Azure Private Link provides private connectivity to Snowflake by ensuring that access to Snowflake is through a private IP address. Traffic can only occur from the customer virtual network (VNet) to the Snowflake VNet using the Microsoft backbone and avoids the public Internet. This significantly simplifies the network configuration by keeping access rules private while providing secure and private communication.
The following diagram summarizes the Azure Private Link architecture with respect to the customer VNet and the Snowflake VNet.
From either a virtual machine (1) or through peering (2), you can connect to the Azure Private Link endpoint (3) in your virtual network. That endpoint then connects to the Private Link Service (4) and routes to Snowflake.
Here are the high-level steps to integrate Snowflake with Azure Private Link:
Create a Private Endpoint.
Generate and retrieve an access token from your Azure subscription.
Enable your Snowflake account on Azure to use Azure Private Link.
Update your outbound firewall settings to allow the Snowflake account URL and OCSP URL.
Update your DNS server to resolve your account URL and OCSP URL to the Private Link IP address. You can add the DNS entry to your
on-premises DNS server or private DNS on your VNet, and use DNS forwarding to direct queries for the entry from other locations where
your users will access Snowflake.
Configuring Access to Snowflake with Azure Private Link¶
This section only covers the Snowflake-specific details for configuring your VNet environment. Also, note that Snowflake is not responsible for the actual configuration of the required firewall updates and DNS records. If you encounter issues with any of these configuration tasks, please contact Microsoft Support directly.
This section describes how to configure your Azure VNet to connect to the Snowflake VNet on Azure using Azure Private Link. After initiating the connection to Snowflake using Azure Private Link, you can determine the approval state of the connection in the Azure portal.
This procedure manually creates and initializes the necessary Azure Private Link resources to use Azure Private Link to connect to
Snowflake on Azure. Note that this procedure assumes that your use case does not involve Using SSO with Azure Private Link
(in this topic).
As a representative example using the Azure CLI, execute azaccountlist--outputtable. Note the output values in the
Name, SubscriptionID and CloudName columns.
Name CloudName SubscriptionId State IsDefault
------- ---------- ------------------------------------ ------- ----------
MyCloud AzureCloud 13c... Enabled True
Navigate to the Azure portal. Search for Private Link and click Private Link.
Click Private endpoints and then click Add.
In the Basics section, complete the Subscription, Resource group, Name, and Region fields for your environment and then click Next: Resource.
In the Resource section, complete the Connection Method and the Resource ID or Alias Field fields. The Request message value is optional.
For Connection Method, select the Connect to an Azure resource by resource ID or alias.
In Snowflake, execute SYSTEM$GET_PRIVATELINK_CONFIG and input the value for privatelink-pls-id into the Resource ID or Alias field. Note that the screenshot in this step uses the alias value for the east-us-2 region as a representative example, and that Azure confirms a valid alias value with a green checkmark.
Return to the Private endpoints section and allow a few minutes to wait. On approval, the Private Endpoint displays a
CONNECTION STATE value of Pending. This value will update to Approved after completing the authorization in
the next step.
Enable your Snowflake account on Azure to use Azure Private Link by completing the following steps:
In your command line environment, record the private endpoint resource ID value using the following Azure CLI
az network private-endpoint show
The private endpoint was created in the previous steps using the template files. The resource ID value takes the following form,
which has a truncated value:
In your command line environment, execute the following
Azure CLI account command
and save the output. The output will be used as the value for the federated_token argument in the next step.
az account get-access-token --subscription <SubscriptionID>
Extract the access token value from the command output. This value will be used as the federated_token value in the next
step. In this example, the values are truncated and the access token value is eyJ...:
To verify your authorized configuration, call the SYSTEM$GET_PRIVATELINK function in your
Snowflake account on Azure. Snowflake returns AccountisauthorizedforPrivateLink. for a successful authorization.
If it is necessary to disable Azure Private Link in your Snowflake account, call the
SYSTEM$REVOKE_PRIVATELINK function, using the argument values for
private-endpoint-resource-id and federated_token.
DNS Setup. All requests to Snowflake need to be routed via the Private Endpoint. Update your DNS to resolve the Snowflake account and
OCSP URLs to the private IP address of your Private Endpoint.
To get the endpoint IP address, navigate to Azure portal search bar and enter the name of the endpoint
(i.e. the NAME value from Step 5). Locate the Network Interface result and click it.
Copy the value for the Private IP address (i.e. 10.0.27.5).
These endpoint values allow you to access Snowflake, Snowsight, and the Snowflake Marketplace while also using
OCSP to determine whether a certificate is revoked when Snowflake clients attempt to connect to an endpoint
through HTTPS and connection URLs.
The function values to obtain are:
Note that the values for regionless-snowsight-privatelink-url and snowsight-privatelink-url allow access to Snowsight
and the Snowflake Marketplace using private connectivity. However, there is additional configuration if you want to enable URL redirects.
A full explanation of DNS configuration is beyond the scope of this procedure. For example, you can choose to integrate an
Azure Private DNS zone into your environment. Please
consult your internal Azure and Cloud Infrastructure administrators to configure and resolve the URLs in DNS properly.