AWS PrivateLink and Snowflake¶

AWS PrivateLink: Overview¶

AWS PrivateLink (https://docs.aws.amazon.com/aws-technical-content/latest/aws-vpc-connectivity-options/aws-privatelink.html) is an AWS service for creating private VPC endpoints that allow direct, secure connectivity between your AWS VPCs and the Snowflake VPC without traversing the public internet. AWS PrivateLink connectivity supports VPC endpoint services and AWS VPCs that are located in the same or in different AWS regions. Cross-region connectivity for AWS PrivateLink allows you to use a custom endpoint service to connect a Snowflake account in a region that is different from your AWS VPC region. Cross-region connectivity isn’t currently supported for any platform as a service (PaaS) services, such as Amazon Simple Storage Service (Amazon S3) or key management service (KMS).

For more information, see the AWS blog page, Introducing Cross-Region Connectivity for AWS PrivateLink (https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-cross-region-connectivity-for-aws-privatelink).

When writing external functions, you can also use AWS PrivateLink with private endpoints.

If you have an on-premises environment, such as a non-hosted data center, you can use AWS Direct Connect (https://aws.amazon.com/directconnect/) with AWS PrivateLink to connect all your virtual and physical environments in a single, private network.

Enable AWS PrivateLink¶

To enable AWS PrivateLink for your Snowflake account, complete the following steps:

1. Generate a federated token, and then save the output.

   1. To generate a token, run the AWS CLI STS (https://docs.aws.amazon.com/cli/latest/reference/sts/get-federation-token.html) command on the command line. get-federation-token requires either an identity and access management user in AWS or the AWS account root user. For details, refer to the AWS documentation (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison).

      Important

      The federated token expires after 12 hours. If you call any of the system functions to authorize, verify, or disable your Snowflake account to use AWS PrivateLink and the token has expired, regenerate the token by running the AWS CLI STS command again.

      aws sts get-federation-token --name sam
      

      Copy

      In a later step, you provide the output of this command as the federated_token argument for the SYSTEM$AUTHORIZE_PRIVATELINK function.

   2. From your generated token, extract the value of the "FederatedUserId" field. For example, if your token contains the following values:

      {
       ...
         "FederatedUser": {
           "FederatedUserId": "185...:sam",
           "Arn": "arn:aws:sts::185...:federated-user/sam"
         },
       "PackedPolicySize": 0
      }
      

      Copy

      Extract 185.... In the next step, you provide this 12-digit number as the aws_id argument for the SYSTEM$AUTHORIZE_PRIVATELINK function.

2. Using the ACCOUNTADMIN Snowflake system role, call the SYSTEM$AUTHORIZE_PRIVATELINK function to authorize (enable) AWS PrivateLink for your Snowflake account:

   SELECT SYSTEM$AUTHORIZE_PRIVATELINK ( '<aws_id>' , '<federated_token>' );
   

   Copy

   Where:

   • 'aws_id'

     The 12-digit identifier that uniquely identifies your Amazon Web Services (AWS) account, as a string.

   • 'federated_token'

     The federated token value that contains access credentials for a federated user as a string.

   For example:

   USE ROLE ACCOUNTADMIN;
   
   SELECT SYSTEM$AUTHORIZE_PRIVATELINK (
     '185...',
       '{
         "Credentials": {
           "AccessKeyId": "ASI...",
           "SecretAccessKey": "enw...",
           "SessionToken": "Fwo...",
           "Expiration": "2021-01-07T19:06:23+00:00"
         },
         "FederatedUser": {
           "FederatedUserId": "185...:sam",
           "Arn": "arn:aws:sts::185...:federated-user/sam"
         },
         "PackedPolicySize": 0
        }'
     );
   

   Copy

   To verify your configuration, call the SYSTEM$GET_PRIVATELINK function in your Snowflake account on AWS. This function uses the same argument values for 'aws_id' and 'federated_token' that were used to authorize your Snowflake account.

   SYSTEM$GET_PRIVATELINK returns Account is authorized for PrivateLink. for a successful authorization.

3. Optional: If you need to disable AWS PrivateLink in your Snowflake account, call the SYSTEM$REVOKE_PRIVATELINK function by using the same argument values for 'aws_id' and 'federated_token'.

To further harden your security posture, Snowflake recommends pinning private endpoints for your Snowflake account. For more information, see Pinning private connectivity endpoints for inbound traffic.

Configure your AWS VPC environment¶

Connect to Snowflake¶

Before you connect to Snowflake, you can optionally use the Snowflake Connectivity Diagnostic tool (SnowCD) to evaluate the network connection with Snowflake and AWS PrivateLink.

For more information, see SnowCD and SYSTEM$ALLOWLIST_PRIVATELINK.

Otherwise, connect to Snowflake with your private connectivity account URL.

If you want to connect to Snowsight through AWS PrivateLink, follow the instructions in the Snowsight documentation.

Block public access — Recommended¶

After you test private connectivity to Snowflake by using AWS PrivateLink, you can optionally block public access to Snowflake. This means that users can access Snowflake only if their connection request originates from an IP address within a particular CIDR block range specified in a Snowflake network policy.

To block public access by using a network policy:

1. Create a new network policy or edit an existing network policy.

2. Add the CIDR block range for your organization.

3. Activate the network policy for your account.

For more information, see Controlling network traffic with network policies.

Configure your Snowflake clients¶

The following sections describe how to configure Snowflake clients for specific use cases.

Using SSO with AWS PrivateLink¶

Snowflake supports using SSO with AWS PrivateLink. For more information, see:

• SSO with private connectivity

• Partner applications

Using Client Redirect with AWS PrivateLink¶

Snowflake supports using Client Redirect with AWS PrivateLink.

For more information, see Redirecting client connections.

Using replication and Tri-Secret Secure with private connectivity¶

Snowflake supports replicating your data from the source account to the target account, regardless of whether you enable Tri-Secret Secure or this feature in the target account.

Troubleshooting¶

To troubleshoot problems that you might come across with PrivateLink, see the following Snowflake Community articles:

• How to retrieve a Federation Token from AWS for PrivateLink Self-Service (https://community.snowflake.com/s/article/How-to-retrieve-a-Federation-Token-from-AWS-for-PrivateLink-Self-Service)

• FAQ: PrivateLink Self-Service with AWS (https://community.snowflake.com/s/article/PrivateLink-Self-Service-with-AWS)

• Troubleshooting: Snowflake self-service functions for AWS PrivateLink (https://community.snowflake.com/s/article/Troubleshooting-Snowflake-self-service-functions-for-AWS-PrivateLink)