为 Google Cloud Storage 配置外部卷¶

Grant Snowflake restricted access to a Google Cloud Storage (GCS) bucket using an external volume. To configure an external volume for Google Cloud Storage, you can use SQL or use Snowsight.

先决条件

在配置外部卷之前，您需要具备以下条件：

Google Cloud Storage 桶。
- To use the external volume for externally managed Iceberg tables, all of your table data and metadata files must be located in the bucket.
- To support data recovery, enable versioning for your external cloud storage location.
Permissions in Google Cloud to create and manage IAM policies and roles. If you aren’t a Google Cloud administrator, ask your Google Cloud administrator to perform these tasks.

To configure an external volume, you can use SQL or Snowsight:

Configure an external volume by using SQL
Configure an external volume in Snowsight

Configure an external volume by using SQL¶

第 1 步：在 Snowflake 中创建外部卷¶

Create an external volume using the CREATE EXTERNAL VOLUME command.

Note

只有账户管理员（具有 ACCOUNTADMIN 角色的用户）可执行此 SQL 命令。

以下示例创建一个外部卷，该卷定义了单个 GCS 加密存储位置：

CREATE EXTERNAL VOLUME my_gcs_external_volume
  STORAGE_LOCATIONS =
    (
      (
        NAME = 'my-us-west-2'
        STORAGE_PROVIDER = 'GCS'
        STORAGE_BASE_URL = 'gcs://mybucket1/path1/'
        ENCRYPTION=(TYPE='GCS_SSE_KMS' KMS_KEY_ID = '1234abcd-12ab-34cd-56ef-1234567890ab')
      )
    );

第 2 步：检索 Snowflake 账户的 GCS 服务账户¶

To retrieve the ID for the GCS service account that was created automatically for your Snowflake account, use the DESCRIBE EXTERNAL VOLUME command. Specify the name of the external volume that you created previously.

例如：

DESC EXTERNAL VOLUME my_gcs_external_volume;

Record the value of the STORAGE_GCP_SERVICE_ACCOUNT property in the output (for example, service-account-id@project1-123456.iam.gserviceaccount.com).

Snowflake 会为您的整个 Snowflake 账户预置一个 GCS 服务账户。所有 GCS 外部卷都使用该服务账户。

第 3 步：授予服务账户访问桶对象的权限¶

In this step, you configure IAM access permissions for Snowflake in your Google Cloud console.

创建自定义 IAM 角色¶

创建具有访问桶和获取对象所需权限的自定义角色。

Log in to the Google Cloud console as a project editor.
From the home dashboard, select IAM & Admin » Roles.
Select Create Role.
Enter a Title and optional Description for the custom role.
Select Add Permissions.
In Filter, select Service and then select storage.
筛选权限列表，并从列表中添加以下内容：
- storage.buckets.get
- storage.objects.create
- storage.objects.delete
- storage.objects.get
- storage.objects.list
Select Add.
Select Create.

Note

For Iceberg tables created from Delta table files, often called Delta Direct, create the role with only storage.buckets.get, storage.objects.get, and storage.objects.list (omit storage.objects.create and storage.objects.delete). For the full comparison with write access on every storage provider, see Read-only vs write access for Delta Direct on each storage provider.

为 GCS 服务账户分配自定义角色¶

Log in to the Google Cloud console as a project editor.
From the home dashboard, select Cloud Storage » Buckets.
筛选桶列表，然后选择创建外部卷时指定的桶。
Select Permissions » View by principals, then select Grant access.
Under Add principals, paste the name of the service account name from the output in 第 2 步：检索 Snowflake 账户的 GCS 服务账户.
Under Assign roles, select the custom IAM role that you created previously, then select Save.

授予 GCS 服务账户对 Google Cloud Key Management Service 密钥的权限¶

Note

This step is required only if your GCS bucket is encrypted using a key stored in the Google Cloud Key Management Service (Cloud KMS).

Log in to the Google Cloud console as a project editor.
From the home dashboard, search for and select Security » Key Management.
选择分配给 GCS 桶的密钥环。
In the upper-right corner, select SHOW INFO PANEL. The information panel for the key ring appears.
In the Add members field, search for the service account name from the DESCRIBE EXTERNAL VOLUME output in 第 2 步：检索 Snowflake 账户的 GCS 服务账户.
From the Select a role dropdown, select the Cloud KMS CryptoKey Encrypter/Decrypter role.
Select Add. The service account name is added to the Cloud KMS CryptoKey Encrypter/Decrypter role drop-down in the information panel.

第 4 步：验证存储访问¶

To check that Snowflake can successfully authenticate to your storage provider, call the SYSTEM$VERIFY_EXTERNAL_VOLUME function.

SELECT SYSTEM$VERIFY_EXTERNAL_VOLUME('my_external_volume');

Note

If you receive the following error, your account administrator must activate AWS STS in the Snowflake deployment region. For instructions, see Manage AWS STS in an AWS Region (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html) in the AWS documentation.

Error assuming AWS_ROLE:
STS is not activated in this region for account:<external volume id>. Your account administrator can activate STS in this region using the IAM Console.

Configure an external volume in Snowsight¶

Step 1: Retrieve the GCS service account for your Snowflake account¶

Sign in to Snowsight.
In the lower-left corner, select your name » Switch role, and then select ACCOUNTADMIN or a role that has the CREATE EXTERNAL VOLUME privilege.

For more information, see Switch your primary role.
In the navigation menu, select Catalog » External data.
Select the External volumes tab.
Select + Create.
Select Google Cloud Storage and then select Next.
From the Grant storage access page, copy the value of the GCS service account into a text editor.

Snowflake 会为您的整个 Snowflake 账户预置一个 GCS 服务账户。所有 GCS 外部卷都使用该服务账户。

Step 2: Grant the service account permissions to access bucket objects¶

In this step, you configure IAM access permissions for Snowflake in your Google Cloud console.

创建自定义 IAM 角色¶

创建具有访问桶和获取对象所需权限的自定义角色。

Log in to the Google Cloud console as a project editor.
From the home dashboard, select IAM & Admin » Roles.
Select Create Role.
Enter a Title and optional Description for the custom role.
Select Add Permissions.
In Filter, select Service and then select storage.
筛选权限列表，并从列表中添加以下内容：
- storage.buckets.get
- storage.objects.create
- storage.objects.delete
- storage.objects.get
- storage.objects.list
Select Add.
Select Create.

为 GCS 服务账户分配自定义角色¶

Log in to the Google Cloud console as a project editor.
From the home dashboard, select Cloud Storage » Buckets.
筛选桶列表，然后选择创建外部卷时指定的桶。
Select Permissions » View by principals, then select Grant access.
Under Add principals, paste the name of the service account name from the output in Step 1: Retrieve the GCS service account for your Snowflake account.
Under Assign roles, select the custom IAM role that you created previously, then select Save.

Step 3: Create an external volume¶

To create an external volume in Snowflake by using Snowsight, follow these steps:

Sign in to Snowsight.
In the lower-left corner, select your name » Switch role, and then select ACCOUNTADMIN or a role that has the CREATE EXTERNAL VOLUME privilege.

For instructions, see Switch your primary role.
In the navigation menu, select Catalog » External data.
Select the External volumes tab.
Select + Create.
Select Google Cloud Storage and then select Next.
Select Next.

Note
You already granted storage access earlier when you retrieved the GCS service account for your Snowflake account and assigned the custom role to the GCS service account.

To configure your external volume, from the Configure external volume page, complete the fields:

Field	Description
External volume name	Enter a name for your external volume.
Storage base URL	Specifies the base URL for your cloud storage location.
Encryption (optional)	Specifies the encryption type used. Possible values are: None (default): No encryption. SSE-KMS (enter key): Server-side encryption using keys stored in KMS. For more information, see customer-managed encryption keys (https://cloud.google.com/storage/docs/encryption/customer-managed-keys).
Access scope	Specifies whether write operations are allowed for the external volume; must be set to Allow writes for the following tables: Iceberg tables that use Snowflake as the catalog. Iceberg tables that use an external catalog and are writable. Externally managed Iceberg tables are writable when you access them through a catalog-linked database that has the ALLOWED_WRITE_OPERATIONS parameter set to TRUE. For Iceberg tables created from Delta table files, setting this parameter to Allow writes enables Snowflake to write Iceberg metadata to your external storage. For more information, see Delta-based tables. The value of this field must also match the permissions that you set on the cloud storage account for each specified storage location. Note You can configure storage permissions so Access scope matches read and write or read-only use, depending on your use case. For comparison tables and Delta Direct guidance, see Read-only vs write access for Delta Direct on each storage provider.
Scope	Choose where this external volume should become the default location for future Iceberg tables. Possible values are: Do not set a default: Don’t set the external volume as a default anywhere. Account: Set the external volume as the default for Iceberg tables that are created under the entire account. Specific database: Set the external volume as the default for Iceberg tables that are created under the database you specify. To specify this database, use the Database drop-down that appears when you select Specific database. Specific schema: Set the external volume as the default for Iceberg tables that are created under the schema you specify. To specify this schema, use the Database drop-down that appears to first select the parent database of the schema and then select the schema.
Comment (optional)	Specifies a comment for the external volume.
Connectivity	Specifies whether to use outbound private connectivity to harden your security posture. For information about using this parameter, see Private connectivity to external volumes for Google Cloud. Possible values are: Public (default): Use the public internet. Private (Private Service Connect): Use outbound private connectivity.

Select Next.

On the Verify connection & create volume page, Snowflake verifies your connection to Google Cloud Storage and then displays a “Successfully connected” message.

Note
If Snowflake is unable to verify your connection, check your permission or external volume configuration and then select Verify again.
Select Create.

Next steps¶

After you configure an external volume, you can create an Iceberg table.

To create a read-only Iceberg table that uses an external catalog, see Configure a catalog integration.
To create an Iceberg table with full Snowflake platform support, see Create a Snowflake-managed table.