Schema:

ORGANIZATION_USAGE

For guidance on query performance when using organization-wide usage views, see Performance (Organization Usage).

EXTERNAL_ACCESS_HISTORY view

Important

This view is only available in the organization account. For more information, see Premium views in the organization account.

Organization Usage performance

When you query a specific view in the SNOWFLAKE.ORGANIZATION_USAGE schema, follow the organization-wide guidance in Performance (Organization Usage): bound every scan on history views, list columns explicitly, and use the time filter column table plus worked SQL and anti-patterns there.

The EXTERNAL_ACCESS_HISTORY view in the ORGANIZATION_USAGE schema can be used to query the history of external access performed by procedure or UDF handler code across accounts in your organization within the last 365 days (1 year).

Columns

Organization-level columns

Column NameData TypeDescription
ORGANIZATION_NAMEVARCHARName of the organization.
ACCOUNT_LOCATORVARCHARSystem-generated identifier for the account.
ACCOUNT_NAMEVARCHARUser-defined identifier for the account.

Additional columns

Column NameData TypeDescription
QUERY_IDTEXTID of the query or job that called the UDF or procedure performing external access.
HOSTNAMESTEXTHost names accessed, returned as a JSON array.
STATUSTEXT

Status of the attempt to connect to the external location. One of the following values:

  • SUCCESS if the connection was successful
  • DENY if the connection was denied
IPTEXTIP address for the external network location.
SOURCE_CLOUDTEXT

Name of the cloud provider where the data transfer originated. One of the following:

  • aws
  • gcp
  • azure
SOURCE_REGIONTEXTRegion where the data transfer originated.
TARGET_CLOUDTEXT

Name of the cloud provider to which the data was sent. One of the following:

  • aws
  • gcp
  • azure
  • internet (for regions not on a cloud provider)
TARGET_REGIONTEXTRegion to which the data was sent. internet for regions not on a cloud provider.
SENT_BYTESNUMBERNumber of bytes sent to the external endpoint.
RECEIVED_BYTESNUMBERNumber of bytes received from the external endpoint.

Usage notes

  • Each row in the view represents a single IP address that the procedure or UDF accesses. As a result, there might be multiple rows with different IP addresses, but with the same query ID. There might also be multiple hostnames mapped to the same IP address.
  • Latency for the view may be up to 180 minutes (3 hours).
  • The data is retained for 365 days (1 year).

Examples

Retrieve denied external access attempts:

SELECT account_name, query_id, hostnames, ip, sent_bytes, received_bytes
  FROM snowflake.organization_usage.external_access_history
  WHERE status = 'DENY'
  LIMIT 10;