Categories:: System functions (System Information)

SYSTEM$GET_CMK_CONFIG_SNOWFLAKE_MANAGED_VOLUME¶

Returns the cloud-provider configuration you need to authorize Snowflake to use your customer-managed key (CMK) with Tri-Secret Secure for Snowflake storage for Iceberg tables. On AWS, this is a KMS key-policy statement. On Microsoft Azure, this is an Azure CLI command to create a service principal in your tenant.

See also:: Tri-Secret Secure for Snowflake storage for Apache Iceberg™ tables

Syntax¶

SYSTEM$GET_CMK_CONFIG_SNOWFLAKE_MANAGED_VOLUME()

Arguments¶

None.

Returns¶

For AWS, returns a KMS key-policy statement that grants Snowflake the permissions it needs to use your CMK. The Principal.AWS value in the returned statement is specific to your Snowflake account. For example:

{
  "Sid": "Allow Snowflake managed storage to use the key",
  "Effect": "Allow",
  "Principal": { "AWS": "arn:aws:iam::123456789012:user/snowflake-stage-user" },
  "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ],
  "Resource": "*"
}

Important

Call the function to get the ARN for your account. Don’t copy the principal ARN from the preceding example.

For Microsoft Azure, returns an Azure CLI command that creates a service principal for Snowflake in your Azure tenant. For example:

az ad sp create --id 3f8a2c1d-7b4e-4f9a-a6d2-5e1c9b0f7a34

Important

Call the function to get the application ID for your account. Don’t copy the application ID from the preceding example.

After you run the command, grant the service principal the following permissions on your key:

Microsoft.KeyVault/vaults/keys/read
Microsoft.KeyVault/vaults/keys/wrap/action
Microsoft.KeyVault/vaults/keys/unwrap/action

For details, see Activate Tri-Secret Secure for Snowflake storage for Iceberg tables.

Access control requirements¶

Only account administrators (users with the ACCOUNTADMIN role) can call this function.

Usage notes¶

You must register a CMK with SYSTEM$REGISTER_CMK_INFO_SNOWFLAKE_MANAGED_VOLUME before calling this function.

Examples¶

Obtain the cloud-provider configuration for the CMK registered on your Snowflake account:

SELECT SYSTEM$GET_CMK_CONFIG_SNOWFLAKE_MANAGED_VOLUME();