为 Azure 配置外部卷¶

先决条件¶

在配置外部卷之前，您需要具备以下条件：

• Azure 存储容器。

  • 要将外部卷用于外部管理的 Iceberg 表，所有表数据和元数据文件都必须位于容器中。

  • 为支持数据恢复，为外部云存储位置启用版本控制。

• 在 Azure 中创建和管理 IAM 策略和角色的权限。如果您不是 Azure 管理员，请让 Azure 管理员执行这些任务。

如果使用 Azure 存储防火墙阻止未经授权的流量进入存储账户，请按照 允许 VNet 子网 IDs 中的说明明确授予 Snowflake 访问您的 Azure 存储账户的权限。

Configure an external volume by using SQL¶

CREATE EXTERNAL VOLUME exvol
  STORAGE_LOCATIONS =
    (
      (
        NAME = 'my-azure-northeurope'
        STORAGE_PROVIDER = 'AZURE'
        STORAGE_BASE_URL = 'azure://exampleacct.blob.core.windows.net/my_container_northeurope/'
        AZURE_TENANT_ID = 'a123b4c5-1234-123a-a12b-1a23b45678c9'
      )
    );

SELECT SYSTEM$VERIFY_EXTERNAL_VOLUME('my_external_volume');

Error assuming AWS_ROLE:
STS is not activated in this region for account:<external volume id>. Your account administrator can activate STS in this region using the IAM Console.

Configure an external volume in Snowsight¶

1. Sign in to Snowsight.

2. In the lower-left corner, select your name » Switch role, and then select ACCOUNTADMIN or a role that has the CREATE EXTERNAL VOLUME privilege.

   For more information, see 切换您的主要角色.

3. In the navigation menu, select Catalog » External data.

4. Select the External volumes tab.

5. Select + Create.

6. Select Microsoft Azure & OneLake and then select Next.

7. From the Prerequisites page, for Azure tenant ID, specify your Azure tenant ID.

   To find your Azure tenant ID, see How to find your Microsoft Entra tenant ID (https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) in the Microsoft Entra documentation.

8. Select Next.

9. From the Grant storage access page, to grant Snowflake access to the storage location, follow these steps:

   1. To provide consent for Snowflake to connect to your Azure storage or Microsoft OneLake, select Provide consent.

      The Microsoft permissions request page opens in a new browser tab.

   2. From the Microsoft permissions request page, select Accept. This action allows the Azure service principal created for your Snowflake account to obtain an access token on a specified resource inside your tenant. Obtaining an access token succeeds only if you grant the service principal the appropriate permissions on the storage account level (see the next step).

      Microsoft 权限请求页面会重定向到 Snowflake 公司站点 (snowflake.com)。

   3. In Snowflake, from the Multi-tenant app name field, copy the name of the Snowflake client application created for your account into a text editor. In the next step, you grant this application permission to obtain an access token on your allowed storage location.

10. To grant your application permission to obtain an access token on your allowed storage location, follow these steps:

    1. 登录 Microsoft Azure 门户。

    2. Go to Azure Services » Storage Accounts. Select the name of the storage account that the Snowflake service principal needs to access.

       备注

       您必须在存储账户级别（而非容器级别）为外部卷设置 IAM 权限。

    3. Select Access Control (IAM) » Add role assignment.

    4. 选择要授予 Snowflake 服务主体的读写访问权限的 Storage Blob Data Contributor 角色。

       备注

       Storage Blob Data Contributor 角色授予对外部卷位置的写入访问权限。要完全配置写入访问权限，请将外部卷的 ALLOW_WRITES 参数设置为 TRUE （默认值）。

    5. Select + Select members.

    6. Search for the Snowflake service principal.

       This is the Multi-tenant app name that you copied from Snowflake in the previous step.

       重要

       • Azure 可能需要一个小时或更长时间才能创建通过此部分中的 Microsoft 请求页面请求的 Snowflake 服务主体。如果服务主体不能立即使用，请等待一两个小时，然后再次搜索。

       • 如果删除了服务主体，外部卷将停止工作。

       

    7. 选择 Review + assign。

       备注

       分配角色时，变更最多可能需要 10 分钟才能生效。有关更多信息，请参阅 Microsoft Azure 文档中的 症状 – 未检测到角色分配变更 (https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting?tabs=bicep#symptom---role-assignment-changes-are-not-being-detected)。

11. In Snowflake, select Next.

12. In Snowflake, to configure your external volume, from the Configure external volume page, complete the fields:

    Field	描述
    External volume name	Enter a name for your external volume.
    Storage base URL	Specifies the base URL for your cloud storage location.
    Access scope	Specifies whether write operations are allowed for the external volume; must be set to Allow writes for the following tables: Iceberg tables that use Snowflake as the catalog. Iceberg tables that use an external catalog and are writable. Externally managed Iceberg tables are writable when you access them through a catalog-linked database that has the ALLOWED_WRITE_OPERATIONS parameter set to TRUE. For Iceberg tables created from Delta table files, setting this parameter to Allow writes enables Snowflake to write Iceberg metadata to your external storage. For more information, see 基于 Delta 的表. The value of this parameter must also match the permissions that you set on the cloud storage account for each specified storage location. 备注 If you plan to use the external volume for reading externally managed Iceberg tables, you can set this field to Off. Snowflake doesn't write data or Iceberg metadata files to your cloud storage when you read tables in an external Iceberg catalog.
    Scope	Choose where this external volume should become the default location for future Iceberg tables. Possible values are: Do not set a default: Don't set the external volume as a default anywhere. Account: Set the external volume as the default for Iceberg tables that are created under the entire account. Specific database: Set the external volume as the default for Iceberg tables that are created under the database you specify. To specify this database, use the Database drop-down that appears when you select Specific database. Specific schema: Set the external volume as the default for Iceberg tables that are created under the schema you specify. To specify this schema, use the Database drop-down that appears to first select the parent database of the schema and then select the schema.
    Comment (optional)	Specifies a comment for the external volume.
    Connectivity	Specifies whether to use outbound private connectivity to harden your security posture. For information about using outbound private connectivity, see Microsoft Azure 外部存储卷的专用连接. Possible values are: Public (default): Use the public internet. Private (Azure Private Endpoint): Use outbound private connectivity.

13. Select Next.

    On the Verify connection & create volume page, Snowflake verifies your connection to Azure and then displays a "Successfully connected" message.

    备注

    If Snowflake is unable to verify your connection, check your permission or external volume configuration and then select Verify again.

14. Select Create.

后续步骤¶

配置外部卷后，您可以创建 Iceberg 表。

• 要创建使用外部目录的只读 Iceberg 表，请参阅 配置目录集成。

• 要创建具有完整 Snowflake 平台支持的 Iceberg 表，请参阅 创建 Snowflake 管理的表。