Azure Private Link and Snowflake Open Catalog¶

Create a private endpoint¶

1. Retrieve your Azure account details. The following example uses the Azure CLI's az account list command.

   Name     CloudName   SubscriptionId                        State    IsDefault
   -------  ----------  ------------------------------------  -------  ----------
   MyCloud  AzureCloud  13c...                                Enabled  True
   

   Copy

2. In the Azure portal, search for Private Link, and then select Private Link in the results.

   

3. Click Private endpoints, and then click Add.

   

4. On the Basics tab, complete the Subscription, Resource group, Name, and Region fields for your environment and then click Next: Resource.

5. On the Resource tab, for Connection Method, select Connect to an Azure resource by resource ID or alias.

6. For Resource ID or alias, enter the value for Private Link Service ID that you obtained when you
   retrieved your Open Catalog account settings for private connectivity.

   If you receive an error message regarding the alias value, contact Snowflake Support for the resource ID value, and then repeat this step using that value.

When the private endpoint is approved, the CONNECTION STATE in the Private endpoints section on the Private Link Center page displays the value Pending. This value changes to Approved when you complete the authorization in the next procedure.

Enable inbound private connectivity¶

In this procedure, you enable Azure Private Link for your Open Catalog account. This configuration allows the query engine to connect to Open Catalog through private connectivity. You will need your private endpoint resource ID, a subscription ID, and the federated token value that contains access credentials for a federated user.

1. To obtain these values, execute the following commands in the Azure CLI:

   1. To obtain your private endpoint resource ID, execute the following command, and copy the value into a text editor:

      az network private-endpoint show
      

      Copy

   2. To obtain the subscription ID, execute the following command, and note the value in the SubscriptionID column in the output:

      az account list --output table
      

      Copy

   3. To obtain the federated token value, execute the following command, and copy the accessToken value into a text editor:

      az account get-access-token --subscription <SubscriptionID>
      

      Copy

      • Where: SubscriptionID is the unique identifier you obtained in the previous step.

      重要

      The user generating the Azure access Token must have Read permissions on the Subscription. The least privilege permission is Microsoft.Subscription/subscriptions/acceptOwnershipStatus/read (https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftsubscription). Alternatively, the default role Reader grants more coarse-grained permissions.

      The accessToken value is sensitive information and should be treated like a password value — do not share this value.

      如果需要，请联系 Snowflake 支持部门，在创建支持工单之前编辑任何命令和 URLs 中的访问令牌。

2. Sign in to Snowflake Open Catalog.

3. In the navigation menu, select Settings.

4. Select Authorize.

5. In the Authorize Private Link dialog, enable private connectivity for your account:

   1. For ID, enter the private endpoint resource ID that you copied to a text editor.

   2. For Federated token, enter the federated token value that you copied to a text editor.

   3. Select Save.

Verify that your account is authorized¶

Follow these steps to verify whether your Open Catalog account is authorized for private connectivity to the Snowflake Open Catalog service.

1. Sign in to Snowflake Open Catalog.

2. In the navigation menu, select Settings.

3. Select Get.

4. In the Get Private Link authorization dialog, verify your account:

   1. In the ID field, enter your private endpoint resource ID. You retrieved this value when you enabled inbound private connectivity.

   2. In the Federated token field, enter the federated token value. You retrieved this value when you enabled inbound private connectivity.

   3. Select Save. A message appears, which states whether your account is authorized.

Set up DNS¶

All requests to Open Catalog must be routed through the private endpoint. To resolve the Open Catalog account and OCSP URLs to the private IP address of your private endpoint, update your DNS.

1. To get the endpoint IP address, in the Azure portal search bar, enter the name of the private endpoint you created.

2. Select the Network Interface result.

   

3. Copy the value for the Private IP address.

   

4. Configure your DNS to have the appropriate endpoint values from your Open Catalog account settings for private connectivity resolve to the private IP address.

参数¶