Snowflake Postgres networking

By default, Snowflake Postgres will provision each new instance inside a new private network in the cloud region you have selected. Each network is separate and private from other networks in the same cloud region.

By default, Snowflake Postgres instances do not allow incoming connections. Traffic to/from your Snowflake Postgres instances can be enabled in either of these two ways:

  • Attach a network policy containing Postgres ingress and/or egress network rules. This option is available for all accounts.

  • Configure Private Link connections to/from cloud vendor private networks. This option is available for Business Critical edition or above accounts.

Snowflake Postgres network policies and rules

Network policies and network rules for Snowflake Postgres instances function much the same as they do for other Snowflake resources with a few key differences:

  • Network policies do not need to be activated to be used with Snowflake Postgres instances in the same way they are for Snowflake accounts, users, and other security integrations. Network policies for Snowflake Postgres instances are instead attached to the instances directly at instance creation time. Existing instances can also have their network policies changed.

  • Snowflake Postgres instances only use the ALLOWED_NETWORK_RULE_LIST and BLOCKED_NETWORK_RULE_LIST properties of network policies. The BLOCKED_IP_LIST and ALLOWED_IP_LIST properties are ignored.

  • Network rules for Snowflake Postgres instances should use either the Postgres Ingress or Postgres Egress modes. Rules using these modes are currently limited to type IPv4.

  • Network rules using other modes other than Postgres Ingress or Postgres Egress in a network policy are ignored by Snowflake Postgres instances that use them.

Privileges

  • To create new network policies, Snowflake users must have the CREATE NETWORK POLICY ON ACCOUNT privilege.

  • To create new network rules, Snowflake users must have the CREATE NETWORK RULE ON SCHEMA privilege.

  • To attach an existing network policy to a Snowflake instance, Snowflake users must own the network policy or the policy’s owner must GRANT usage on it.

Snowflake Postgres network policy and rules example

Let’s say that:

  • You want to allow incoming traffic to a new Postgres instance from your office, and your office network router’s public IP address is 23.206.171.35.

  • You also want to allow outgoing traffic from the new Postgres instance to your office Postgres server via a Postgres Foreign Data Wrapper connection.

For this we’ll create a new policy with both a Postgres Ingress network rule and a Postgres Egress network rule.

  1. Create two new network rules. Use 23.206.171.35/32 as the sole network identifier for both, and use “Postgres Ingress” as the Mode for one and “Postgres Egress” for Mode of the other.

  2. Create a new network policy with both new rules included in its Allowed list.

  3. In the navigation menu, select Postgres.

  4. Select + Create.

  5. When selecting your desired instance configuration details make sure to select your new policy under Network policy select box. In the image below we have selected the policy that we named OFFICE POLICY EXAMPLE.

Create Snowflake Postgres with Network Policy

Creating ingress rules at instance creation time

Instead of creating your network policy and rules before creating your Snowflake Postgres instance, you can create a policy with Postgres ingress rules when creating Snowflake Postgres instances via Snowsight.

  1. In the navigation menu, select Postgres.

  2. In the Postgres Instances page, select the Create button at the top right.

  3. Choose your instance configuration but leave the Network policy choice blank.

  4. After you select the Create, a new dialog displays the snowflake_admin ` Postgres user’s connection credentials. After saving those credentials in a secure location, select ui:Continue to network settings.

  5. In the Network Settings dialog (shown below) enter the IP address and/or CIDR values you wish to create Postgres ingress rules for, pressing enter to add each one to the list.

  6. Expand the Details section to edit your new network rule and/or policy names if needed.

  7. Select Save to create your new Postgres ingress network policy and have it automatically attached to your instance once it is active.

Create Snowflake Postgres ingress network policy at instance create time
Language: English