Manage remote app operations¶

About remote app operations¶

Remote app operations let a provider perform different types of operations on the consumer Snowflake Native App, such as running on-demand SQL statements or disabling the application. Providers may use remote app operations to perform maintenance tasks or troubleshoot issues. See the provider guide for more details.

Certain remote app operation types are restricted, and as a consumer, you must grant consent per-application to allow a provider to perform these restricted operations.

Currently, the supported operation types are run_sql, disable, enable, and retry_upgrade:

See SYSTEM$REMOTE_APP_OPERATION for more information on how these operations are executed.

Authorize restricted remote app operations¶

Currently, the only restricted operation type is run_sql.

You can grant consent 1) indefinitely, 2) temporarily, or 3) never, through the ALTER APPLICATION or CREATE APPLICATION commands. By default, consent is not granted on any application.

Prerequisites¶

Before a provider can run remote app operations on an installed application, you must have an active event table set up in your account. Both you and the provider use the event table to view the results of the operation.

To set up an event table, see Set up event tracing for an app.

Grant indefinite consent¶

You can grant consent indefinitely by either of the following commands:

ALTER APPLICATION my_app
  SET AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = 'INDEFINITE';

CREATE APPLICATION my_app FROM LISTING <listing_id>
  AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = 'INDEFINITE';

Grant temporary consent¶

You can grant consent temporarily by specifying a timestamp:

ALTER APPLICATION my_app
  SET AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = '<timestamp>';

CREATE APPLICATION my_app FROM LISTING <listing_id>
  AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = '<timestamp>';

This value can be any valid date and time format. After the specified timestamp, the provider can no longer perform remote app operations on the application.

Withdraw consent¶

You can withdraw consent at any time by any of these commands:

ALTER APPLICATION my_app
  SET AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = 'NEVER';

ALTER APPLICATION my_app UNSET AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL;

CREATE APPLICATION my_app FROM LISTING <listing_id>
  AUTHORIZE_RESTRICTED_PROVIDER_REMOTE_OPERATIONS_UNTIL = 'NEVER';

Querying operation results¶

All remote app operation invocations are logged to the ACCOUNT_USAGE.APPLICATION_REMOTE_OPERATION_HISTORY view, with a latency of up to 1 hour.

SELECT
    application_name,
    application_id,
    application_hash,
    request_id,
    operation_type,
    completed_on,
    request_status,
    request_config
FROM
    snowflake.account_usage.application_remote_operation_history
WHERE
    completed_on >= DATEADD(day, -7, CURRENT_TIMESTAMP());

Event table logging¶

If the correct event definitions are enabled, remote app operations are also logged to the event table. See the provider guide for more details on the exact requirements.

For the run_sql operation, the event table also includes the result of the SQL statement executed in the VALUE column, which is not present in the ACCOUNT_USAGE.APPLICATION_REMOTE_OPERATION_HISTORY view.

Here is an example query on the event table:

-- Get the latest ten invocations
SELECT timestamp,
       RECORD_ATTRIBUTES['snow.application.remote_app_operation.operation_type']::STRING AS operation_type,
       RECORD_ATTRIBUTES['snow.application.remote_app_operation.request_id']::STRING AS request_id,
       VALUE['status']::STRING     AS status,
       value
FROM   snowflake.telemetry.events
WHERE  SCOPE['name'] = 'snow.application.remote_app_operation'
AND    RECORD_ATTRIBUTES['snow.application.name'] = '<application_name>'
LIMIT  10;