Enabling error notifications for tasks using AWS SNS¶

Step 1: Creating an Amazon SNS Topic¶

Create an SNS topic in your AWS account to handle all error messages. Record the Amazon Resource Name (ARN) for the SNS topic.

To reduce latency and avoid data egress charges for sending notifications across regions, we recommend creating the SNS topic in the same region as your Snowflake account.

For instructions, see the Creating an Amazon SNS topic in the SNS documentation.

Step 2: Creating the IAM Policy¶

Create an AWS Identity and Access Management (IAM) policy that grants permissions to publish to the SNS topic. The policy defines the following actions:

• sns:publish

  Publish to the SNS topic.

1. Log into the AWS Management Console.

2. From the home dashboard, choose Identity & Access Management (IAM):

3. Choose Account settings from the left-hand navigation pane.

4. Expand the Security Token Service Regions list, find the AWS region corresponding to the region where your account is located, and choose Activate if the status is Inactive.

5. Choose Policies from the left-hand navigation pane.

6. Click Create Policy.

7. Click the JSON tab.

8. Add a policy document that defines actions that can be taken on your SNS topic.

   Copy and paste the following text into the policy editor:

   {
       "Version": "2012-10-17",
       "Statement": [
         {
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "<sns_topic_arn>"
         }
       ]
    }
   

   Copy

   Replace sns_topic_arn with the ARN of the SNS topic you created in Step 1: Creating an Amazon SNS Topic (in this topic).

9. Click Review policy.

10. Enter the policy name (e.g. snowflake_sns_topic) and an optional description. Click Create policy.

Step 3: Creating the AWS IAM Role¶

Create an AWS IAM role on which to assign privileges on the SNS topic.

1. Log into the AWS Management Console.

2. From the home dashboard, choose Identity & Access Management (IAM):

3. Choose Roles from the left-hand navigation pane.

4. Click the Create role button.

5. Select Another AWS account as the trusted entity type.

6. In the Account ID field, enter your own AWS account ID temporarily.

7. Select the Require external ID option. This option enables you to grant permissions on your Amazon account resources (i.e. SNS) to a third party (i.e. Snowflake).

   For now, enter a dummy ID such as 0000. Later, you will modify the trust relationship and replace the dummy ID with the external ID for the Snowflake IAM user generated for your account. A condition in the trust policy for your IAM role allows your Snowflake users to assume the role using the notification integration object you will create later.

8. Click the Next button.

9. Locate the policy you created in Step 2: Creating the IAM Policy (in this topic), and select this policy.

10. Click the Next button.

11. Enter a name and description for the role, and click the Create role button.

12. Record the Role ARN value located on the role summary page. You will specify this value in one or more later steps.

Step 4: Creating the Notification Integration¶

Create a notification integration using CREATE NOTIFICATION INTEGRATION. An integration is a Snowflake object that references the SNS topic you created.

A single notification integration can support multiple tasks and pipes.

CREATE NOTIFICATION INTEGRATION <integration_name>
  ENABLED = true
  TYPE = QUEUE
  NOTIFICATION_PROVIDER = AWS_SNS
  DIRECTION = OUTBOUND
  AWS_SNS_TOPIC_ARN = '<topic_arn>'
  AWS_SNS_ROLE_ARN = '<iam_role_arn>'

Where:

<integration_name>

Name of the new integration.

DIRECTION = OUTBOUND

Direction of the cloud messaging with respect to Snowflake. Required only when configuring error notifications.

<topic_arn>

SNS topic ARN you recorded in Step 1: Creating an Amazon SNS Topic (in this topic).

<iam_role_arn>

IAM role ARN you recorded in Step 3: Creating the AWS IAM Role (in this topic).

For example:

CREATE NOTIFICATION INTEGRATION my_notification_int
  ENABLED = true
  TYPE = QUEUE
  NOTIFICATION_PROVIDER = AWS_SNS
  DIRECTION = OUTBOUND
  AWS_SNS_TOPIC_ARN = 'arn:aws:sns:us-east-2:111122223333:sns_topic'
  AWS_SNS_ROLE_ARN = 'arn:aws:iam::111122223333:role/error_sns_role';

Step 5: Granting Snowflake Access to the SNS Topic¶

Step 6: Enabling error notifications in tasks¶

You then enable error notification, in either a standalone or root task, by setting ERROR_INTEGRATION to the name of the notification integration. You can set the property when you create a task (using CREATE TASK) or later (using ALTER TASK).

For details refer to Configuring a task to send error notifications.