Setting up Snowflake to use Git¶

Configure for no authentication¶

To set up Snowflake to use a Git repository without authenticating, follow these steps:

1. Create an API integration that supports access without authenticating, and specify the following details:

   • git_https_api as the value of the API_PROVIDER parameter

   • HTTPS endpoints to which requests must be limited as values of the API_ALLOWED_PREFIXES parameter

   For more information, see CREATE API INTEGRATION.

   CREATE OR REPLACE API INTEGRATION my_git_api_integration
     API_PROVIDER = git_https_api
     API_ALLOWED_PREFIXES = ('https://example.com/my-account')
     ENABLED = TRUE;
   

   Copy

2. Create a Git repository clone as described in Create a Snowflake Git repository clone.

Configure for authenticating with a token¶

To have Snowflake authenticate with the Git repository by using a username and token such as a personal access token (PAT), follow these steps:

1. Provide credentials in a basic authentication secret.

   To provide the credentials that Snowflake uses to authenticate with the repository, create a secret that contains the following:

   • A TYPE value of password

   • A username and token, such as a personal access token (PAT)

     If your Git repository is hosted on Bitbucket, specify x-token-auth as the username value.

     Note

     For information about creating a personal access token in GitHub, see Managing your personal access tokens in the GitHub documentation.

   For more information on the SQL command for creating a secret, see the CREATE SECRET.

   Code in the following example creates a secret called my_git_secret with a username and the user’s personal access token to use as credentials:

   CREATE OR REPLACE SECRET my_git_secret
     TYPE = password
     USERNAME = 'gladyskravitz'
     PASSWORD = 'ghp_token';
   

   Copy

2. Create an API integration that supports authenticating with a token.

   To create an API integration for access to a Git repository without authenticating, specify the following details:

   • git_https_api as the value of the API_PROVIDER parameter

   • HTTPS endpoints to which requests must be limited as values of the API_ALLOWED_PREFIXES parameter

   For more information, see CREATE API INTEGRATION.

   CREATE OR REPLACE API INTEGRATION my_git_api_integration
     API_PROVIDER = git_https_api
     API_ALLOWED_PREFIXES = ('https://github.com/my-account')
     ALLOWED_AUTHENTICATION_SECRETS = (my_git_secret)
     ENABLED = TRUE;
   

   Copy

3. Create a Git repository clone as described in Create a Snowflake Git repository clone.

Configure for authenticating with OAuth¶

To set up Snowflake so that it authenticates with the remote Git repository using an OAuth flow, follow these steps:

1. Create an API integration that supports authenticating through OAuth.

   When specifying authentication with an OAuth2 flow, create an API integration that specifies the following:

   • git_https_api as the value of the API_PROVIDER parameter

   • HTTPS endpoints to which requests must be limited as values of the API_ALLOWED_PREFIXES parameter

     This must be a prefix at https://github.com. Authenticating with OAuth is supported only for repositories hosted at github.com.

   • An API_USER_AUTHENTICATION whose value is (TYPE = SNOWFLAKE_GITHUB_APP)

   For more information, see CREATE API INTEGRATION.

   Code in the following example creates an API integration called my_git_api_integration:

   CREATE OR REPLACE API INTEGRATION my_git_api_integration
     API_PROVIDER = git_https_api
     API_ALLOWED_PREFIXES = ('https://github.com')
     API_USER_AUTHENTICATION = (TYPE = SNOWFLAKE_GITHUB_APP)
     ENABLED = TRUE;
   

   Copy

2. Create a Git repository clone as described in Create a Snowflake Git repository clone.

Configure the private link connection¶

Before you can configure Snowflake for access to the remote Git repository, you must set up a private link between Snowflake and your cloud service provider.

To apply configuration changes to both Snowflake and your infrastructure, follow these steps:

1. In your cloud service provider, create a private link service to receive requests from the Snowflake private endpoint service.

   For details, see the knowledge base article Configuring Git Integration with Snowflake over Private Link.

2. In Snowflake, provision a private endpoint that will reach your infrastructure through a private IP.

   To provision the endpoint, use the SYSTEM$PROVISION_PRIVATELINK_ENDPOINT function with the following two arguments:

   • Your cloud provider’s private link service ID

   • Your Git server’s domain name

   AWSAzure

   SELECT SYSTEM$PROVISION_PRIVATELINK_ENDPOINT(
     'com.amazonaws.vpce.us-west-2.vpce-svc-xxx', // VPC Endpoint Service Name
     'git_address.com' // Git server domain
   );
   

   Copy

3. In your cloud service provider, accept the Snowflake private endpoint setup to finish setting up the private link connection.

4. To check status of the provisioning, call the SYSTEM$GET_PRIVATELINK_ENDPOINTS_INFO system function.

Configure Snowflake access to the remote Git repository¶

After you set up a private link between Snowflake and your cloud service provider, you can configure Snowflake access to the remote Git repository.

1. Create an API integration that supports authenticating with a certificate.

   Because Snowflake will reach your Git server using the HTTPS protocol, the domain name needs to have a valid certificate. The configuration you use differs depending on whether you use a self-signed certificate or a certificate signed by a certificate authority.

   • Using a self-signed certificate:

     

     1. Provide credentials in a generic string secret.

        This should be a public key of a self-signed domain to establish an HTTPS connection. To provide to Snowflake the credentials it will use to authenticate with the server, create a secret that contains the following details:

        • A TYPE parameter value of GENERIC_STRING

        • A public certificate string as the value of the SECRET_STRING parameter

          For the parameter’s value, specify a secret string, such as a public certificate body.

        CREATE OR REPLACE SECRET my_public_certificate
          TYPE = GENERIC_STRING
          SECRET_STRING = '-----BEGIN CERTIFICATE-----
                    <certificate_body>
                    -----END CERTIFICATE-----';
        

        Copy

     2. Create an API integration to integrate with the Git API, and specify the following details:

        • An API_PROVIDER parameter set to git_https_api

        • An API_ALLOWED_PREFIXES set to the base URL beneath which access is allowed

        • A USE_PRIVATELINK_ENDPOINT parameter set to TRUE

        • A TLS_TRUSTED_CERTIFICATES parameter set to the name of the secret you created, which contains the certificate

        For more information, see CREATE API INTEGRATION.

        CREATE OR REPLACE API INTEGRATION my_git_api_integration
          API_PROVIDER = git_https_api
          API_ALLOWED_PREFIXES = ('https://example.com/my-account')
          ALLOWED_AUTHENTICATION_SECRETS = ALL
          USE_PRIVATELINK_ENDPOINT = TRUE
          TLS_TRUSTED_CERTIFICATES = (my_public_certificate)
          ENABLED = TRUE;
        

        Copy

   • Using a certificate signed by a certificate authority:

     

     1. Create an API integration to integrate with the Git API, and specify the following details:

        • An API_PROVIDER parameter set to git_https_api

        • An API_ALLOWED_PREFIXES set to the base URL beneath which access is allowed

        • A USE_PRIVATELINK_ENDPOINT parameter set to TRUE

        • A TLS_TRUSTED_CERTIFICATES parameter set to the name of the secret you created, which contains the certificate

        For more information, see CREATE API INTEGRATION.

        CREATE OR REPLACE API INTEGRATION my_git_api_integration
          API_PROVIDER = git_https_api
          API_ALLOWED_PREFIXES = ('https://example.com/my-account')
          ALLOWED_AUTHENTICATION_SECRETS = ALL
          USE_PRIVATELINK_ENDPOINT = TRUE
          ENABLED = TRUE;
        

        Copy

2. Provide credentials in a basic authentication secret.

   After successfully connecting to the Git server over private link, you must still authenticate with the repository by creating another secret that provides credentials for the repository.

   To provide the credentials that Snowflake uses to authenticate with the repository, create a secret that contains the following:

   • A TYPE value of password

   • A username and token, such as a personal access token (PAT)

     Note

     For information about creating a personal access token in GitHub, see Managing your personal access tokens in the GitHub documentation.

   For more information on the SQL command for creating a secret, see the CREATE SECRET.

3. Create a Git repository clone as described in Create a Snowflake Git repository clone.