREATE DATABASE ON ACCOUNT WITH GRANT OPTION

hashtag
Prerequisites

No Snowflake integration configured in Immuta. If your Snowflake integration is already configured on the app settings page, follow the guide.

Complete the following steps to register a Snowflake connection:

  1. Create an Immuta system account with the proper Snowflake privileges for Immuta to use to manage policies in Snowflake.

  2. Use the /integrations/scripts/create endpoint to receive a script.

  3. Run the script in Snowflake.

hashtag
Step 1: Set up the Immuta system account

Complete the following actions in Snowflake:

  1. . Immuta will use this system account continuously to orchestrate Snowflake policies and maintain state between Immuta and Snowflake.

  2. with a minimum of the following privileges:

    • USAGE on all databases and schemas with registered data sources.

hashtag
Step 2: Generate the script

POST /integrations/scripts/create

  1. Using the example request, update the <placeholder_values> with your connection details and the authentication credentials for the system account you just created.

  2. Copy the config object to use later in the setup process.

  3. Run the request.

Find descriptions of the editable attributes in the table below and of the full payload in the .

Payload parameters

Attribute
Description
Required

hashtag
Step 3: Run the script in Snowflake

circle-info

Snowflake impersonation

If enabling Snowflake impersonation, add the following content to the script that is generated before you run it in Snowflake:

Once you finish configuring the integration, you can grant the IMPERSONATE_USER permission to Immuta users. See the for instructions.

Using your generated script, run it in your Snowflake environment as a user with the permissions listed in the .

The script will use the provided Immuta system user credentials to create the database you specified in the earlier step and set up Immuta-managed resources in Snowflake.

hashtag
Step 4: Create the connection in Immuta

POST /data/connection

Using the tabs below, copy the request and update the <placeholder_values> with your connection details. The connection details here should match the ones used when generating the script, and the payload from the script generation should be pasted exactly into nativeIntegration. Then submit the request.

Find descriptions of the editable attributes in the table below and of the full payload in the . The recommended setting values are included in the example.

circle-info

Test run

Opt to test and validate the create connection payload using a dry run:

POST /data/connection/test

Payload parameters

Attribute
Description
Required

hashtag
Response schema

Attribute
Description

Example response

CREATE ROLE ON ACCOUNT WITH GRANT OPTION

  • CREATE USER ON ACCOUNT WITH GRANT OPTION

  • MANAGE GRANTS ON ACCOUNT WITH GRANT OPTION

  • APPLY MASKING POLICY ON ACCOUNT WITH GRANT OPTION

  • APPLY ROW ACCESS POLICY ON ACCOUNT WITH GRANT OPTION

  • Use the /data/connection endpoint to finish registering your connection in Immuta.

    REFERENCES on all tables and views registered in Immuta.

  • SELECT on all tables and views registered in Immuta.

  • Grant the new Snowflake rolearrow-up-right to the system account you just created.

  • Copy the returned script and use it in the next step.

    config.username string

    The new username of the system account that can act on Snowflake objects and register the connection.

    Yes

    config.password string

    The password of the system account that can act on Snowflake objects and register the connection.

    Yes

    config.audit object

    This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled.

    No

    config.audit.enabled boolean

    If true, Snowflake query audit is enabled.

    No

    config.workspaces object

    This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled.

    No

    config.workspaces.enabled boolean

    If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used.

    No

    config.impersonation object

    This object enables user impersonation.

    No

    config.impersonation.enabled boolean

    If true, user impersonation is enabled.

    No

    config.impersonation.role string

    The name of the user impersonation role.

    No

    config.lineage object

    This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled.

    No

    config.lineage.enabled boolean

    If true, Snowflake lineage is enabled.

    No

    config.userRolePattern object

    This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded.

    No

    config.userRolePattern.exclude array

    This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.

    No

    Payload parameters

    Attribute
    Description
    Required

    config.host string

    The URL of your Snowflake account.

    Yes

    config.warehouse string

    The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.

    Yes

    config.database string

    Name of a new empty database that the Immuta system user will manage and store metadata in.

    Yes

    Payload parameters

    Attribute
    Description
    Required

    config.host string

    The URL of your Snowflake account.

    Yes

    config.warehouse string

    The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.

    Yes

    config.database string

    Name of a new empty database that the Immuta system user will manage and store metadata in.

    Payload parameters

    Attribute
    Description
    Required

    config.host string

    The URL of your Snowflake account.

    Yes

    config.warehouse string

    The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.

    Yes

    config.database string

    Name of a new empty database that the Immuta system user will manage and store metadata in.

    Yes

    connection.port integer

    The port to use when registering your Snowflake connection.

    Yes

    connection.warehouse string

    The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.

    Yes

    connection.role string

    The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.

    Yes

    connection.username string

    The username of the system account that can act on Snowflake objects and register the connection.

    Yes

    connection.password string

    The password of the system account that can act on Snowflake objects and register the connection.

    Yes

    settings object

    Specifications of the connection's settings, including status.

    No

    settings.isActive boolean

    When false, data objects will be inactive (disabled) by default when created in Immuta. Set to false for the recommended configuration.

    No

    options.forceRecursiveCrawl boolean

    If false, only active (enabled) objects will be crawled. If true, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to true for the recommended configuration.

    No

    nativeIntegration object

    Configuration attributes that should match the values used when getting the script from the integration endpoint. See the for descriptions.

    Yes

    Payload parameters

    Attribute
    Description
    Required

    connectionKey string

    A unique name for the connection. Avoid the use of periods (.) or

    Yes

    connection object

    Configuration attributes that should match the values used when getting the script from the integration endpoint.

    Yes

    connection.hostname string

    The URL of your Snowflake account. This is the same as host.

    Yes

    Payload parameters

    Attribute
    Description
    Required

    connectionKey string

    A unique name for the connection. Avoid the use of periods (.) or

    Yes

    connection object

    Configuration attributes that should match the values used when getting the script from the integration endpoint.

    Yes

    connection.hostname string

    The URL of your Snowflake account. This is the same as host.

    Payload parameters

    Attribute
    Description
    Required

    connectionKey string

    A unique name for the connection. Avoid the use of periods (.) or

    Yes

    connection object

    Configuration attributes that should match the values used when getting the script from the integration endpoint.

    Yes

    connection.hostname string

    The URL of your Snowflake account. This is the same as host.

    Yes

    config.host string

    The URL of your Snowflake account.

    Yes

    config.warehouse string

    The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.

    Yes

    config.database string

    Name of a new empty database that the Immuta system user will manage and store metadata in.

    connectionKey string

    A unique name for the connection. Avoid the use of periods (.) or restricted words in your connection key.

    Yes

    connection object

    Configuration attributes that should match the values used when getting the script from the integration endpoint.

    Yes

    connection.hostname string

    The URL of your Snowflake account. This should be the same as nativeIntegration.config.host.

    objectPath string

    The list of names that uniquely identify the path to a data object in the remote platform's hierarchy. The first element will be the associated connectionKey.

    bulkId string

    A bulk ID that can be used to search for the status of background jobs triggered by this request.

    Use the connection upgrade manager
    Create a new user in Snowflake to be the Immuta system accountarrow-up-right
    Create a Snowflake rolearrow-up-right
    Integration configuration payload reference guide
    Managing users and permissions guide
    requirements section
    Connection registration payloads reference guide

    Yes

    Yes

    curl -X 'POST' \
        'https://<your-immuta-url>/integrations/scripts/create' \
        -H 'accept: application/json' \
        -H 'Content-Type: application/json' \
        -H 'Authorization: <your-bearer-token>' \
        -d '{
        "type": "Snowflake",
        "autoBootstrap": false,
        "config": {
          "host": "<your-Snowflake-hostname-url>",
          "warehouse": "<your-Snowflake-warehouse>",
          "database": "<your-Snowflake-database>",
          "authenticationType": "keyPair",
          "username": "<the-Snowflake-username>",
          "privateKey": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->",
          "audit": {"enabled": true},
          "workspaces": {"enabled": false},
          "impersonation": {"enabled": false},
          "lineage": { "enabled": false },
          "userRolePattern": { "exclude": [] }
        }
        }'
    curl -X 'POST' \
        'https://<your-immuta-url>/integrations/scripts/create' \
        -H 'accept: application/json' \
        -H 'Content-Type: application/json' \
        -H 'Authorization: <your-bearer-token>' \
        -d '{
        "type": "Snowflake",
        "autoBootstrap": false,
        "config": {
          "host": "<your-Snowflake-hostname-url>",
          "warehouse": "<your-Snowflake-warehouse>",
          "database": "<your-Snowflake-database>",
          "authenticationType": "oAuthClientCredentials",
          "oAuthClientConfig": {
            "provider": "<your-provider>",
            "clientId": "<your-client-ID>",
            "authorityUrl": "<your-example.authority.com>",
            "useCertificate": true,
            "publicCertificateThumbprint": "<your-certificate-thumbprint>",
            "oauthPrivateKey": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->",
            "scope": "session:role-any",
          "audit": {"enabled": true},
          "workspaces": {"enabled": false},
          "impersonation": {"enabled": false},
          "lineage": { "enabled": false },
          "userRolePattern": { "exclude": [] }
          }
        }
        }'
    curl -X 'POST' \
        'https://<your-immuta-url>/integrations/scripts/create' \
        -H 'accept: application/json' \
        -H 'Content-Type: application/json' \
        -H 'Authorization: <your-bearer-token>' \
        -d '{
        "type": "Snowflake",
        "autoBootstrap": false,
        "config": {
          "host": "<your-Snowflake-hostname-url>",
          "warehouse": "<your-Snowflake-warehouse>",
          "database": "<your-Snowflake-database>",
          "authenticationType": "oAuthClientCredentials",
          "oAuthClientConfig": {
            "provider": "<your-provider>",
            "clientId": "<your-client-ID>",
            "authorityUrl": "<your-example.authority.com>",
            "clientSecret": "<your-client-secret>",
            "useCertificate": false,
            "scope": "session:role-any",
          "audit": {"enabled": true},
          "workspaces": {"enabled": false},
          "impersonation": {"enabled": false},
          "lineage": { "enabled": false },
          "userRolePattern": { "exclude": [] }
          }
        }
        }'
    curl -X 'POST' \
        'https://<your-immuta-url>/data/connection' \
        -H 'accept: application/json' \
        -H 'Content-Type: application/json' \
        -H 'Authorization: <your-bearer-token>' \
        -d '{
         "connectionKey": "<your-connection-key-name>",
         "connection": {
           "technology": "Snowflake",
           "hostname": "<your-Snowflake-hostname-url>",
           "port": <your-Snowflake-port>,
           "warehouse": "<your-Snowflake-warehouse>",
           "role": "<your-Snowflake-role>",
           "authenticationType": "keyPair",
           "username": "<the-Snowflake-username>",
           "privateKeyPassword": "<your-Snowflake-key-password>",
           "privateKey": {
             "keyName": "PRIV_KEY_FILE",
             "userFilename": "<your-private-key-file-name>",
             "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
           }
         },
         "settings": {
             "isActive": false
         },
         "options": {
           "forceRecursiveCrawl": true
         },
         "nativeIntegration": {
           "type": "Snowflake",
           "autoBootstrap": false,
           "config": {
             "authenticationType": "keyPair",
             "username": "<the-Snowflake-username>",
             "privateKeyPassword": "<your-Snowflake-key-password>",
             "privateKey": {
               "keyName": "PRIV_KEY_FILE",
               "userFilename": "<your-private-key-file-name>",
               "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
           }
             "host": "<your-Snowflake-hostname-url>",
             "port": <your-Snowflake-port>,
             "warehouse": "<your-Snowflake-warehouse>",
             "database": "<your-Snowflake-database>",
             "impersonation": { "enabled": false },
             "audit": { "enabled": true },
             "workspaces": { "enabled": false },
             "lineage": { "enabled": false },
             "userRolePattern": { "exclude": [] }
           }
         }
        }'
        
    curl -X 'POST' \
        'https://<your-immuta-url>/data/connection' \
        -H 'accept: application/json' \
        -H 'Content-Type: application/json' \
        -H 'Authorization: <your-bearer-token>' \
        -d '{
         "connectionKey": "<your-connection-key-name>",
         "connection": {
           "technology": "Snowflake",
           "hostname": "<your-Snowflake-hostname-url>",
           "port": <your-Snowflake-port>,
           "warehouse": "<your-Snowflake-warehouse>",
           "role": "<your-Snowflake-role>",
           "authenticationType": "oAuthClientCredentials",
           "oAuthClientConfig": {
             "useCertificate": true,
             "clientId": "<your-client-ID>",
             "authorityUrl": "<your-example.authority.com>",
             "scope": "session:role-any",
             "publicCertificateThumbprint": "<your-certificate-thumbprint>",
             "resource": "<your-optional-resource>",
             "oauthPrivateKey": {
               "keyName": "oauth client certificate",
               "userFilename": "<your-user-file.pem>",
               "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
             }
           }
         },
         "settings": {
             "isActive": false
         },
         "options": {
           "forceRecursiveCrawl": true
         },
         "nativeIntegration": {
           "type": "Snowflake",
           "autoBootstrap": false,
           "config": {
             "authenticationType": "oAuthClientCredentials",
             "oAuthClientConfig": {
               "useCertificate": true,
               "clientId": "<your-client-ID>",
               "authorityUrl": "<your-example.authority.com>",
               "scope": "session:role-any",
               "publicCertificateThumbprint": "<your-certificate-thumbprint>",
               "resource": "<your-optional-resource>",
               "oauthPrivateKey": {
                 "keyName": "oauth client certificate",
                 "userFilename": "<your-user-file.pem>",
                 "content": "<-----BEGIN PRIVATE KEY-----your-private-key-----END PRIVATE KEY----->"
               }
             }
             "host": "<your-Snowflake-hostname-url>",
             "port": <your-Snowflake-port>,
             "warehouse": "<your-Snowflake-warehouse>",
             "database": "<your-Snowflake-database>",
             "impersonation": { "enabled": false },
             "audit": { "enabled": true },
             "workspaces": { "enabled": false },
             "lineage": { "enabled": false },
             "userRolePattern": { "exclude": [] }
           }
         }
        }'
        
    curl -X 'POST' \
        'https://<your-immuta-url>/data/connection' \
        -H 'accept: application/json' \
        -H 'Content-Type: application/json' \
        -H 'Authorization: <your-bearer-token>' \
        -d '{
         "connectionKey": "<your-connection-key-name>",
         "connection": {
           "technology": "Snowflake",
           "hostname": "<your-Snowflake-hostname-url>",
           "port": <your-Snowflake-port>,
           "warehouse": "<your-Snowflake-warehouse>",
           "role": "<your-Snowflake-role>",
           "authenticationType": "oAuthClientCredentials",
           "oAuthClientConfig": {
             "useCertificate": false,
             "clientId": "<your-client-ID>",
             "authorityUrl": "<your-example.authority.com>",
             "scope": "session:role-any",
             "resource": "<your-optional-resource>",
             "clientSecret": "<your-client-secret>"
           }
         },
         "settings": {
             "isActive": false
         },
         "options": {
           "forceRecursiveCrawl": true
         },
         "nativeIntegration": {
           "type": "Snowflake",
           "autoBootstrap": false,
           "config": {
             "authenticationType": "oAuthClientCredentials",
             "oAuthClientConfig": {
               "useCertificate": false,
               "clientId": "<your-client-ID>",
               "authorityUrl": "<your-example.authority.com>",
               "scope": "session:role-any",
               "resource": "<your-optional-resource>",
               "clientSecret": "<your-client-secret>"           
             }
             "host": "<your-Snowflake-hostname-url>",
             "port": <your-Snowflake-port>,
             "warehouse": "<your-Snowflake-warehouse>",
             "database": "<your-Snowflake-database>",
             "impersonation": { "enabled": false },
             "audit": { "enabled": true },
             "workspaces": { "enabled": false },
             "lineage": { "enabled": false },
             "userRolePattern": { "exclude": [] }
           }
         }
        }'
        
    curl -X 'POST' \
        'https://<your-immuta-url>/integrations/scripts/create' \
        -H 'accept: application/json' \
        -H 'Content-Type: application/json' \
        -H 'Authorization: <your-bearer-token>' \
        -d '{
        "type": "Snowflake",
        "autoBootstrap": false,
        "config": {
          "host": "<your-Snowflake-hostname-url>",
          "warehouse": "<your-Snowflake-warehouse>",
          "database": "<your-Snowflake-database>",
          "authenticationType": "userPassword",
          "username": "<new-Snowflake-username>",
          "password": "<new-Snowflake-password>",
          "audit": {"enabled": true},
          "workspaces": {"enabled": false},
          "impersonation": {
            "enabled": true,
            "role": "IMPERSONATION_ROLE"
          },
          "lineage": { "enabled": false },
          "userRolePattern": { "exclude": [] }
        }
        }'
    CREATE ROLE "YOUR IMPERSONATION ROLE NAME";
    GRANT OWNERSHIP ON ROLE "YOUR IMPERSONATION ROLE NAME" TO ROLE "SYSTEM ACCOUNT ROLE";
    curl -X 'POST' \
        'https://<your-immuta-url>/data/connection' \
        -H 'accept: application/json' \
        -H 'Content-Type: application/json' \
        -H 'Authorization: <your-bearer-token>' \
        -d '{
         "connectionKey": "<your-connection-key-name>",
         "connection": {
           "technology": "Snowflake",
           "hostname": "<your-Snowflake-hostname-url>",
           "port": <your-Snowflake-port>,
           "warehouse": "<your-Snowflake-warehouse>",
           "role": "<your-Snowflake-role>",
           "authenticationType": "userPassword",
           "username": "<your-Snowflake-username>",
           "password": "<your-Snowflake-password>"
         },
         "settings": {
             "isActive": false
         },
         "options": {
           "forceRecursiveCrawl": true
         },
         "nativeIntegration": {
           "type": "Snowflake",
           "autoBootstrap": false,
           "config": {
             "authenticationType": "userPassword",
             "username": "<your-Snowflake-username>",
             "password": "<your-Snowflake-password>",
             "host": "<your-Snowflake-hostname-url>",
             "port": <your-Snowflake-port>,
             "warehouse": "<your-Snowflake-warehouse>",
             "database": "<your-Snowflake-database>",
             "impersonation": { 
               "enabled": true,
               "role": "IMPERSONATION_ROLE"
              },
             "audit": { "enabled": true },
             "workspaces": { "enabled": false },
             "lineage": { "enabled": false },
             "userRolePattern": { "exclude": [] }
           }
         }
        }'
        
    {
      "objectPath": ['<your-connection-key-name>'],
      "bulkId": "a-new-uuid"
    }
    restricted words
    in your connection key.
    restricted words
    in your connection key.
    restricted words
    in your connection key.

    config.username string

    The username of the system account that can act on Snowflake objects and register the connection.

    Yes

    config.privateKey string

    The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.

    Yes

    config.audit object

    This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled.

    No

    config.audit.enabled boolean

    If true, Snowflake query audit is enabled.

    No

    config.workspaces object

    This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled.

    No

    config.workspaces.enabled boolean

    If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used.

    No

    config.impersonation object

    This object enables user impersonation.

    No

    config.impersonation.enabled boolean

    If true, user impersonation is enabled.

    No

    config.lineage object

    This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled.

    No

    config.lineage.enabled boolean

    If true, Snowflake lineage is enabled.

    No

    config.userRolePattern object

    This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded.

    No

    config.userRolePattern.exclude array

    This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.

    No

    Yes

    config.oAuthClientConfig.provider string

    The identity provider for OAuth, such as Okta.

    Yes

    config.oAuthClientConfig.clientId string

    The client identifier of your registered application.

    Yes

    config.oAuthClientConfig.authorityUrl string

    Authority URL of your identity provider.

    Yes

    config.oAuthClientConfig.publicCertificateThumbprint string

    Your certificate thumbprint.

    Yes

    config.oAuthClientConfig.oauthPrivateKey string

    The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added.

    Yes

    config.audit object

    This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled.

    No

    config.audit.enabled boolean

    If true, Snowflake query audit is enabled.

    No

    config.workspaces object

    This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled.

    No

    config.workspaces.enabled boolean

    If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used.

    No

    config.impersonation object

    This object enables user impersonation.

    No

    config.impersonation.enabled boolean

    If true, user impersonation is enabled.

    No

    config.lineage object

    This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled.

    No

    config.lineage.enabled boolean

    If true, Snowflake lineage is enabled.

    No

    config.userRolePattern object

    This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded.

    No

    config.userRolePattern.exclude array

    This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.

    No

    config.oAuthClientConfig.provider string

    The identity provider for OAuth, such as Okta.

    Yes

    config.oAuthClientConfig.clientId string

    The client identifier of your registered application.

    Yes

    config.oAuthClientConfig.authorityUrl string

    Authority URL of your identity provider.

    Yes

    config.oAuthClientConfig.clientSecret string

    Client secret of the application.

    Yes

    config.audit object

    This object enables Snowflake query audit. Omit for the recommended configuration: audit enabled.

    No

    config.audit.enabled boolean

    If true, Snowflake query audit is enabled.

    No

    config.workspaces object

    This object represents Immuta project workspaces configured for Snowflake. Omit for the recommended configuration: workspaces disabled.

    No

    config.workspaces.enabled boolean

    If true, Snowflake project workspaces are enabled. If you use Snowflake table grants, project workspaces cannot be used.

    No

    config.impersonation object

    This object enables user impersonation.

    No

    config.impersonation.enabled boolean

    If true, user impersonation is enabled.

    No

    config.lineage object

    This object enables Snowflake lineage ingestion. Omit for the recommended configuration: lineage disabled.

    No

    config.lineage.enabled boolean

    If true, Snowflake lineage is enabled.

    No

    config.userRolePattern object

    This object excludes roles and users from authorization checks. Omit for the recommended configuration: no users or roles excluded.

    No

    config.userRolePattern.exclude array

    This array is a list of roles and users (both case-sensitive) to exclude from authorization checks. Wildcards are unsupported. The roles and users will not have policies applied to them when querying Immuta protected Snowflake tables.

    No

    connection.port integer

    The port to use when registering your Snowflake connection.

    Yes

    connection.warehouse string

    The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.

    Yes

    connection.role string

    The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.

    Yes

    connection.username string

    The username of the system account that can act on Snowflake objects and register the connection.

    Yes

    connection.privateKeyPassword string

    The Snowflake private key password. Required if the private key is encrypted.

    No

    connection.privateKey.userFilename string

    The name of your private key file on your machine.

    Yes

    connection.privateKey.content string

    The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as config.privateKey.

    Yes

    settings object

    Specifications of the connection's settings, including status.

    No

    settings.isActive boolean

    If false, data objects will be inactive (disabled) by default when created in Immuta. Set to false for the recommended configuration.

    No

    options.forceRecursiveCrawl boolean

    If false, only active (enabled) objects will be crawled. If true, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to true for the recommended configuration.

    No

    nativeIntegration object

    Configuration attributes that should match the values used when getting the script from the integration endpoint.

    Yes

    nativeIntegration.config.username string

    Same as connection.username

    Yes

    nativeIntegration.config.privateKeyPassword string

    Same as connection.privateKeyPassword

    No

    nativeIntegration.config.privateKey.keyName string

    Same as connection.keyName

    Yes

    nativeIntegration.config.privateKey.userFilename string

    Same as connection.userFilename

    Yes

    nativeIntegration.config.privateKey.content string

    Same as connection.content

    Yes

    nativeIntegration.config.host string

    Same as connection.hostname

    Yes

    nativeIntegration.config.port integer

    Same as connection.port

    Yes

    nativeIntegration.config.warehouse string

    Same as connection.warehouse

    Yes

    nativeIntegration.config.database string

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.impersonation object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.audit object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.workspaces object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.lineage object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.userRolePattern object

    Use the same setting as the script generation.

    Yes

    Yes

    connection.port integer

    The port to use when registering your Snowflake connection.

    Yes

    connection.warehouse string

    The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.

    Yes

    connection.role string

    The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.

    Yes

    connection.oAuthClientConfig.clientId string

    The client identifier of your registered application.

    Yes

    connection.oAuthClientConfig.authorityUrl string

    Authority URL of your identity provider.

    Yes

    connection.oAuthClientConfig.publicCertificateThumbprint string

    Your certificate thumbprint.

    Yes

    connection.oAuthClientConfig.resource string

    An optional resource to pass to the token provider.

    No

    connection.oAuthClientConfig.oauthPrivateKey.userFilename string

    The name of your private key file on your machine.

    Yes

    connection.oAuthClientConfig.oauthPrivateKey.content string

    The private key. Replace new lines in the private key with a backslash before the new line character: "\n". If you are using another means of configuration, such as a Python script, the "\n" should not be added. This is the same as config.oauthPrivateKey in the script request.

    Yes

    settings object

    Specifications of the connection's settings, including status.

    No

    settings.isActive boolean

    When false, data objects will be inactive (disabled) by default when created in Immuta. Set to false for the recommended configuration.

    No

    options.forceRecursiveCrawl boolean

    If false, only active (enabled) objects will be crawled. If true, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to true for the recommended configuration.

    No

    nativeIntegration object

    Configuration attributes that should match the values used when getting the script from the integration endpoint.

    Yes

    nativeIntegration.config.oAuthClientConfig.clientId string

    Same as connection.oAuthClientConfig.clientId

    Yes

    nativeIntegration.config.oAuthClientConfig.authorityUrl string

    Same as connection.oAuthClientConfig.authorityUrl

    Yes

    nativeIntegration.config.oAuthClientConfig.publicCertificateThumbprint string

    Same as connection.oAuthClientConfig.publicCertificateThumbprint

    Yes

    nativeIntegration.config.oAuthClientConfig.resource string

    Same as connection.oAuthClientConfig.resource

    No

    nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.userFilename string

    Same as connection.oAuthClientConfig.oauthPrivateKey.userFilename

    Yes

    nativeIntegration.config.oAuthClientConfig.oauthPrivateKey.content string

    Same as connection.oAuthClientConfig.oauthPrivateKey.content

    Yes

    nativeIntegration.config.host string

    Same as connection.hostname

    Yes

    nativeIntegration.config.port integer

    Same as connection.port

    Yes

    nativeIntegration.config.warehouse string

    Same as connection.warehouse

    Yes

    nativeIntegration.config.database string

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.impersonation object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.audit object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.workspaces object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.lineage object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.userRolePattern object

    Use the same setting as the script generation.

    Yes

    connection.port integer

    The port to use when registering your Snowflake connection.

    Yes

    connection.warehouse string

    The default pool of compute resources the Immuta system user will use to run queries and perform other Snowflake operations.

    Yes

    connection.role string

    The privileged Snowflake role used by the Immuta system account when registering the Snowflake connection. At minimum, it must be able to see the data that Immuta will govern.

    Yes

    connection.oAuthClientConfig.clientId string

    The client identifier of your registered application.

    Yes

    connection.oAuthClientConfig.authorityUrl string

    Authority URL of your identity provider.

    Yes

    connection.oAuthClientConfig.clientSecret string

    Client secret of the application.

    Yes

    connection.oAuthClientConfig.resource string

    An optional resource to pass to the token provider.

    No

    settings object

    Specifications of the connection's settings, including status.

    No

    settings.isActive boolean

    When false, data objects will be inactive (disabled) by default when created in Immuta. Set to false for the recommended configuration

    No

    options.forceRecursiveCrawl boolean

    If false, only active (enabled) objects will be crawled. If true, both active (enabled) and inactive (disabled) data objects will be crawled; any child objects from inactive (disabled) objects will be set as inactive (disabled). Set to true for the recommended configuration.

    No

    nativeIntegration object

    Configuration attributes that should match the values used when getting the script from the integration endpoint.

    Yes

    nativeIntegration.config.oAuthClientConfig.clientId string

    Same as connection.oAuthClientConfig.clientId

    Yes

    nativeIntegration.config.oAuthClientConfig.authorityUrl string

    Same as connection.oAuthClientConfig.authorityUrl

    Yes

    nativeIntegration.config.oAuthClientConfig.resource string

    Same as connection.oAuthClientConfig.resource

    No

    nativeIntegration.config.oAuthClientConfig.clientSecret string

    Same as connection.oAuthClientConfig.clientSecret

    Yes

    nativeIntegration.config.host string

    Same as connection.hostname

    Yes

    nativeIntegration.config.port integer

    Same as connection.port

    Yes

    nativeIntegration.config.warehouse string

    Same as connection.warehouse

    Yes

    nativeIntegration.config.database string

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.impersonation object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.audit object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.workspaces object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.config.lineage object

    Use the same setting as the script generation.

    Yes

    nativeIntegration.userRolePattern object

    Use the same setting as the script generation.

    Yes

    table above