Accessing Data

Learn how end users can access policy-enforced data in Snowflake

Once data is registered through the Snowflake connection, you will access your data through your Snowflake queries as you normally would. If you are subscribed to the data source, Immuta grants you access to the data in Snowflake.

When you submit a query, the Snowflake client submits the SQL query to the Snowflake server, which then processes the query and determines what data your role is allowed to see. Then, the Snowflake server queries the database and returns the query results to the Snowflake client, which then returns policy-enforced data to you.

The diagram below illustrates how Immuta, the Snowflake server, and Snowflake client interact to access data.

Querying data

Because subscription policies are managed through roles, you must be acting under the role Immuta creates for you to get access to your subscribed data sources. When querying data in Snowflake, do one of the following:

• ​Use the role that Immuta creates and manages. (For example, USE ROLE <prefix>_USER_<username>: The role prefix is set on the Immuta app settings page and the <username> is your Immuta username.) If the current active primary role is used to query tables, USAGE on a Snowflake warehouse must be granted to the Immuta-managed Snowflake role for each user.
• ​Set your Snowflake to use secondary roles (USE SECONDARY ROLES ALL), which allows users to use the privileges from all roles that they have been granted, including <prefix>_USER_<username>, in addition to the current active primary role. Users may also set a value for DEFAULT_SECONDARY_ROLES as an object property on a Snowflake user. To learn more about primary roles and secondary roles in Snowflake, see Snowflake documentation.

User impersonation

Impersonation allows Immuta users or system accounts to query data sources they are subscribed to as another Immuta user.

Consider the following users and their data source subscriptions.

User 1 data source subscriptions

• HR data source
• Research data source

User 2 data source subscriptions

• HR data source
• Consumer report data source

The table below illustrates what data is returned when User 1, User 2, and User 2 impersonating User 1 query these data sources.

	HR data source	Research data source	Consumer report data source
User 1	name column is masked	ssn column is masked with hashing	​ ❌ Denied access
User 2	All data visible	​ ❌ Denied access	address column is masked
User 2 impersonating User 1	name column is masked	​ ❌ Denied access​	address column is masked

Users with the APPLICATION_ADMIN Immuta permission can enable impersonation when registering a Snowflake connection for the first time or edit an existing connection to enable impersonation.

Audit

Snowflake query audit will show the user running the queries as the user logged in to Snowflake, not as the user they are impersonating.