Installing the Snowflake Data Clean Rooms environment¶

About the accounts used on this page¶

Three sets of account credentials are involved in installing a clean rooms environment:

• Your Snowflake account: This is a Snowflake account used to install the clean rooms environment with ACCOUNTADMIN privilege. Use these credentials only when specified.

• Your clean rooms administrator account: This is the account used to log into the clean rooms web application. These credentials are maintained and managed by Snowflake Data Clean Room independently of your Snowflake account. Use a new name and password for this account. When you are signed in to the clean rooms web application, if you need to perform Snowflake administrator functions, you will sign in with your Snowflake credentials within the web app.

• A service account: The web application uses a service account to communicate with Snowflake. This account is granted limited permissions from your Snowflake account. You will create the service account during clean rooms installation, after which you do not need to save your service account credentials or manage the service account.

1. Request a Snowflake Data Clean Room environment¶

You must first request a clean rooms environment for your Snowflake account:

1.1 Request a clean rooms environment:

1. Visit the sign-up page.

2. Enter your Snowflake account identifier in hyphenated format: ORGNAME-ACCOUNT_NAME. This account must have ACCOUNTADMIN privileges.

3. Enter an email address for your clean rooms account. You must be able to receive email to this address. It can be a group address if you want to share clean room management with multiple users. It does not need to be the email address associated with your Snowflake account.

4. Provide a company name used to brand clean rooms for this account. You can change this name later.

5. Select Sign Up, which will send a verification email.

1.2 When you receive the verification email:

1. Select Verify Email` to re-open the sign up page in your browser.

2. Specify a name and password for your clean rooms account. We recommend not re-using your Snowflake name and password.

3. Select Sign up.

4. When redirected to a new page, sign in to your clean room environment your clean rooms credentials (the email, name, and password you provided when requesting an environment).

5. Enroll in a multi-factor authentication (MFA) system to use clean rooms.

6. If you are associated with multiple clean room environments, select the Snowflake account that you are configuring.

Next, install the clean room environment in your account.

2. Install the clean rooms native application¶

When your initial clean rooms request is granted, you will be able install the clean room environment. The clean room environment is a native web application that runs in your account. These steps will install the native application into your account. After installation, you can grant access to the environment to anyone in that Snowflake account.

2.1 Create a service account user. The clean room environment uses this service account to access Snowflake for all clean room users.

1. If you aren’t already in the web application, open the clean rooms web application with your clean room credentials and, if prompted, select the Snowflake account that you are configuring.

2. In the left navigation pane, select Admin > Snowflake Admin > Log in to Snowflake and sign in with Snowflake credentials you provided when requesting a clean room environment.

3. Navigate to Admin > Snowflake Admin > Install data clean room native app > Service account - new Snowflake user. Follow the steps to create a service account user that clean rooms will use when accessing Snowflake. Save these account details, you will use them again when you verify the service account email.

   1. Enter an email address to identify the service account. You must have access to this email address.

   2. In the New Snowflake Username field, specify a service account name unique to this Snowflake account. We recommend using a name that indicates this is a service account.

   3. Specify a service account password.

   4. Select Create to create the service account user.

   5. Select Verify Status to send a verification email to your service account email.

   6. Open the verification email and select Validate your email.

   7. Sign in using the service account credentials you just provided above. ⚠️ If prompted, do not enroll in multi-factor authentication (MFA). This is because once you have verified the service account user, name+password authentication will no longer be used for the service user account; key-pair authentication will be used instead.

   8. Select Verify Status and sign out of the account or close the browser tab.

2.2 Install the Snowflake Native App associated with Snowflake Data Clean Rooms:

1. Open the clean rooms web application with your clean rooms administrator account credentials.

2. Navigate to Admin > Snowflake Admin > Install data clean room native app > Service account - new Snowflake user. Your service account information should be shown at the top of the page, marked Authenticated.

3. (Optional) Review the code that will install the Snowflake Native App by scrolling down to the Setup Scripts section. Do not execute this code manually and do not change the default name of the application.

4. Select Install to install the Snowflake Native App. The process of installing the Snowflake Native App takes several minutes. Periodically select Refresh to check whether it is complete before proceeding to the next step.

For information about what is installed in your Snowflake account when you use Snowflake Data Clean Rooms, see Snowflake Data Clean Rooms: Installation details

Next, configure your environment.

3. Configure the clean rooms environment¶

You need to configure the clean rooms environment after it has been installed:

• Register data in your environment. In order to use Snowflake data in a clean room, it must first be registered by an account administrator. Only registered data can be linked into a clean room by a clean room creator.

• Add DCR administrators. DCR administrators manage the web application on a day-to-day basis, add other administrators and clean room managers, can enable and configure connectors available to clean rooms, and do other tasks.

• Add clean room managers. Clean room managers are able to use the web application to create clean rooms, or act as consumers when a clean room is shared with them.

• Add developers. Grant API access to developers in your Snowflake account so they can create or consume clean rooms in your account.

• Enable SSO for your account. If your account uses SSO to manage authentication, learn how to enable SSO for your clean room environment.

• Enable Cross-Cloud Auto-Fulfillment. By default, clean rooms can be shared only with consumers in the same underlying cloud region as the clean room creator. If you want to enable a clean room to be shared with consumers in a different cloud region, you must enable Cross-Cloud Auto-Fulfillment for your account.