Configure an external volume for Google Cloud Storage¶

Step 1: Create an external volume in Snowflake¶

Create an external volume using the CREATE EXTERNAL VOLUME command.

The following example creates an external volume that defines a single GCS storage location with encryption:

CREATE EXTERNAL VOLUME my_gcs_external_volume
  STORAGE_LOCATIONS =
    (
      (
        NAME = 'my-us-west-2'
        STORAGE_PROVIDER = 'GCS'
        STORAGE_BASE_URL = 'gcs://mybucket1/path1/'
        ENCRYPTION=(TYPE='GCS_SSE_KMS' KMS_KEY_ID = '1234abcd-12ab-34cd-56ef-1234567890ab')
      )
    );

Step 2: Retrieve the GCS service account for your Snowflake account¶

To retrieve the ID for the GCS service account that was created automatically for your Snowflake account, use the DESCRIBE EXTERNAL VOLUME command. Specify the name of the external volume that you created previously.

For example:

DESC EXTERNAL VOLUME my_gcs_external_volume;

Copy

Record the value of the STORAGE_GCP_SERVICE_ACCOUNT property in the output (for example, service-account-id@project1-123456.iam.gserviceaccount.com).

Snowflake provisions a single GCS service account for your entire Snowflake account. All GCS external volumes use that service account.

Step 3: Grant the service account permissions to access bucket objects¶

In this step, you configure IAM access permissions for Snowflake in your Google Cloud console.

Step 4: Verify storage access¶

To check that Snowflake can successfully authenticate to your storage provider, call the SYSTEM$VERIFY_EXTERNAL_VOLUME function.

SELECT SYSTEM$VERIFY_EXTERNAL_VOLUME('my_external_volume');

Error assuming AWS_ROLE:
STS is not activated in this region for account:<external volume id>. Your account administrator can activate STS in this region using the IAM Console.

Step 1: Retrieve the GCS service account for your Snowflake account¶

1. Sign in to Snowsight.

2. In the lower-left corner, select your name » Switch role, and then select ACCOUNTADMIN or a role that has the CREATE EXTERNAL VOLUME privilege.

   For more information, see Switch your primary role.

3. In the navigation menu, select Catalog » External data.

4. Select the External volumes tab.

5. Select + Create.

6. Select Google Cloud Storage and then select Next.

7. From the Grant storage access page, copy the value of the GCS service account into a text editor.

   Snowflake provisions a single GCS service account for your entire Snowflake account. All GCS external volumes use that service account.

Step 2: Grant the service account permissions to access bucket objects¶

In this step, you configure IAM access permissions for Snowflake in your Google Cloud console.

Step 3: Create an external volume¶

To create an external volume in Snowflake by using Snowsight, follow these steps:

1. Sign in to Snowsight.

2. In the lower-left corner, select your name » Switch role, and then select ACCOUNTADMIN or a role that has the CREATE EXTERNAL VOLUME privilege.

   For instructions, see Switch your primary role.

3. In the navigation menu, select Catalog » External data.

4. Select the External volumes tab.

5. Select + Create.

6. Select Google Cloud Storage and then select Next.

7. Select Next.

   Note

   You already granted storage access earlier when you retrieved the GCS service account for your Snowflake account and assigned the custom role to the GCS service account.

8. To configure your external volume, from the Configure external volume page, complete the fields:

   Field	Description
   External volume name	Enter a name for your external volume.
   Storage base URL	Specifies the base URL for your cloud storage location.
   Encryption (optional)	Specifies the encryption type used. Possible values are: None (default): No encryption. SSE-KMS (enter key): Server-side encryption using keys stored in KMS. For more information, see customer-managed encryption keys.
   Access scope	Specifies whether write operations are allowed for the external volume; must be set to Allow writes for the following tables: Iceberg tables that use Snowflake as the catalog. Iceberg tables that use an external catalog and are writable. Externally managed Iceberg tables are writable when you access them through a catalog-linked database that has the ALLOWED_WRITE_OPERATIONS parameter set to TRUE. For Iceberg tables created from Delta table files, setting this parameter to Allow writes enables Snowflake to write Iceberg metadata to your external storage. For more information, see Delta-based tables. The value of this field must also match the permissions that you set on the cloud storage account for each specified storage location. Note If you plan to use the external volume for reading externally managed Iceberg tables, you can set this field to Off. Snowflake doesn’t write data or Iceberg metadata files to your cloud storage when you read tables in an external Iceberg catalog.
   Scope	Choose where this external volume should become the default location for future Iceberg tables. Possible values are: Do not set a default: Don’t set the external volume as a default anywhere. Account: Set the external volume as the default for Iceberg tables that are created under the entire account. Specific database: Set the external volume as the default for Iceberg tables that are created under the database you specify. To specify this database, use the Database drop-down that appears when you select Specific database. Specific schema: Set the external volume as the default for Iceberg tables that are created under the schema you specify. To specify this schema, use the Database drop-down that appears to first select the parent database of the schema and then select the schema.
   Comment (optional)	Specifies a comment for the external volume.
   Connectivity	Specifies whether to use outbound private connectivity to harden your security posture. For information about using this parameter, see Private connectivity to external volumes for Google Cloud. Possible values are: Public (default): Use the public internet. Private (Private Service Connect): Use outbound private connectivity.

9. Select Next.

   On the Verify connection & create volume page, Snowflake verifies your connection to Google Cloud Storage and then displays a “Successfully connected” message.

   Note

   If Snowflake is unable to verify your connection, check your permission or external volume configuration and then select Verify again.

10. Select Create.