Snowflake

Create an integration to manage access to a Snowflake instance

Snowflake is a fully managed, cloud-based data platform that functions as a data warehouse, data lake, and data sharing solution. With features such as automatic scaling, secure data sharing, and robust data integration, Snowflake offers high performance and flexibility, ensuring seamless data management and analytics.

Through this integration, Apono helps you securely manage access to your Snowflake instance.

Prerequisites

Item

Description

Apono Connector

On-prem connection serving as a bridge between a Snowflake instance and Apono:

OpenSSL

OpenSSL command-line tool installed on your local machine

OpenSSL is an open-source toolkit for implementing Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Snowflake account

Snowflake account with administrative access

Snowflake Hostname

Unique identifier of the Snowflake instance to connect You can use either format:

<organization_name>-<account_name> (Format 1)
<organization_name>-<account_name>.privatelink (if using a private connectivity URL)

NOTE: If your Snowflake hostname uses <account_locator>.<cloud_region_id> (Format 2), you must switch to one of the accepted formats above.

Multi-Factor Authentication (MFA)

MFA for the Snowflake account

Admins must enable MFA for the Snowflake account due to Snowflake’s recent deprecation of non-MFA authentication.

Follow these steps to enable MFA:

In the Snowflake UI, go to Settings > Authentication.
Click Add new authentication method.
Register your chosen authentication method (for example, Passkey or Authenticator).

Public / Private Key Pair

Key-pair authentication and rotation for Snowflake using public and private keys

Learn how to generate a key pair below.

For additional information, visit Snowflake’s documentation.

Generate a key pair

Follow these steps to generate a public-private key pair for authentication between the Apono connector and your Snowflake instance:

In your terminal, run the following command to create a private key.

openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8

When prompted, enter a passphrase for the private key.

Save this passphrase securely. You will need it later when configuring the Apono integration.

In your terminal, run the following command to create a public key.

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

When prompted, enter the passphrase you created in step 2.

Your key pair files are now ready for use during authentication.

Key

Value

Private key

rsa_key.p8

Public key

rsa_key.pub

You will assign the public key to your connector user in Snowflake and add the private key (and its passphrase, if applicable) to your Apono Secret.

Create a Snowflake user

You must create a user in your Snowflake instance for the Apono connector and grant that user permissions to your instance.

Follow these steps to create a user for the Apono connector:

Create a new role called APONOADMIN.

CREATE ROLE APONOADMIN;

Grant the following access to the role. These permissions allow the connector to create users and roles, manage role grants, and monitor account activity, such as running SHOW commands or viewing users, roles, and sessions.

GRANT CREATE USER ON ACCOUNT TO ROLE APONOADMIN;
GRANT CREATE ROLE ON ACCOUNT TO ROLE APONOADMIN;
GRANT MANAGE GRANTS ON ACCOUNT TO ROLE APONOADMIN;
GRANT MONITOR ON ACCOUNT TO ROLE APONOADMIN;

Create a user for the Apono connector. Use APONO_CONNECTOR or another name of your choosing for the username. Be sure to set a strong password for the user.

CREATE USER APONO_CONNECTOR PASSWORD = 'password';

In your Snowflake worksheet, assign the public key to the connector user by copying the key content from your rsa_key.pub file (excluding the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines). Be sure to replace {PUBLIC_KEY} with your actual key value.

ALTER USER APONO_CONNECTOR SET RSA_PUBLIC_KEY='{PUBLIC_KEY}';

This step enables key-pair authentication for the Apono connector. The private key (and passphrase, if applicable) will be stored later in your Apono Secret.

Assign the APONOADMIN role to the user.

GRANT ROLE APONOADMIN TO USER APONO_CONNECTOR;

(Optional) Set the default role for the user.

ALTER USER APONO_CONNECTOR SET DEFAULT_ROLE = APONOADMIN;

Enable multi-factor authentication (MFA).
Create a secret with the credentials from step 3 and your public-private key pair. Use the following structure when generating the secret. Be sure to replace #PRIVATE_KEY and #PASSPHRASE with actual values copied from your rsa_key.p8 file (excluding the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines). If you used a different name for the user, replace APONO_CONNECTOR with the name you assigned to the user.

"username": "APONO_CONNECTOR",
"private_key": "#PRIVATE_KEY"
"passphrase": "#PASSPHRASE"

You can also input the credentials directly into the Apono UI during the integration process (step 8).

You can now integrate your Snowflake instance.

Enable multi-factor authentication (MFA)

Admins must enable MFA for a Snowflake account due to Snowflake’s recent deprecation of non-MFA authentication.

Once MFA is enabled in Snowflake, it cannot be disabled. Password-based authentication will no longer work after MFA is activated.

Follow these steps to enable MFA:

In the Snowflake UI, click Settings > Authentication.
Click Add new authentication method.
Follow the prompts to register your chosen authentication method (for example, Passkey or Authenticator).

Integrate Snowflake

You can also use the steps below to integrate with Apono using Terraform.

In step 11, instead of clicking Confirm, follow the Are you integrating with Apono using Terraform? guidance.

Follow these steps to complete the integration:

On the Catalog tab, click Snowflake. The Connect Integration page appears.
Under Discovery, select one or multiple resource types for Apono to discover in all instances of the environment.
Click Next. The Apono connector section expands.
From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

If the desired connector is not listed, click + Add new connector and follow the instructions for creating a connector (AWS, Azure, GCP, Kubernetes).

Click Next. The Integration Config section expands.
Define the Integration Config settings.
Setting
Description
Integration Name
Unique, alphanumeric, user-friendly name used to identify this integration when constructing an access flow
Hostname
Hostname of the Snowflake instance to connect
Auth Type
(Optional) Authorization type for the Snowflake user
User / Password: Apono-created local user credentials
SSO Auth: Synced user credentials from IdP integration with Snowflake
Role
(Optional) User role associated with the Snowflake instance
Default: ACCOUNTADMIN
SSO Portal URL
(Optional) URL for the SSO portal connected to your Snowflake instance
Click Next. The Secret Store section expands.
Associate the secret or credentials.

If you select the Apono secret manager, enter the following values:

Your Apono Username and Password to verify the apono-connector user. NOTE: The connector Password is a legacy field. Leave this value empty when using Snowflake’s updated version.\
Your Snowflake Private Key to authenticate using your Snowflake key-pair.
Your Snowflake Private Key’s Passphrase, if the private key was generated with a passphrase.

Click Next. The Get more with Apono section expands.
Define the Get more with Apono settings.
Setting
Description
Credential Rotation
(Optional) Number of days after which the database credentials must be rotated Learn more about the Credentials Rotation Policy.
User cleanup after access is revoked (in days)
(Optional) Defines the number of days after access has been revoked that the user should be deleted
Learn more about Periodic User Cleanup & Deletion.
Custom Access Details
(Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.
Integration Owner
(Optional) Fallback approver if no resource owner is found Follow these steps to define one or several integration owners:
From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform.
From the Value dropdown menu, select one or multiple users or groups.
NOTE: When Resource Owner is defined, an Integration Owner must be defined.
Resource Owner
(Optional) Group or role responsible for managing access approvals or rejections for the resource Follow these steps to define one or several resource owners:
Enter a Key name. This value is the name of the tag created in your cloud environment.
From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.
NOTE: When this setting is defined, an Integration Owner must also be defined.
Click Confirm.

💡Are you integrating with Apono using Terraform?

If you want to integrate with Apono using Terraform, follow these steps instead of clicking Confirm:

At the top of the screen, click View as Code. A modal appears with the completed Terraform configuration code.
Click to copy the code.
Make any additional edits.
Deploy the code in your Terraform.

Refer to Integration Config Metadata for more details about the schema definition.

Now that you have completed this integration, you can create access flows that grant permission to your Snowflake instance.

PreviousRedis Cloud (Redislabs)NextVertica

Last updated 15 hours ago

Was this helpful?