# AWS PrivateLink and Snowflake Open Catalog

This feature requires Business Critical (or higher).

To ask about upgrading, contact [Snowflake Support](https://docs.snowflake.cn/user-guide/contacting-support).

This topic describes how to configure AWS PrivateLink to directly connect your Snowflake Open Catalog account to your query engine by
using inbound private connectivity.

## Prerequisites

- Your Snowflake Open Catalog account is hosted on AWS.
- You have the necessary permissions to configure your AWS DNS service with the private connectivity URL for your Open Catalog account.
  For guidance, see How to configure the AWS DNS service (Route 53) to access Snowflake via a PrivateLink (https://community.snowflake.com/s/article/How-to-configure-the-AWS-DNS-service-Route-53-to-access-Snowflake-via-a-PrivateLink) in the Snowflake Community.

## Step 1: Enable AWS PrivateLink

In this procedure, you enable AWS PrivateLink for your Open Catalog account. This configuration allows the query engine to connect to
Open Catalog through private connectivity. You will need the 12-digit identifier for your Amazon Web Services (AWS) account and
the federated token value that contains access credentials for a federated user.

1. To obtain the federated token value, execute the following command by using the AWS CLI and copy the value into a text editor:

   ```bash
   aws sts get-federation-token --name sam
   ```

1. Sign in to Snowflake Open Catalog.
1. In the navigation menu, select **Settings**.
1. Select **Authorize**.
1. In the **Authorize Private Link** dialog, enable private connectivity for your account:
   1. In the **ID** field, enter the 12-digit identifier for your Amazon Web Services (AWS) account.
   1. For **Federated token**, enter the federated token value that you copied to a text editor.
   1. Select **Save**.

## Step 2: Verify that your account is authorized

To verify whether your Open Catalog account is authorized for private connectivity to the Snowflake Open Catalog service, follow this procedure:

1. Sign in to Snowflake Open Catalog.
1. In the navigation menu, select **Settings**.
1. Select **Get**.
1. In the Get Private Link authorization dialog, verify your account:
   1. In the **ID** field, enter the 12-digit identifier for your Amazon Web Services (AWS) account.
   1. In the **Federated token** field, enter the federated token value.
      You retrieved this value when you [enabled AWS PrivateLink](#step-1-enable-aws-privatelink).
   1. Select **Save**. A message appears, which states whether your account is authorized.

## Step 3: Retrieve your Open Catalog account settings

Retrieve these settings, which you'll need later to create and configure a VPC endpoint and your VPC network.

1. Sign in to Snowflake Open Catalog.
1. In the navigation menu, select **Settings**.
1. On the Settings page, copy the values for the following settings into a text editor:

   - PrivateLink Account URL
   - Regionless PrivateLink Account URL
   - PrivateLink OCSP URL
   - Regionless PrivateLink OCSP URL
   - VPCE Service ID

You paste these values when you [create and configure a VPC endpoint (VPCE)](#step-4-create-and-configure-a-vpc-endpoint),
[configure your VPC network](#step-5-configure-your-vpc-network), and [connect to Open Catalog through AWS PrivateLink](#step-6-connect-to-open-catalog-through-aws-privatelink).

For descriptions of each setting, see
[Return values for the SYSTEM$GET_PRIVATELINK_CONFIG system function](https://docs.snowflake.cn/en/sql-reference/functions/system_get_privatelink_config#returns) in the Snowflake documentation. In this topic, the names of the account settings are in JSON format.

Remember that, where applicable, the description refers to a Snowflake account but your value is actually for your Snowflake Open
Catalog account. For example, the `privatelink-account-url` is the URL for your Snowflake Open Catalog account.

- Optional: To retrieve these values in JSON format, [Create a Snowflake CLI connection for Open Catalog](private-connectivity-outbound-manage-endpoints-aws#step-1-create-a-snowflake-cli-connection-for-open-catalog),
  and then call the SYSTEM$GET_PRIVATELINK_CONFIG system function.
- In the Snowflake documentation, `privatelink-vpce-id` corresponds to the VPCE Service ID in Open Catalog.

## Step 4: Create and configure a VPC endpoint

In this procedure, you create and configure a corresponding VPC endpoint (VPCE) in your AWS VPC environment.

If you already created a VPC endpoint for your Snowflake account, and the account is in the same deployment as your Open Catalog account,
creating a new VPC endpoint for your Open Catalog account isn't required. You can optionally skip this step.

For instructions, see
[Create and configure a VPC endpoint (VPCE)](https://docs.snowflake.cn/en/user-guide/admin-security-privatelink#create-and-configure-a-vpc-endpoint-vpce)
in the Snowflake documentation, starting with step 2.

## Step 5: Configure your VPC network

To configure your VPC network, create CNAME records in your DNS service to resolve the appropriate endpoint values from your
[Open Catalog account settings for private connectivity](#step-3-retrieve-your-open-catalog-account-settings) to the DNS name of your VPC Endpoint.

For instructions, see [Configure your VPC network](https://docs.snowflake.cn/en/user-guide/admin-security-privatelink#configure-your-vpc-network)
in the Snowflake documentation. Remember that these instructions are for Snowflake, so some of the features mentioned in them don't apply
to Open Catalog. For example, `regionless-snowsight-privatelink-url` is for Snowsight, which isn't supported in Open Catalog.

For additional help with DNS configuration, contact your internal AWS administrator.

## Step 6: Connect to Open Catalog through AWS PrivateLink

- To register a service connection and connect your query engine to Snowflake Open Catalog through AWS PrivateLink, use the code:

  

### Parameters

Ensure that you set up your DNS service to match the value you specify for `<open_catalog_account_identifier>`.

## Step 7 (Optional): Create a catalog integration for Snowflake