AWS PrivateLink and Snowflake¶

What is AWS PrivateLink?¶

AWS PrivateLink is an AWS service for creating private VPC endpoints that allow direct, secure connectivity between your AWS VPCs and the Snowflake VPC without traversing the public Internet. The connectivity is for AWS VPCs in the same AWS region.

For Writing external functions, you can also use AWS PrivateLink with private endpoints.

In addition, if you have an on-premises environment (e.g. a non-hosted data center), you can choose to use AWS Direct Connect, in conjunction with AWS PrivateLink, to connect all your virtual and physical environments in a single, private network.

Enabling AWS PrivateLink¶

To enable AWS PrivateLink for your Snowflake account, complete the following steps:

1. In your command line environment, run the following AWS CLI STS command and save the output. The output will be used as the value for the federated_token argument in the next step.

   aws sts get-federation-token --name sam
   

   Copy

   Note that get-federation-token requires either an identity and access management user in AWS or the AWS account root user. For details, refer to the AWS documentation.

   Extract the 12-digit number in the "FederatedUserId" value (truncated). For example, if your token contains:

   {
      ...
      "FederatedUser": {
          "FederatedUserId": "185...:sam",
          "Arn": "arn:aws:sts::185...:federated-user/sam"
      },
      "PackedPolicySize": 0
    }
   

   Copy

   Extract 185.... This 12-digit number will be the value for the aws_id in the next step.

2. As a Snowflake account administrator (i.e. a user with the ACCOUNTADMIN system role), call the SYSTEM$AUTHORIZE_PRIVATELINK function to authorize (i.e. enable) AWS PrivateLink for your Snowflake account:

   select SYSTEM$AUTHORIZE_PRIVATELINK ( '<aws_id>' , '<federated_token>' );
   

   Copy

   Where:

   • 'aws_id'

     The 12-digit identifier that uniquely identifies your Amazon Web Services (AWS) account, as a string.

   • 'federated_token'

     The federated token value that contains access credentials for a federated user as a string.

   For example:

   use role accountadmin;
   
   select SYSTEM$AUTHORIZE_PRIVATELINK (
       '185...',
       '{
          "Credentials": {
              "AccessKeyId": "ASI...",
              "SecretAccessKey": "enw...",
              "SessionToken": "Fwo...",
              "Expiration": "2021-01-07T19:06:23+00:00"
          },
          "FederatedUser": {
              "FederatedUserId": "185...:sam",
              "Arn": "arn:aws:sts::185...:federated-user/sam"
          },
          "PackedPolicySize": 0
       }'
     );
   

   Copy

To verify your authorized configuration, call the SYSTEM$GET_PRIVATELINK function in your Snowflake account on AWS. This function uses the same argument values for 'aws_id' and 'federated_token' that were used to authorize your Snowflake account.

Snowflake returns Account is authorized for PrivateLink. for a successful authorization.

If it is necessary to disable AWS PrivateLink in your Snowflake account, call the SYSTEM$REVOKE_PRIVATELINK function, using the same argument values for 'aws-id' and 'federated_token'.

To further harden your security posture, Snowflake recommends Pinning private connectivity endpoints for inbound traffic for your Snowflake account.

Configuring your AWS VPC environment¶

Connect to Snowflake¶

Prior to connecting to Snowflake, you can optionally leverage SnowCD (Snowflake Connectivity Diagnostic tool) to evaluate the network connection with Snowflake and AWS PrivateLink.

For more information, see SnowCD and SYSTEM$ALLOWLIST_PRIVATELINK.

Otherwise, connect to Snowflake with your private connectivity account URL.

Note that if you want to connect to Snowsight via AWS PrivateLink, follow the instructions in the Snowsight documentation.

Blocking public access — Recommended¶

After testing private connectivity to Snowflake using AWS PrivateLink, you can optionally block public access to Snowflake. This means that users can access Snowflake only if their connection request originates from an IP address within a particular CIDR block range specified in a Snowflake network policy.

To block public access using a network policy:

1. Create a new network policy or edit an existing network policy. Add the CIDR block range for your organization.

2. Activate the network policy for your account.

For details, see Controlling network traffic with network policies.

Configuring your Snowflake clients¶

Using SSO with AWS PrivateLink¶

Snowflake supports using SSO with AWS PrivateLink. For more information, see:

• SSO with private connectivity

• Partner applications

Using Client Redirect with AWS PrivateLink¶

Snowflake supports using Client Redirect with AWS PrivateLink.

For more information, see Redirecting client connections.

Using replication and Tri-Secret Secure with private connectivity¶

Snowflake supports replicating your data from the source account to the target account, regardless of whether you enable Tri-Secret Secure or this feature in the target account.

Troubleshooting¶

Note the following Snowflake Community articles:

• How to retrieve a Federation Token from AWS for PrivateLink Self-Service

• FAQ: PrivateLink Self-Service with AWS

• Troubleshooting: Snowflake self-service functions for AWS PrivateLink