Getting Started with Snowflake
The how-to guides linked on this page illustrate how to integrate Snowflake with Immuta.
Requirement: Snowflake Enterprise Edition
Configure your Snowflake integration
These guides provide information on the recommended features to enable with Snowflake.
Configure your Snowflake integration with the following features enabled:
Snowflake table grants (enabled by default)
Snowflake low row access policy mode (enabled by default)
Snowflake native query audit (enabled by default)
Select None as your default subscription policy.
Register metadata
These guides provide instructions for organizing your Snowflake data to align with your governance structure.
These guides provide instructions for auditing and detecting your users' activity, or see the Detect use case for a comprehensive guide on the benefits of these features and other recommendations.
Set up audit export to S3 or ADLS Gen2 for your Snowflake audit logs.
These guides provide instructions for discovering, classifying, and tagging your data.
Register a subset of your tables to configure and validate SDD.
Configure SDD to discover entities of interest for your policy needs.
Register your remaining tables at the schema level with schema monitoring turned on.
These guides provide instructions for configuring and securing your data with governance policies, or see the Secure use cases for a comprehensive guide on creating policies to fit your organization's use case.
Validate the policy. You do not have to validate every policy you create in Immuta; instead, examine a few to validate the behavior you expect to see:
Validate that the Immuta users impacted now have an Immuta role in Snowflake dedicated to them.
Validate that when acting under the Immuta role those users have access to the table(s) in question.
Validate that users without access in Immuta can still access the table with a different Snowflake role that has access.
Validate that a user with
SECONDARY ROLES ALL
enabled retains access ifthey were not granted access by Immuta and
they have a role that provides them access, even if they are not currently acting under that role.
Validate that a user with a role that can access the table in question (whether it's an Immuta role or not) sees the impact of that data policy.
Once all Immuta policies are in place, remove or alter old roles.
Last updated