Planning an External Function for Azure¶

Azure Portal¶

You can use the Azure Portal to create an Azure Function (as the remote service) and an API Management service instance (as the proxy service). If you choose this method, you also use the Azure Portal to configure security-related settings.

The instructions for creating an external function using the Azure Portal include a sample Azure Function and details for creating a basic API Management service instance:

• First-time users can use the instructions and sample Azure Function with little or no modification.

• Experienced users can use the instructions and sample Azure Function as a starting point for creating a custom Azure Function and a custom-configured API Management service instance.

ARM (Azure Resource Manager) Template¶

An ARM template uses JSON to describe configuration information about an Azure Function (as the remote service) and an Azure API Management service instance (as the proxy service).

Snowflake provides a sample ARM template that includes the following:

• Sample Azure Function.

• Most of the configuration information for a sample API Management service. You must enter some additional information if you wish to customize the sample API Management service.

• Code to create a storage account needed by the Azure Functions service.

• Code to add a validate-JWT (JSON Web Token) Policy to the API Management instance in order to increase security of the Azure API Management service. However, you must manually update the validate-JWT policy before using it.

ARM templates can be useful for both first-time and experienced users:

• First-time users might want to start with the Snowflake sample template because it reduces the number of steps required to create the Azure Function and the API Management service instance.

  Note that although the template-based instructions help you create your first external function quickly, they skip steps that most users need when creating customized external functions.

• Experienced users might want to use ARM templates because templates can be used to automate deployment. This can be useful if you are developing an Azure Function and API Management service iteratively.

For more information about configuring Azure Functions using ARM templates, see the Microsoft documentation: reource deployment .

Choose the Pricing Plan for Your Azure Function¶

In Microsoft Azure, an Azure Function (remote service) can run on a Linux host or Windows host. At this time, Azure offers different combinations of pricing and authentication options for Linux and Windows hosts.

If you plan to run your Azure Function on Linux, then you must choose a valid combination of Azure pricing plan and authentication:

• If you use the Premium or App Service pricing plan:

  • Create the Azure AD (Active Directory) application from the Authentication/Authorization tab on the Azure Functions screen in the Azure Portal.

  • Use Azure AD for authentication with the Azure Functions service.

  Additional details and links are provided later in the instructions for creating a remote service.

• If you use the Consumption pricing plan:

  • Manually create the Azure AD application in the Azure Portal. Additional details are provided later in the instructions for creating a remote service.

  • Set a validate-JWT policy for the API Management instance. For details, see Step 6: Create the Azure Security Policy for the Proxy Service in the Portal.

  • Use IP address restrictions to limit the remote service to accept connections only from the API Management service instance. For details, see Restrict the IP Addresses That Accept Azure Functions Calls (Optional).

Create a Worksheet for Tracking Required Information¶

As you complete the tasks to create an external function in the Azure Portal, you are required to enter specific values (e.g. API Management service name) during each step in the process. Often, the values you enter are required in subsequent steps.

To facilitate recording/tracking this information, we’ve provided a worksheet with fields for each of the required values:

================================================================================
======================= Tracking Worksheet: Azure Portal =======================
================================================================================

****** Step 1: Azure Function (Remote Service) Info ****************************

Azure Function app name: _______________________________________________________
HTTP-Triggered Function name: __________________________________________________
Azure Function AD app registration name: _______________________________________
Azure Function App AD Application ID: __________________________________________

    (The value for the Azure Function App AD Application ID above is the
    "Application (client) ID" of the Azure AD app registration for the
    Azure Function. The value is used to fill in the "azure_ad_application_id"
    field in the CREATE API INTEGRATION command. This value is in the form of a
    UUID (universally unique identifier), which contains hexadecimal digits and
    dashes.)


****** Step 2: Azure API Management Service (Proxy Service) Info ***************

API Management service name: ___________________________________________________
API Management API URL suffix: _________________________________________________


****** Steps 3-5: API Integration & External Function Info *********************

API Integration Name: __________________________________________________________
AZURE_MULTI_TENANT_APP_NAME: ___________________________________________________
AZURE_CONSENT_URL: _____________________________________________________________

External Function Name: ________________________________________________________

Download the Template¶

The template is available to download from the Snowflake repository in GitHub.

Before you can use the template, you must import it into the Azure Portal. Details for importing the template are included later in the topic that describes using the template.

Choose the Pricing Plan for Your Azure Function¶

In Microsoft Azure, an Azure Function (remote service) can run on a Linux host or Windows host. At this time, Azure offers different combinations of pricing and authentication options for Linux and Windows hosts.

The Snowflake-provided ARM template defaults to using the following pricing plan and authentication information:

• Defaults to using a Windows host for the Azure Function.

• Defaults to the “Consumption” pricing tier.

• Creates an Azure Functions app, and configures that app to require AD (Active Directory) authentication.

• Creates a security policy to validate a JWT (JSON Web Token) that authorizes Snowflake to call your Azure Function.

  Note that this security policy is missing one field; instructions provided later tell you how to fill in this field.

If you plan to run your Azure API management instance or Azure Function with a different configuration, you must update the template. For information about updating the template, see the Microsoft documentation:

• Automating resource deployment (for your function app in Azure Functions)

Create a Worksheet for Tracking Required Information¶

As you complete the tasks to create an external function using the ARM template provided by Snowflake, you are required to enter specific values (e.g. API Management service name) during each step in the process. Often, the values you enter are required in subsequent steps.

To facilitate recording/tracking this information, we’ve provided a worksheet with fields for each of the required values:

================================================================================
======================= Tracking Worksheet: ARM Template =======================
================================================================================

****** Step 1: Azure Function (Remote Service) Info ****************************

HTTP-Triggered Function name: __________________ echo __________________________
Azure Function AD Application ID: ______________________________________________

    (The value for the Azure Function AD Application ID above is the
    "Application (client) ID" of the Azure AD app registration for the
    Azure Function. The value is used to fill in the "azure_ad_application_id"
    field in the CREATE API INTEGRATION command. This value is in the form of a
    UUID (universally unique identifier), which contains hexadecimal digits and
    dashes.)


****** Step 2: Azure API Management Service (Proxy Service) Info ***************

API Management service name: ___________________________________________________
API Management URL: ____________________________________________________________
Azure Function HTTP Trigger URL: _______________________________________________
API Management API URL suffix: _________________________________________________


****** Steps 3-5: API Integration & External Function Info *********************

API Integration Name: __________________________________________________________
AZURE_MULTI_TENANT_APP_NAME: ___________________________________________________
AZURE_CONSENT_URL: _____________________________________________________________

External Function Name: ________________________________________________________