Manage remote app operations

About remote app operations

Remote app operations let a provider perform different types of operations on the consumer Snowflake Native App, such as running on-demand SQL statements or disabling the application. Providers might use remote app operations to perform maintenance tasks or troubleshoot issues. See the provider guide for more details.

Prerequisites

Before a provider can run remote app operations on an installed application, you must have an active event table set up in your account. Both you and the provider use the event table to view the results of the operation.

To set up an event table, see Set up event tracing for an app.

Important

If event sharing is disabled for the application, the provider cannot see the results of a run_sql operation. Make sure event sharing is enabled before the provider attempts a remote app operation. For more information, see Enable event sharing for an app.

Authorize restricted remote app operations

Certain remote app operation types are restricted, and as a consumer, you control whether a provider can perform these restricted operations per-application.

Currently, the only restricted operation type is run_sql. See SYSTEM$REMOTE_APP_OPERATION for more information.

You can grant consent 1) indefinitely, 2) temporarily, or 3) never, through the ALTER APPLICATION or CREATE APPLICATION commands. By default, consent is not granted on any application.

You can grant consent indefinitely by either of the following commands:

ALTER APPLICATION my_app
  SET AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = 'INDEFINITE';

CREATE APPLICATION my_app FROM LISTING <listing_id>
  AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = 'INDEFINITE';

You can grant consent temporarily by specifying a timestamp:

ALTER APPLICATION my_app
  SET AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = '<timestamp>';

CREATE APPLICATION my_app FROM LISTING <listing_id>
  AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = '<timestamp>';

This value can be any valid date and time format. After the specified timestamp, the provider can no longer perform remote app operations on the application.

You can withdraw consent at any time by any of these commands:

ALTER APPLICATION my_app
  SET AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = 'NEVER';

ALTER APPLICATION my_app UNSET AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL;

CREATE APPLICATION my_app FROM LISTING <listing_id>
  AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = 'NEVER';

Note

Withdrawing consent prevents the provider from starting new remote operations, but a remote operation that is already running may still run.

Querying operation results

Remote app operation invocations are logged to the event table.

Here is an example query to get started:

-- Get the latest ten invocations
SELECT timestamp,
       RECORD_ATTRIBUTES['snow.application.remote_app_operation.operation_type']::STRING AS operation_type,
       RECORD_ATTRIBUTES['snow.application.remote_app_operation.request_id']::STRING AS request_id,
       VALUE['status']::STRING     AS status,
       value
FROM   snowflake.telemetry.events
WHERE  SCOPE['name'] = 'snow.application.remote_app_operation'
AND    RECORD_ATTRIBUTES['snow.application.name'] = '<application_name>'
LIMIT  10;