Installing the Snowflake Data Clean Rooms environment¶

Clean rooms environment installation¶

The Snowflake data clean rooms environment is installed once for an entire Snowflake account (not once per user or per clean room) by someone with ACCOUNTADMIN privileges on the Snowflake account.

The administrator configures the environment to specify which users in that account can create clean rooms, which users have API access, which accounts can be invited to collaborate in a clean room, what data a clean room creator can import into the clean room, and which (if any) third-party services can be used to export query results from any clean room created in this account.

If a clean room environment has already been installed for your account, reach out to your clean rooms administrator for access. If a clean room environment has not been installed for your account, learn how to install the environment.

After the environment has been installed and configured, the administrator grants permission to other Snowflake users to act as clean room administrators (DCR admins), clean room creators (clean room managers), and developers.

Creating a clean room¶

The Snowflake account administrator grants permission to users in their account to create clean rooms. When you create a clean room, you are considered a provider for that clean room. Providers can configure and share clean rooms with users in other Snowflake accounts (or even non-Snowflake users), who are called consumers for clean rooms shared with them.

After creating a clean room, the provider imports tables or views into it, specifies what queries can be run against their data, which columns in their data can be joined or appear in the results, and what can be done with the results. (You can create variations on the standard clean room, as described later.)

The provider then invites consumers to join the clean room, import their own tables and views, and run one of the queries specified by the provider. Consumers must be pre-approved by a clean rooms administrator before they can be invited to a clean room.

Joining a clean room¶

After creating and configuring a clean room, the provider sends invitations to users in other accounts to join the clean room. These invited users are called consumers or sometimes collaborators. Consumers invited through the web application receive an emailed invitation to join the clean room. Snowflake users must have the clean rooms environment installed in order to be invited to join a clean room, but you can invite non-Snowflake users to join a clean room. A Snowflake account must be allowlisted by a clean rooms administrator before a clean room creator can invite users in that account.

(In the web application both “join” and “install” are used to describe when a consumer accepts a clean room invitation. This is because a clean room must literally be installed in the consumer’s clean room environment.)

After joining a clean room, a consumer imports any data needed for the templates in that clean room, specifies how their data can be accessed, such as which columns can be joined or projected, provides any template-specific filters or other parameters, then runs the template. Consumers can specify a repeating run of the template, if desired. Results can be viewed in the browser, or downloaded. If the provider has enabled activation and the consumer approves, the consumer can export the results to the approved locations (their own Snowflake account, or a third-party activation connector designated by the provider).

All data imported into a clean room is accessible only through a template installed in the clean room. That is, data imported cannot be directly queried by either party–the provider or consumer–but can only be accessed through a template in that clean room. Each party also sets rules on their own data: which columns can be joined and not projected, or projected but not joined, and which templates can access which tables that they own. Each party can also delete their data from the clean room at any time.

By default, only a consumer can run queries in a clean room, but the provider can enable a clean room to support provider-run queries. If a clean room supports provider-run queries, the consumer will be alerted to this before they join the clean room.

Running queries¶

Every clean room has one or more templates installed. A template is a SQL query that can include run-time parameters provided by the person running the template. These parameters enable users to specify which tables in the clean room are used in the query, which columns are used in the query, and WHERE clause filters.

Snowflake provides a set of standard templates for use in the web app. These templates enable common use cases such as audience overlap, audience lookalike, inventory forecasting, and arbitrary SQL queries.

Developers can create custom templates to use in their clean rooms.

Queries can be run in the web application or in code. Query results can be viewed or downloaded, or can be shared to the provider, the consumer, or an approved third-party if activation is allowed in that clean room.

Clean room variations¶

The most common clean room, as described above, is one where a provider imports data and specifies one or more specific queries that can be run against the data and how the results can be shared, and the consumer imports their own data and runs the permitted queries against the combined data. However, a provider can permit several variations on the standard clean room:

• Allow the provider to run their own queries against consumer data.. By default, only the consumer can run queries in a clean room. If enabled for a clean room, a provider can request permission from the consumer to run a specific query in the clean room.

• Allow the query results to be exported (activated) to the Snowflake account of the person running the query or to a Snowflake-approved third-party account, such as Meta Ads Manager or The Trade Desk. Exporting data outside the clean room is always subject to approval by all parties who shared the data being queried.

• Allow either party to include custom Python code that can be called by the query they run. This code typically filters or manipulates the data in some way as the query is being run; it cannot take external actions such as saving a file, exporting data, or performing other actions.

• Allow the query to access data in other clean rooms, subject to approval by the providers of all the clean rooms being accessed.

• Chain multiple queries together.

About providers and consumers¶

Clean room collaborators are classified as either a provider or a consumer for a given clean room. The provider is the account that creates a clean room; the consumer is the account that is shared a clean room. You cannot invite someone in the same account where you created a clean room to act as a consumer for that clean room. All users in the same Snowflake account have the same clean room role (provider or consumer) for the same clean rooms in that account.

Whether you are a provider or consumer is determined solely by whether you created or were shared a clean room, not by any Snowflake roles or other permissions.

Here is more information about the provider and consumer roles.

Web application¶

Snowflake data clean rooms can be managed and used in a browser. You can use the web application to create, manage, and use clean rooms as a provider or consumer, to administer the web application or the entire clean rooms environment for your Snowflake account. The web application is the only way to manage the clean rooms environment.

Permissions and access: The web app is managed by the clean rooms manager. You must be granted access to use the web app by the DCR administrator for your Snowflake account.

The web application requires an email address, name, and password to log in. The email address is not required to match your Snowflake account email address, but is designated by the clean room administrator. Your user name and password are chosen by you.

The web application is accessed at a separate URL from Snowsight, the Snowflake web application. The URL is specific to each account.

To get a feel for using the web application, try out the web application tutorial, or read more about the web application.

API¶

Snowflake provides a number of stored procedures to create or run clean rooms. These procedures can be called through Snowsight notebooks or worksheets or any other command-line interface where you can run stored procedures in your Snowflake account.

These procedures enable you to perform most of the consumer or provider actions needed to create, manage or use a clean room as a provider or consumer. The API does not enable administrative actions; to administer a clean room you must use the web app. Read the reference documentation for the API.

Permissions and access: In order to use the API you must be granted access to use the samooha_app_role by the DCR administrator for your Snowflake account. When using the API, use your Snowflake login credentials.

Read about the clean rooms API or try out the API tutorial.