# Snowflake Snowflake is a fully managed, cloud-based data platform that functions as a data warehouse, data lake, and data sharing solution. With features such as automatic scaling, secure data sharing, and robust data integration, Snowflake offers high performance and flexibility, ensuring seamless data management and analytics. Through this integration, Apono helps you securely manage access to your Snowflake instance. *** ### Prerequisites

Item	Description
Apono Connector	On-prem connection serving as a bridge between a Snowflake instance and Apono: AWS Azure GCP Kubernetes
OpenSSL	OpenSSL command-line tool installed on your local machine OpenSSL is an open-source toolkit for implementing Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.
Snowflake account	Snowflake account with administrative access
Snowflake Hostname	Unique identifier of the Snowflake instance to connect You can use either format: `<organization_name>-<account_name>` (Format 1) `<organization_name>-<account_name>.privatelink` (if using a private connectivity URL) NOTE: If your Snowflake hostname uses `<account_locator>.<cloud_region_id>` (Format 2), you must switch to one of the accepted formats above.
Multi-Factor Authentication (MFA)	MFA for the Snowflake account Admins must enable MFA for the Snowflake account due to Snowflake’s recent deprecation of non-MFA authentication. Follow these steps to enable MFA: In the Snowflake UI, go to Settings > Authentication. Click Add new authentication method. Register your chosen authentication method (for example, Passkey or Authenticator).
Public / Private Key Pair	Key-pair authentication and rotation for Snowflake using public and private keys Learn how to generate a key pair below. For additional information, visit Snowflake’s documentation.

#### Generate a key pair Follow these steps to generate a public-private key pair for authentication between the Apono connector and your Snowflake instance: 1. In your terminal, run the following command to create a private key. {% code overflow="wrap" %} ``` openssl genrsa 2048 | openssl pkcs8 -topk8 -v2 des3 -inform PEM -out rsa_key.p8 ``` {% endcode %} 2. When prompted, enter a passphrase for the private key. {% hint style="success" %} **Save this passphrase securely**. You will need it later when configuring the Apono integration. {% endhint %} 3. In your terminal, run the following command to create a public key. ``` openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub ``` 4. When prompted, enter the passphrase you created in step **2**. Your key pair files are now ready for use during authentication. | Key | Value | | --------------- | ------------- | | **Private key** | `rsa_key.p8` | | **Public key** | `rsa_key.pub` | You will assign the public key to your [connector user in Snowflake](#create-a-snowflake-user) and add the private key (and its passphrase, if applicable) to your Apono Secret. *** ### Create a Snowflake user You must create a user in your Snowflake instance for the Apono connector and grant that user permissions to your instance. Follow these steps to create a user for the Apono connector: 1. [Create a new role](http://docs.snowflake.com/en/user-guide/security-access-control-configure#create-a-role) called *APONOADMIN*. ```sql CREATE ROLE APONOADMIN; ``` 2. Grant the following access to the role. These permissions allow the connector to create users and roles, manage role grants, and monitor account activity, such as running `SHOW` commands or viewing users, roles, and sessions. ```sql GRANT CREATE USER ON ACCOUNT TO ROLE APONOADMIN; GRANT CREATE ROLE ON ACCOUNT TO ROLE APONOADMIN; GRANT MANAGE GRANTS ON ACCOUNT TO ROLE APONOADMIN; GRANT MONITOR ON ACCOUNT TO ROLE APONOADMIN; ``` 3. [Create a user](https://docs.snowflake.com/en/user-guide/admin-user-management#creating-users) for the Apono connector. Use *APONO\_CONNECTOR* or another name of your choosing for the username. Be sure to set a strong password for the user. ```sql CREATE USER APONO_CONNECTOR PASSWORD = 'password'; ``` 4. In your Snowflake worksheet, assign the public key to the connector user by copying the key content from your `rsa_key.pub` file (excluding the `-----BEGIN PUBLIC KEY-----` and `-----END PUBLIC KEY-----` lines). Be sure to replace `{PUBLIC_KEY}` with your actual key value. ``` ALTER USER APONO_CONNECTOR SET RSA_PUBLIC_KEY='{PUBLIC_KEY}'; ``` {% hint style="info" %} This step enables key-pair authentication for the Apono connector. The private key (and passphrase, if applicable) will be stored later in your Apono Secret. {% endhint %} 5. Assign the **APONOADMIN** role to the user. ```sql GRANT ROLE APONOADMIN TO USER APONO_CONNECTOR; ``` 6. (Optional) Set the default role for the user. ```sql ALTER USER APONO_CONNECTOR SET DEFAULT_ROLE = APONOADMIN; ``` 7. [Enable multi-factor authentication (MFA)](#enable-multi-factor-authentication-mfa). 8. [Create a secret](/docs/connectors-and-secrets/apono-integration-secret.md) with the credentials from step **3** and your public-private key pair.\ \ Use the following structure when generating the secret. Be sure to replace `#PRIVATE_KEY` and `#PASSPHRASE` with actual values copied from your `rsa_key.p8` file (excluding the `-----BEGIN PUBLIC KEY-----` and `-----END PUBLIC KEY-----` lines). If you used a different name for the user, replace `APONO_CONNECTOR` with the name you assigned to the user. ``` "username": "APONO_CONNECTOR", "private_key": "#PRIVATE_KEY" "private_key_passphrase": "#PRIVATE_KEY_PASSPHRASE" ``` {% hint style="success" %} You can also input the credentials directly into the Apono UI during the [integration process](#integrate-snowflake) (step **8**). {% endhint %} You can now [integrate your Snowflake instance](#integrate-snowflake). #### Enable multi-factor authentication (MFA) Admins must enable MFA for a Snowflake account due to Snowflake’s recent deprecation of non-MFA authentication. {% hint style="warning" %} Once MFA is enabled in Snowflake, it **cannot** be disabled. Password-based authentication will no longer work after MFA is activated. {% endhint %} Follow these steps to enable MFA: 1. In the Snowflake UI, click **Settings > Authentication**. 2. Click **Add new authentication method**. 3. Follow the prompts to register your chosen authentication method (for example, Passkey or Authenticator). *** ### Integrate Snowflake

{% hint style="success" %} You can also use the steps below to integrate with Apono using Terraform. In step **11**, instead of clicking **Confirm**, follow the **Are you integrating with Apono using Terraform?** guidance. {% endhint %} Follow these steps to complete the integration: 1. On the [**Catalog**](https://app.apono.io/catalog?search=snowflake) tab, click **Snowflake**. The **Connect Integration** page appears. 2. Under **Discovery**, select one or multiple resource types for Apono to discover in all instances of the environment. 3. Click **Next**. The **Apono connector** section expands. 4. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located. {% hint style="success" %} If the desired connector is not listed, click **+ Add new connector** and follow the instructions for creating a connector ([AWS](/docs/aws-environment/apono-connector-for-aws.md), [Azure](/docs/azure-environment/apono-connector-for-azure.md), [GCP](/docs/gcp-environment/apono-connector-for-gcp.md), [Kubernetes](/docs/kubernetes-environment/apono-connector-for-kubernetes.md)). {% endhint %} 5. Click **Next**. The **Integration Config** section expands. 6. Define the **Integration Config** settings.

Setting	Description
Integration Name	Unique, alphanumeric, user-friendly name used to identify this integration when constructing an access flow
Hostname	Hostname of the Snowflake instance to connect
Auth Type	(Optional) Authorization type for the Snowflake user User / Password: Apono-created local user credentials SSO Auth: Synced user credentials from IdP integration with Snowflake
Role	(Optional) User role associated with the Snowflake instance Default: ACCOUNTADMIN
SSO Portal URL	(Optional) URL for the SSO portal connected to your Snowflake instance

7. Click **Next**. The **Secret Store** section expands. 8. [Associate the secret or credentials](/docs/connectors-and-secrets/apono-integration-secret.md). {% hint style="info" %} If you select the Apono secret manager, enter the following values: 1. Your Apono **Username** and **Password** to verify the apono-connector user.\ \ **NOTE**: The connector **Password** is a legacy field. Leave this value empty when using Snowflake’s updated version.
2. Your **Snowflake Private Key** to authenticate using your Snowflake key-pair. 3. Your **Snowflake Private Key’s Passphrase**, if the private key was generated with a passphrase. {% endhint %} 4. Click **Next**. The **Get more with Apono** section expands. 5. Define the **Get more with Apono** settings.

Setting	Description
Credential Rotation	(Optional) Number of days after which the database credentials must be rotated Learn more about the Credentials Rotation Policy.
User cleanup after access is revoked (in days)	(Optional) Defines the number of days after access has been revoked that the user should be deleted Learn more about Periodic User Cleanup & Deletion.
Custom Access Details	(Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.
Integration Owner	(Optional) Fallback approver if no resource owner is found Follow these steps to define one or several integration owners: From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform. From the Value dropdown menu, select one or multiple users or groups. NOTE: When Resource Owner is defined, an Integration Owner must be defined.
Resource Owner	(Optional) Group or role responsible for managing access approvals or rejections for the resource Follow these steps to define one or several resource owners: Enter a Key name. This value is the name of the tag created in your cloud environment. From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono. NOTE: When this setting is defined, an Integration Owner must also be defined.

6. Click **Confirm**.

💡Are you integrating with Apono using Terraform?

If you want to integrate with Apono using Terraform, follow these steps instead of clicking **Confirm**: 1. At the top of the screen, click **View as Code**. A modal appears with the completed Terraform configuration code. 2. Click to copy the code. 3. Make any additional edits. 4. Deploy the code in your Terraform. Refer to [Integration Config Metadata](https://docs.apono.io/metadata-for-integration-config/integration-metadata/snowflake) for more details about the schema definition.

Now that you have completed this integration, you can [create access flows](/docs/access-flows/access-flows.md) that grant permission to your Snowflake instance. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.apono.io/docs/additional-integrations/databases-and-data-repositories/snowflake.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.