Getting started with Snowflake Data Clean Rooms¶
This topic describes the tasks an administrator must complete to set up Snowflake Data Clean Rooms.
Prerequisites¶
In order to use a Snowflake Data Clean Room, your account must:
If you do not meet certain requirements and need to upgrade, contact Snowflake Support.
Capacity account¶
You need a Snowflake account that has an upfront capacity commitment to use Snowflake Data Clean Rooms.
Snowflake On Demand accounts cannot create or use a clean room.
Snowflake Edition¶
Use the following table to determine which Snowflake Edition is required for the Snowflake account of a clean room collaborator:
Collaborator |
Task |
Required Snowflake Edition |
|---|---|---|
Provider |
Create a clean room |
Enterprise Edition or higher |
Consumer |
Join and use a clean room |
Standard Edition or higher |
Provider & Consumer Terms¶
Before using a Snowflake Data Clean Room as a provider or consumer, you need to agree to additional Snowflake terms and abide by Snowflake policies. For details, see Legal requirements for providers and consumers of listings.
Sign up for a Snowflake Data Clean Room environment¶
Important
The user who initially signs up as a clean room participant must have the ACCOUNTADMIN role in the Snowflake account associated with the clean room environment. This clean room administrator needs to use the ACCOUNTADMIN role to configure the Snowflake account in subsequent steps in the getting started process.
Do not install the native app from the Snowflake Marketplace. Instead, use the sign up link to sign up. After signing up for the clean room environment, follow the steps to install the app as described in Configure the Snowflake account.
To sign up and log in to the clean room environment:
Navigate to the sign-up page.
Enter the account identifier of your Snowflake account using the hyphenated form of the account name format (that is,
orgname-acctname).Enter your email address.
Specify a company name, which is used to identify the clean room environment when users sign in.
Select Sign Up. You are sent an email.
After receiving the email, do the following:
Select Verify Email. The sign up page re-opens.
Specify a Name and Password.
Select Sign up.
Add IP addresses to your allowed list¶
If your Snowflake account uses a network policy to control network traffic, you must explicitly allow traffic from the IP addresses that the web app uses to communicate with your Snowflake account.
Use the following to determine which IP addresses must be allowed by the network policy based upon the region of your Snowflake account on Amazon Web Service (AWS), Microsoft Azure (Azure), or Google Cloud Platform (GCP):
Snowflake account region |
Web app IP addresses |
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
Configure the Snowflake account¶
A Snowflake user with the ACCOUNTADMIN role must configure the Snowflake account associated with the clean room environment before users can create and use clean rooms.
Note
The user with the ACCOUNTADMIN role must have a valid first name, last name, and email defined for their user object. To verify whether these properties are defined, execute the DESCRIBE USER command.
To configure the Snowflake account, you complete the following tasks:
Create a service account user that represents the clean room environment so clean rooms can access the Snowflake account.
Install a Snowflake Native App that allows clean rooms to interact with data in a Snowflake account.
Register the databases, schemas, and objects that contain the data that collaborators can access in clean rooms.
To configure the Snowflake account for a clean room environment:
Access the Snowflake Admin console in the clean room environment. Do the following:
Navigate to the sign in page.
Enter your email address, and select Continue.
Enter your password.
If you are associated with multiple clean room environments, select the Snowflake account that you are configuring.
In the left navigation, select Snowflake Admin.
Select Login to Snowflake, and authenticate as a Snowflake user with the ACCOUNTADMIN role.
Specify the details for the service account user that clean rooms use to interact with Snowflake. Be sure to remember these details as you will need them in a subsequent step. Do the following:
Enter the email address associated with the service account user.
In the New Snowflake Username field, specify a name that is unique to the Snowflake account.
Specify a password.
Select Create to create the service account user.
Verify the email of the new service account user. Do the following:
Select Log into your Snowflake account.
Sign in to Snowsight using the credentials of the service account user. You specified these in the previous step.
To open the user menu, select the username of the service account user, and then select My profile.
Select Resend verification email. A verification email is sent to the email address of the service account user.
Access the email inbox of the service account user, open the verification email, and select Validate Your Email.
Return to the Snowflake Admin console of the clean room environment, and select Verify Status.
To install the Snowflake Native App associated with Snowflake Data Clean Rooms (
SAMOOHA_BY_SNOWFLAKE), follow these steps:Optional: Use the Setup Scripts section to review the code that is executed in your account to install the Snowflake Native App. Do not execute this code manually.
Do not change the default name of the application.
Select Install to install the Snowflake Native App.
The process of installing the Snowflake Native App can take some time. Periodically select Refresh to check whether it is complete before proceeding to the next step.
In the Database Registration section, select the databases, schemas, and objects that contain the data that you want collaborators to be able to access in clean rooms. Registering a database or schema registers all of the objects within that database or schema.
The web app of Snowflake Data Clean Rooms supports the following objects:
Tables
Views
Materialized views
Secure views. The owner of a secure view must be the SAMOOHA_APP_ROLE role.
Note
Once you complete these steps, new objects added to registered databases or schemas are not available to clean room collaborators immediately. If an object is added to a registered database or schema, you need to use the web app’s Snowflake Admin option to return to the Database Registration section, and then select Resync.
Enable collaboration with consumers in different regions¶
In order to collaborate with a Snowflake customer whose account is in a different region than your account, you must enable Cross-Cloud Auto-Fulfillment for your clean room environment. A Snowflake user with the ACCOUNTADMIN role must enable Cross-Cloud Auto-Fulfillment before clean room administrators can add accounts in other regions as collaborators.
To configure your clean room environment to allow collaborators to be in a different region:
Navigate to the sign in page.
Enter your email address, and select Continue.
Enter your password.
If you are associated with multiple clean room environments, select the Snowflake account that you are configuring.
In the left navigation, select Snowflake Admin.
Select Login to Snowflake, and authenticate as a Snowflake user with the ACCOUNTADMIN role.
Toggle on Cross-Cloud Auto-Fulfillment.
Costs associated with cross-region collaboration¶
There are additional costs associated with collaborators who are in a different region. For more information about how these costs are incurred, see Understand Cross-Cloud Auto-Fulfillment costs.
Limitations on cross-region collaboration¶
Limitations on cross-region collaboration include the following:
Collaborators must share the same web app hosting region. For example, if the web app hosting region for one account is Amazon Web Services: US East (N. Virginia) and the web hosting region for another account is Amazon Web Services: Asia Pacific (Mumbai), then the two Snowflake customers cannot collaborate. To determine whether two collaborators share the same web app hosting region, see Web app hosting.
A provider cannot use differential privacy in the clean room.
A provider cannot view the request logs being sent from the consumer of a clean room.
A consumer cannot run a multi-provider analysis.
Collaborators cannot use masking policies or row access policies.
Troubleshooting¶
Use this section to troubleshoot problems you might have after completing the steps in this topic.
- Symptom: Insufficient privileges
Solution: Ensure that the IP addresses associated with the web app are allowed by your network policies. For a list of these IP addresses, see Add IP addresses to your allowed list.
- Symptom: Installation is successful, but the web app is not functioning properly.
Solution #1: Use the DESCRIBE USER command to double-check that the Snowflake user that you used to configure Snowflake has a valid first name, last name, and email. If the user is missing any of these, execute the ALTER USER command to specify them.
Solution #2: Try uninstalling the Snowflake Native App for Snowflake Data Clean Rooms, and then re-installing it.
To uninstall the app, see Uninstall a Snowflake Native App. If you installed the application with its default name, it is called SAMOOHA_BY_SNOWFLAKE.
To re-install the app:
In the left navigation, select Snowflake Admin.
Select Login to Snowflake, and authenticate as a Snowflake user with the ACCOUNTADMIN role.
Use the DESCRIBE USER command to confirm that the Snowflake user with the ACCOUNTADMIN role that you just used to authenticate has a valid first name, last name, and email. If the user is missing any of these, execute the ALTER USER command to specify them.
To install the Snowflake Native App, select Install.
Accept the default name of the application during the installation process.
Next steps¶
For additional steps needed to set up a clean room environment, including adding users and collaborators, see Snowflake Data Clean Rooms: Administrator tasks.