Manage private connectivity endpoints: AWS¶

Provision private connectivity endpoints¶

You can use the SYSTEM$PROVISION_PRIVATELINK_ENDPOINT system function to create a private connectivity endpoint by specifying the service or resource, and the hostname. You need to use the ACCOUNTADMIN role when using this system function.

The SYSTEM$PROVISION_PRIVATELINK_ENDPOINT function accepts a provider service name and host name as its arguments. You can obtain these values by using the describe-vpc-endpoint-services subcommand from the AWS command line. As described in the AWS documentation (https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-vpc-endpoint-services.html), this AWS subcommand returns a JSON object with a ServiceName field and a PrivateDnsName field. Use the following table to determine which values to use for the SYSTEM$PROVISION_PRIVATELINK_ENDPOINT function:

For example, to create a PrivateLink with external access to Amazon S3, execute the following SQL statement:

SELECT SYSTEM$PROVISION_PRIVATELINK_ENDPOINT(
  'com.amazonaws.us-west-2.s3',
  '*.s3.us-west-2.amazonaws.com'
);

After you create an endpoint, there is a delay before you can use the endpoint. For information about checking the status of a created endpoint, see SYSTEM$GET_PRIVATELINK_ENDPOINTS_INFO.

Remove a private connectivity endpoint to services¶

You can use the SYSTEM$DEPROVISION_PRIVATELINK_ENDPOINT system function to remove a private connectivity endpoint by specifying the service or resource.

After the endpoint is removed, the endpoint is put on a queue to be deleted after 7 days.

You need to use the ACCOUNTADMIN role when using this system function.

For example, to remove a PrivateLink with external access to Amazon S3, execute the following SQL statement:

SELECT SYSTEM$DEPROVISION_PRIVATELINK_ENDPOINT('com.amazonaws.us-west-2.s3');

Restore a private connectivity endpoint to services¶

You can use the SYSTEM$RESTORE_PRIVATELINK_ENDPOINT system function to restore a removed private connectivity endpoint that is still on the deletion queue by specifying the service or resource. If the endpoint is not found on the deletion queue, then you cannot restore the endpoint.

You need to use the ACCOUNTADMIN role when using this system function.

For example, to restore a PrivateLink with external access to Amazon S3, execute the following SQL statement:

SELECT SYSTEM$RESTORE_PRIVATELINK_ENDPOINT('com.amazonaws.us-west-2.s3');

List all private connectivity endpoints to services¶

You can use the SYSTEM$GET_PRIVATELINK_ENDPOINTS_INFO system function to list all private connectivity endpoints, and information about the endpoints, in your account.

You need to use the ACCOUNTADMIN role when using this system function.

For example, to list all AWS PrivateLink endpoints with AWS services, execute the following SQL statement:

SELECT SYSTEM$GET_PRIVATELINK_ENDPOINTS_INFO();

[
  {
    "provider_service_name": "com.amazonaws.us-west-2.s3",
    "snowflake_endpoint_name": "vpce-123456789012abcdea",
    "endpoint_state": "CREATED",
    "host": "*.s3.us-west-2.amazonaws.com",
    "status": "Available"
  },
  ...
]

For a description of the fields of the JSON object returned by the function, see Returns.