AWS PrivateLink e Snowflake¶

AWS PrivateLink: Overview¶

AWS PrivateLink is an AWS service for creating private VPC endpoints that allow direct, secure connectivity between your AWS VPCs and the Snowflake VPC without traversing the public internet. AWS PrivateLink connectivity supports VPC endpoint services and AWS VPCs that are located in the same or in different AWS regions. Cross-region connectivity for AWS PrivateLink allows you to use a custom endpoint service to connect a Snowflake account in a region that is different from your AWS VPC region. Cross-region connectivity isn’t currently supported for any platform as a service (PaaS) services, such as Amazon Simple Storage Service (Amazon S3) or key management service (KMS).

For more information, see the AWS blog page, Introducing Cross-Region Connectivity for AWS PrivateLink. For information about finding the region names for your account, see Find the cloud-provider’s name of the region for your account.

When writing external functions, you can also use AWS PrivateLink with private endpoints.

If you have an on-premises environment, such as a non-hosted data center, you can use AWS Direct Connect with AWS PrivateLink to connect all your virtual and physical environments in a single, private network.

Enable AWS PrivateLink¶

Para habilitar o AWS PrivateLink para sua conta Snowflake, complete as seguintes etapas:

1. Gere um token federado e salve a saída.

   1. To generate a token, run the AWS CLI STS command on the command line. get-federation-token requires either an identity and access management user in AWS or the AWS account root user. For details, refer to the AWS documentation.

      Importante

      The federated token expires after 12 hours. If you call any of the system functions to authorize, verify, or disable your Snowflake account to use AWS PrivateLink and the token has expired, regenerate the token by running the AWS CLI STS command again.

      aws sts get-federation-token --name sam
      

      Copy

      Em uma etapa posterior, você fornece a saída deste comando como o argumento federated_token para a função SYSTEM$AUTHORIZE_PRIVATELINK.

   2. From your generated token, extract the value of the "FederatedUserId" field. For example, if your token contains the following values:

      {
       ...
         "FederatedUser": {
           "FederatedUserId": "185...:sam",
           "Arn": "arn:aws:sts::185...:federated-user/sam"
         },
       "PackedPolicySize": 0
      }
      

      Copy

      Extract 185.... In the next step, you provide this 12-digit number as the aws_id argument for the SYSTEM$AUTHORIZE_PRIVATELINK function.

2. Using the ACCOUNTADMIN Snowflake system role, call the SYSTEM$AUTHORIZE_PRIVATELINK function to authorize (enable) AWS PrivateLink for your Snowflake account:

   SELECT SYSTEM$AUTHORIZE_PRIVATELINK ( '<aws_id>' , '<federated_token>' );
   

   Copy

   Onde:

   • 'aws_id'

     O identificador de 12 dígitos que identifica de forma única sua conta no Amazon Web Services (AWS) como uma cadeia de caracteres.

   • 'federated_token'

     O valor do token federado que contém as credenciais de acesso para um usuário federado como uma cadeia de caracteres.

   Por exemplo:

   USE ROLE ACCOUNTADMIN;
   
   SELECT SYSTEM$AUTHORIZE_PRIVATELINK (
     '185...',
       '{
         "Credentials": {
           "AccessKeyId": "ASI...",
           "SecretAccessKey": "enw...",
           "SessionToken": "Fwo...",
           "Expiration": "2021-01-07T19:06:23+00:00"
         },
         "FederatedUser": {
           "FederatedUserId": "185...:sam",
           "Arn": "arn:aws:sts::185...:federated-user/sam"
         },
         "PackedPolicySize": 0
        }'
     );
   

   Copy

   To verify your configuration, call the SYSTEM$GET_PRIVATELINK function in your Snowflake account on AWS. This function uses the same argument values for 'aws_id' and 'federated_token' that were used to authorize your Snowflake account.

   SYSTEM$GET_PRIVATELINK returns Account is authorized for PrivateLink. for a successful authorization.

3. Optional: If you need to disable AWS PrivateLink in your Snowflake account, call the SYSTEM$REVOKE_PRIVATELINK function by using the same argument values for 'aws_id' and 'federated_token'.

To further harden your security posture, Snowflake recommends pinning private endpoints for your Snowflake account. For more information, see Fixação de pontos de extremidade de conectividade privada para tráfego de entrada.

Configure your AWS VPC environment¶

SELECT CURRENT_REGION();

+------------------+
| CURRENT_REGION() |
|------------------|
| AWS_US_WEST_2    |
+------------------+

SHOW REGIONS;

+------------------+-------+-----------|-----------------+
| snowflake_region | cloud | region    | display_name    |
|------------------|-------|-----------|-----------------|
| AWS_US_WEST_2    | aws   | us-west-2 | US West (Oregon)|
+------------------+-------+-----------+-----------------+

Conexão com o Snowflake¶

Before you connect to Snowflake, you can optionally use the Snowflake Connectivity Diagnostic tool (SnowCD) to evaluate the network connection with Snowflake and AWS PrivateLink.

Para obter mais informações, consulte SnowCD e SYSTEM$ALLOWLIST_PRIVATELINK.

Caso conectividade privada, conecte-se ao Snowflake com a URL da sua conta de conectividade privada.

If you want to connect to Snowsight through AWS PrivateLink, follow the instructions in the Snowsight documentation.

Block public access — Recommended¶

After you test private connectivity to Snowflake by using AWS PrivateLink, you can optionally block public access to Snowflake. This means that users can access Snowflake only if their connection request originates from an IP address within a particular CIDR block range specified in a Snowflake network policy.

To block public access by using a network policy:

1. Create a new network policy or edit an existing network policy.

2. Adicione o intervalo de blocos CIDR para sua organização.

3. Ative a política de redes para sua conta.

For more information, see Controle do tráfego de rede com políticas de rede.

Configure your Snowflake clients¶

As seções a seguir descrevem como configurar clientes Snowflake para casos de uso específicos.

Uso de SSO com o AWS PrivateLink¶

O Snowflake oferece suporte ao uso de SSO com o AWS PrivateLink. Para obter mais informações, consulte:

• SSO com conectividade privada

• Aplicativos de parceiros

Uso do redirecionamento do cliente com o AWS PrivateLink¶

O Snowflake oferece suporte ao uso do redirecionamento do cliente com o AWS PrivateLink.

Para obter mais informações, consulte Redirecionamento de conexões do cliente.

Usando replicação e Tri-Secret Secure com conectividade privada¶

O Snowflake oferece suporte à replicação de seus dados da conta de origem para a conta de destino, independentemente de você habilitar o Tri-Secret Secure ou este recurso na conta de destino.

Solução de problemas¶

Para solucionar problemas que você possa encontrar com o PrivateLink, consulte os seguintes artigos da Comunidade Snowflake:

• Como recuperar um token de federação do AWS for PrivateLink Self-Service

• FAQ: PrivateLink Self-Service com AWS

• Solução de problemas: funções de auto-serviço Snowflake para AWS PrivateLink