Set up Openflow - Snowflake Deployment: Core Snowflake¶

Openflow - Snowflake Deployment requires the creation of the following Snowflake specific resources:

Create the OPENFLOW_ADMIN role

Configure required privileges

To complete these tasks, Sign in to Snowsight and open a SQL worksheet.

Create the OPENFLOW_ADMIN role¶

Create the required Openflow administration role.

Note

<OPENFLOW_USER> denotes the user that will be used to access Openflow.

USE ROLE ACCOUNTADMIN;

CREATE ROLE IF NOT EXISTS OPENFLOW_ADMIN;

GRANT ROLE OPENFLOW_ADMIN TO USER <OPENFLOW_USER>;

Caution

Users with a default role of ACCOUNTADMIN can’t login to Openflow - Snowflake Deployment runtimes and will get an error message when attempting to do so. Snowflake recommends assigning a different default role to any user that will login to a runtime. In addition, Snowflake recommends setting default secondary roles to ALL for all Openflow users.

To change the default role and enable all secondary roles, execute the following:

For example:

USE ROLE ACCOUNTADMIN;

ALTER USER <openflow_user> SET DEFAULT_ROLE = <openflow_admin>;
ALTER USER <openflow_user> SET DEFAULT_SECONDARY_ROLES = ('ALL');

Configure required privileges¶

Openflow requires defining specific Snowflake account-level privileges. These privileges are assigned to the ACCOUNTADMIN role as part of the default set of privileges. ACCOUNTADMIN will automatically have the following privileges and will be able to grant them to a role of their choosing for the Openflow admin role, shown as OPENFLOW_ADMIN role in the following examples.

Gen 2 privileges¶

Gen 2 deployments are account-level objects, while runtimes and connectors are schema-level objects. Those schema-level objects need a database and schema to live in. Snowflake recommends designating one database and schema to hold your Openflow infrastructure objects, which keeps them easy to manage.

Grant the Openflow admin role the account-level privileges it needs:

USE ROLE ACCOUNTADMIN;

GRANT CREATE OPENFLOW DEPLOYMENT ON ACCOUNT TO ROLE OPENFLOW_ADMIN;
GRANT CREATE DATABASE ON ACCOUNT TO ROLE OPENFLOW_ADMIN;
GRANT CREATE INTEGRATION ON ACCOUNT TO ROLE OPENFLOW_ADMIN;

-- Snowflake deployments only:
GRANT CREATE COMPUTE POOL ON ACCOUNT TO ROLE OPENFLOW_ADMIN;

Create the database and schema that will hold your gen 2 Openflow objects:
```
USE ROLE OPENFLOW_ADMIN;

CREATE DATABASE IF NOT EXISTS openflow_db;
CREATE SCHEMA IF NOT EXISTS openflow_db.openflow_schema;
```
This is your Openflow infrastructure database and schema, also referred to as the control schema. Your deployments’ runtimes, your connectors, and any secrets those connectors reference live here. You create it once and reuse it.

Important
Keep the infrastructure database separate from the databases your connectors write data to. Snowflake recommends a dedicated destination database per connector.
A connector creates destination schemas and tables named after the source’s schemas and tables. Those names aren’t under your control and can change as the source changes, so pointing a connector at your infrastructure database risks collisions with the Openflow objects that live there.

Grant the Openflow admin role the ability to create gen 2 objects in that schema:

USE ROLE ACCOUNTADMIN;

GRANT CREATE OPENFLOW RUNTIME ON SCHEMA openflow_db.openflow_schema TO ROLE OPENFLOW_ADMIN;
GRANT CREATE OPENFLOW CONNECTOR ON SCHEMA openflow_db.openflow_schema TO ROLE OPENFLOW_ADMIN;

For the full gen 2 setup workflow, see Quickstart: gen 2 Openflow.

Gen 1 privileges¶

USE ROLE ACCOUNTADMIN;

GRANT CREATE OPENFLOW DATA PLANE INTEGRATION ON ACCOUNT TO ROLE OPENFLOW_ADMIN;
GRANT CREATE OPENFLOW RUNTIME INTEGRATION ON ACCOUNT TO ROLE OPENFLOW_ADMIN;
GRANT CREATE DATABASE ON ACCOUNT TO ROLE OPENFLOW_ADMIN;
GRANT CREATE INTEGRATION ON ACCOUNT TO ROLE OPENFLOW_ADMIN;
GRANT CREATE COMPUTE POOL ON ACCOUNT TO ROLE OPENFLOW_ADMIN;

Next steps¶

Optionally, Set up PrivateLink UI access to access the Snowflake Openflow Runtime UI using private connectivity.

Create deployment