Skip to content

Setup for Access Management for Snowflake Connector

Runtime tab

The Runtime tab describes the Omni Connector on a Runtime Plane, which is a separate connector from PolicySync. Sections without a Runtime tab apply to PolicySync only.

This section outlines the steps to set up the Snowflake Connector with Policysync Privacera. Please ensure that all prerequisites are completed before starting the setup process.

Create Instance of Snowflake Connector

Note

The Ops Server Setup is required for the Self-Managed (Portal Configuration) setup.

  1. Navigate to Settings → Applications in the Self-Managed Portal.

  2. Select the Snowflake connector under Available Connections.

  3. Enter the application Name and Description, then click Next.

    • The name can be any meaningful identifier, such as sf-connector-1.
    • The description can provide additional context, e.g. Snowflake Connector for dev account xyz.

  4. Click on the application name or the icon. Enable the Access Management toggle.

  1. SSH to the instance where Privacera is installed.

  2. Run the following command to navigate to the /config directory.

    Bash
    1
    cd ~/privacera/privacera-manager/config

  3. Create a new directory for the Snowflake connector's configuration.

    Note

    In the example below, instance1 is the name of the connector instance. You can change this name to uniquely identify your installed connector configuration. The connector instance name should consist of only hyphens and alphanumeric characters.

    Bash
    1
    mkdir -p custom-vars/connectors/snowflake/instance1

  4. Copy the sample connector configuration file to your custom directory:

    Bash
    1
    cp -n sample-vars/vars.connector.snowflake.yml custom-vars/connectors/snowflake/instance1/

  5. Run the following command to open the .yml file to be edited.

    Bash
    1
    vi custom-vars/connectors/snowflake/instance1/vars.connector.snowflake.yml

  1. In PrivaceraCloud, navigate to Settings → Applications.

  2. On the Applications screen, select Snowflake application under Available connections.

  3. Select the Platform Type. Enter the application Name and Description, then click Save. The name can be any name of your choice, e.g. AWS Snowflake for account 123456789012.

  4. Open the Snowflake Application and click Edit to configure it.

  5. Enable the Access Management option using the toggle.

The Omni Connector is configured from the Trust3 AI portal on a Runtime Plane (Self-Managed or Partially Managed (D2P)). For an overview and the data platform prerequisites, see Omni Connector.

  1. In the portal, navigate to Settings → Runtime Plane and open your Runtime Plane.

  2. Open the Connectors tab and select Add New.

  3. Select Snowflake from the available connectors.

  4. Enter the Name and an optional Description.

    • The name can contain lowercase letters, numbers and hyphens, with a single space allowed only between words. It must start and end with a letter or number, and be unique within the Runtime Plane. For example, snowflake-1.

  5. Select the Deployment Mode, then select Continue.

    • Shared: the connector runs inside the Runtime Plane's shared omni-connector application.
    • Dedicated: the connector runs in its own application.
    • The deployment mode cannot be changed after the connector is created. See Deployment mode.

Connection Details

  1. Specify the Snowflake JDBC URL. For example, jdbc:snowflake://dev-environment.snowflakecomputing.com.

    JDBC URL with Underscores in Hostname

    If your Snowflake account hostname contains underscores (e.g., my_account.snowflakecomputing.com), the Snowflake JDBC driver requires an additional parameter. Append allowUnderscoresInHost=true as a query parameter to the JDBC URL:

    Text Only
    1
    jdbc:snowflake://my_account.snowflakecomputing.com/?allowUnderscoresInHost=true
    For more details, refer to the Snowflake JDBC driver documentation.

  2. Provide the Snowflake username and password used to authenticate the JDBC connection.

  3. Specify the Snowflake warehouse and role to be used by Policysync Connector on Snowflake server to execute queries.
  4. Specify the default password for new Snowflake users created by Policysync Connector.

Replace the below example values with your actual values.

Enter these fields under the BASIC tab:

Note

  • To view the property details, click the icon next to the property name.
  • Fields with asterisks (*) are mandatory.
  • Requires restart indicates that the connector pod will restart after updating the property.
  • Cleans RocksDB: When this property is updated, the connector pod initiates a cleanup process to remove cached data and other internal resources from RocksDB. The duration of this process may vary depending on the volume of data and resources being managed.
  • Snowflake JDBC url: jdbc:snowflake://dev-environment.snowflakecomputing.com
  • Snowflake JDBC username: <snowflake-jdbc-username>
  • Snowflake JDBC password: <snowflake-jdbc-password>
  • Snowflake warehouse to use: <snowflake-warehouse>
  • Snowflake role to use: <snowflake-role>
  • Default password for new snowflake user: <default-password>
YAML
1
2
3
4
5
6
7
CONNECTOR_SNOWFLAKE_JDBC_URL: "jdbc:snowflake://dev-environment.snowflakecomputing.com"             
CONNECTOR_SNOWFLAKE_JDBC_DB: "<snowflake-database-name>"             
CONNECTOR_SNOWFLAKE_JDBC_USERNAME: "<snowflake-jdbc-username>" 
CONNECTOR_SNOWFLAKE_JDBC_PASSWORD: "<snowflake-jdbc-password>"       
CONNECTOR_SNOWFLAKE_WAREHOUSE_TO_USE: "<snowflake-warehouse>"      
CONNECTOR_SNOWFLAKE_ROLE_TO_USE: "<snowflake-role>"
CONNECTOR_SNOWFLAKE_DEFAULT_USER_PASSWORD: "<default-password>"

Enter these fields under the BASIC tab:

  • Snowflake JDBC url: jdbc:snowflake://dev-environment.snowflakecomputing.com
  • Snowflake JDBC username: <snowflake-jdbc-username>
  • Snowflake JDBC password: <snowflake-jdbc-password>
  • Snowflake warehouse to use: <snowflake-warehouse>
  • Snowflake role to use: <snowflake-role>
  • Default password for new snowflake user: <default-password>

Under ACCESS CONTROL CONFIGS, in the Snowflake section, enter:

  • Account: the account locator, <org>-<account>. For example, myorg-myaccount.
  • User: the user the connector signs in as.
  • Auth type: Key-pair (RSA JWT) (default), Programmatic access token (PAT), OAuth token or Password (legacy).
  • Private key (PEM) and Private key passphrase: for key-pair authentication. Paste the full PKCS#8 key, including the -----BEGIN and -----END lines. Leave the passphrase empty for an unencrypted key.
  • Token: for PAT and OAuth.
  • Password: for Password. Not recommended.
  • Role: the role used to run scan and grant statements.
  • Warehouse: the warehouse used for the connector's queries.
  • Grant source: how existing grants are read for drift detection. Default INFORMATION_SCHEMA.

Use a small, auto-suspending warehouse. Each scan resumes it, and Snowflake bills a 60-second minimum. For the role, warehouse and key-pair setup, see Prerequisites on the data platform.

Managed Warehouses and Databases

This property is used to set comma-separated warehouse and database names for which access control policies will be applied. Wildcards are supported.

Example: test_warehouse1,test_warehouse2,sales_*.

Warning

  • Values are case-sensitive.
  • Replace the below example value with your actual value.

Under the BASIC tab, enter the values for:

  • Warehouses to manage access control policies: test_warehouse1
  • Databases to manage access control policies: test_database1
YAML
1
2
CONNECTOR_SNOWFLAKE_MANAGE_WAREHOUSE_LIST: "test_warehouse1"
CONNECTOR_SNOWFLAKE_MANAGE_DATABASE_LIST: "test_database1"

Under the BASIC tab, enter the values for:

  • Warehouses to set access control policies: test_warehouse1
  • Databases to set access control policies: test_database1
  • Database name where the masking function for column access control will be created: test_db1
    Specifies the database name in which policysync should create custom masking functions.
    Mandatory when Column access exception is enabled.

Under ACCESS CONTROL CONFIGS, in the Managed Resources section, enter one database name or wildcard pattern per line under Include.

Example: test_database1

A new connector governs nothing until you add an Include entry

Include is empty by default, which means deny-all. Enter * alone to govern everything.

To also govern warehouses, add WAREHOUSE to Resource types governed, and name the warehouses under Include. See Manage Resources List.

Manage Access Audits

By default, access audit is disabled. To enable it, refer to the Manage Access Audits.

Access audits are not available for the Omni Connector (Runtime) on Snowflake. See Supported platforms.

Apply the Configuration

  1. Once all the required fields are filled, click Save.

  2. Download the configuration as a YML file by clicking the icon in the Action column.

  3. Copy the downloaded zip file to the following location on Privacera Manager instance:

    Bash
    1
    ~/privacera/privacera-manager/config/custom-vars/

  4. SSH to the Privacera Manager instance and navigate to the location where zip file is copied and unzip the file:

    Bash
    1
2
    cd ~/privacera/privacera-manager/config/custom-vars/
unzip <file_name>.zip

    Note

    • Backup existing configurations if needed.
    • Ensure unzip is installed on the system.
    • The replacement will only replace files with the same name; other files within the folder remain unchanged.

  5. After all the changes are done you can start the connector by running the following instructions:

    Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh setup
    Step 2 - Apply the Privacera Manager helm charts.
    Bash
    1
2
    cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
    Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

    Bash
    1
2
    cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  6. Once the connector is started, you can manage and monitor it using the Self-Managed portal.

After all the changes are done you can start the connector by running the following instructions:

Step 1 - Setup which generates the helm charts. This step usually takes few minutes.

Bash
1
2
cd ~/privacera/privacera-manager
./privacera-manager.sh setup
Step 2 - Apply the Privacera Manager helm charts.
Bash
1
2
cd ~/privacera/privacera-manager
./pm_with_helm.sh upgrade
Step 3 - (Optional) Post-installation step which generates Plugin tar ball, updates Route 53 DNS and so on. This step is not required if you are updating only connector properties.

Bash
1
2
cd ~/privacera/privacera-manager
./privacera-manager.sh post-install

  1. Once all the required fields are filled, click Save.

  2. The configured Snowflake connector appears under Connected Applications.

  3. Once saved and enabled, the Snowflake connector will start. Then you can hover on the VIEW LOGS button to check the status, either Running or Stopped.

  4. Perform the following steps to restart the Snowflake connector application:

    1. Go to Settings → Applications → select the Snowflake connector application.

    2. Edit the application by disabling the Access Management option with toggle button and then Save it.

    3. Open the same application again and then enable the Access Management option with toggle button and then Save it.

  1. Optionally, set the Scan Schedule under ACCESS CONTROL CONFIGS. Both schedules are off by default, so a new connector scans only when triggered manually. For example, set Metadata scan schedule to 0 0 */4 * * * and Permission sweep schedule to 0 0 */8 * * *. See Scan schedule.

  2. Select Save.

  3. The connector starts after it is saved.

    • Shared: saving restarts the shared omni-connector pod, so every Shared connector on the Runtime Plane is briefly interrupted. To check the status, select View status on the connector row, which opens the shared application under System Applications.
    • Dedicated: the connector's own application starts. Enable, restart and resource controls are on the connector itself.