AWS PrivateLink 和 Snowflake¶

AWS PrivateLink: Overview¶

AWS PrivateLink (https://docs.aws.amazon.com/aws-technical-content/latest/aws-vpc-connectivity-options/aws-privatelink.html) is an AWS service for creating private VPC endpoints that allow direct, secure connectivity between your AWS VPCs and the Snowflake VPC without traversing the public internet. AWS PrivateLink connectivity supports VPC endpoint services and AWS VPCs that are located in the same or in different AWS regions. Cross-region connectivity for AWS PrivateLink allows you to use a custom endpoint service to connect a Snowflake account in a region that is different from your AWS VPC region. Cross-region connectivity isn't currently supported for any platform as a service (PaaS) services, such as Amazon Simple Storage Service (Amazon S3) or key management service (KMS).

有关更多信息，请参阅 AWS 博客页面“AWS PrivateLink 的跨区域连接简介 (https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-cross-region-connectivity-for-aws-privatelink)”。

When writing external functions, you can also use AWS PrivateLink with private endpoints.

If you have an on-premises environment, such as a non-hosted data center, you can use AWS Direct Connect (https://aws.amazon.com/directconnect/) with AWS PrivateLink to connect all your virtual and physical environments in a single, private network.

Enable AWS PrivateLink¶

要为您的 Snowflake 账户启用 AWS PrivateLink，请完成以下步骤：

1. 生成联合令牌，然后保存输出。

   1. To generate a token, run the AWS CLI STS (https://docs.aws.amazon.com/cli/latest/reference/sts/get-federation-token.html) command on the command line. get-federation-token requires either an identity and access management user in AWS or the AWS account root user. For details, refer to the AWS documentation (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison).

      重要

      The federated token expires after 12 hours. If you call any of the system functions to authorize, verify, or disable your Snowflake account to use AWS PrivateLink and the token has expired, regenerate the token by running the AWS CLI STS command again.

      aws sts get-federation-token --name sam
      

      Copy

      在后续步骤中，提供此命令的输出作为 SYSTEM$AUTHORIZE_PRIVATELINK 函数的 federated_token 实参。

   2. From your generated token, extract the value of the "FederatedUserId" field. For example, if your token contains the following values:

      {
       ...
         "FederatedUser": {
           "FederatedUserId": "185...:sam",
           "Arn": "arn:aws:sts::185...:federated-user/sam"
         },
       "PackedPolicySize": 0
      }
      

      Copy

      Extract 185.... In the next step, you provide this 12-digit number as the aws_id argument for the SYSTEM$AUTHORIZE_PRIVATELINK function.

2. Using the ACCOUNTADMIN Snowflake system role, call the SYSTEM$AUTHORIZE_PRIVATELINK function to authorize (enable) AWS PrivateLink for your Snowflake account:

   SELECT SYSTEM$AUTHORIZE_PRIVATELINK ( '<aws_id>' , '<federated_token>' );
   

   Copy

   其中：

   • 'aws_id'

     用于唯一标识您的 Amazon Web Services (AWS) 账户的 12 位标识符（字符串）。

   • 'federated_token'

     以字符串形式包含联合用户的访问凭据的联合令牌值。

   例如：

   USE ROLE ACCOUNTADMIN;
   
   SELECT SYSTEM$AUTHORIZE_PRIVATELINK (
     '185...',
       '{
         "Credentials": {
           "AccessKeyId": "ASI...",
           "SecretAccessKey": "enw...",
           "SessionToken": "Fwo...",
           "Expiration": "2021-01-07T19:06:23+00:00"
         },
         "FederatedUser": {
           "FederatedUserId": "185...:sam",
           "Arn": "arn:aws:sts::185...:federated-user/sam"
         },
         "PackedPolicySize": 0
        }'
     );
   

   Copy

   To verify your configuration, call the SYSTEM$GET_PRIVATELINK function in your Snowflake account on AWS. This function uses the same argument values for 'aws_id' and 'federated_token' that were used to authorize your Snowflake account.

   SYSTEM$GET_PRIVATELINK returns Account is authorized for PrivateLink. for a successful authorization.

3. Optional: If you need to disable AWS PrivateLink in your Snowflake account, call the SYSTEM$REVOKE_PRIVATELINK function by using the same argument values for 'aws_id' and 'federated_token'.

To further harden your security posture, Snowflake recommends pinning private endpoints for your Snowflake account. For more information, see 为入站流量固定专用连接端点.

Configure your AWS VPC environment¶

连接到 Snowflake¶

Before you connect to Snowflake, you can optionally use the Snowflake Connectivity Diagnostic tool (SnowCD) to evaluate the network connection with Snowflake and AWS PrivateLink.

有关更多信息，请参阅 SnowCD 和 SYSTEM$ALLOWLIST_PRIVATELINK。

否则，请使用您的专用连接账户 URL 连接到 Snowflake。

If you want to connect to Snowsight through AWS PrivateLink, follow the instructions in the Snowsight documentation.

Block public access --- Recommended¶

After you test private connectivity to Snowflake by using AWS PrivateLink, you can optionally block public access to Snowflake. This means that users can access Snowflake only if their connection request originates from an IP address within a particular CIDR block range specified in a Snowflake network policy.

To block public access by using a network policy:

1. Create a new network policy or edit an existing network policy.

2. 为您的组织添加 CIDR 阻止范围。

3. 激活账户的网络策略。

For more information, see 使用网络策略控制网络流量.

Configure your Snowflake clients¶

以下部分介绍如何为特定用例配置 Snowflake 客户端。

将 SSO 与 AWS PrivateLink 配合使用¶

Snowflake 支持将 SSO 与 AWS PrivateLink 配合使用。有关更多信息，请参阅：

• SSO 与专用连接结合使用

• 合作伙伴应用程序

将 Client Redirect 与 AWS PrivateLink 配合使用¶

Snowflake 支持将 Client Redirect 与 AWS PrivateLink 配合使用。

有关更多信息，请参阅 重定向客户端连接。

将复制和 Tri-Secret Secure 与专用连接配合使用¶

无论您是否在目标账户中启用 Tri-Secret Secure 或此功能，Snowflake 都支持将您的数据从源账户复制到目标账户。

故障排除¶

要解决使用 PrivateLink 时可能出现的问题，请参阅以下 Snowflake 社区文章：

• 如何从 AWS 中为 PrivateLink 自助服务检索联合令牌 (https://community.snowflake.com/s/article/How-to-retrieve-a-Federation-Token-from-AWS-for-PrivateLink-Self-Service)

• FAQ：AWS PrivateLink 自助服务 (https://community.snowflake.com/s/article/PrivateLink-Self-Service-with-AWS)

• 故障排除：适用于 AWS PrivateLink 的 Snowflake 自助函数 (https://community.snowflake.com/s/article/Troubleshooting-Snowflake-self-service-functions-for-AWS-PrivateLink)