Create a Snowflake connection to an Edge or Collibra Cloud site

After you install an Edge site or are granted a Collibra Cloud site, you can create a connection to Snowflake.

Do you use a vault?

You can use a vault to add your data source information to your Edge site connection.

Check the connection property table below to see which information is available for your vault.

Vaults are not available for Collibra Cloud sites.
No vault
AWS Secrets Manager
Azure Key Vault
CyberArk Vault
Google Secret Manager
HashiCorp Vault
  
To use your vault, do the following:
  1. In the Value Type field, select Vault Key.
  2. Enter the query value to identify the secret in your vault.
    Example 
    Note The Query must be a string containing the properties required to identify the secret. Each property must be separated by a semicolon (;). For example: Safe=<SafeName>;Folder=<FolderName>;Object=<ObjectName>

    If a property is a folder with sub-folders, use a backslash (\) to define the folder path. For example: Folder=Root\Top Secrets\More Secrets

    For more information about query formats and supported properties, go to the CyberArk Credential Provider documentation.

To use your vault, do the following:
  1. In the Value Type field, select Vault Key.
  2. Enter the required information:
    Secret Engine Type
    Select one of the following:
    • Key Value
    • Database
    Engine Path
    The engine path to your vault where the value is stored.
    Secret Path
    The secret path to your vault where the value is stored.
    Field
    If your Secret Engine Type is Key Value, enter the name of the field to your vault where the value is stored.
    Role
    If your Secret Engine Type is Database, enter the role specified in the Database engine.
    Example 

To use your vault, do the following:
  1. In the Value Type field, select Vault Key.
  2. Enter the required information:
    Vault Name
    The name of your Azure Key Vault in your Azure Key Vault service where the value is stored.
    Secret Name
    The name of the secret in your vault where the value is stored.
    Example 

To use your vault, do the following:
  1. In the Value Type field, select Vault Key.
  2. Enter the required information:
    Secret Name
    The name of the secret in your vault where the value is stored.
    Field
    If the secret stored in your AWS Secrets Manager is a JSON value, for example {"pass1": "my-password", "pass2": "my-password2"}, then you need to specify the Field to point to the exact JSON value that should be used. For example, Secret Name: edge-db-customer; Field: pass.
    Note If the secret stored in your AWS Secrets Manager is a plain string value, for example my-password, then you do not need to specify the Field.
    Example 

To use your vault, do the following:
  1. In the Value Type field, select Vault Key.
  2. Enter the name of the secret in your vault where the value is stored.
    Example 

Prerequisites

In your Collibra environment

  • You either created and installed an Edge site or were granted a Collibra Cloud site.
    Note 

    If you have defined an outbound (forward) proxy on your Edge site, the integration will take that configuration into account when connecting to Snowflake. The following proxies are supported, using either a HTTP or HTTPS proxy URL:

    • Pass through (No authentication)
    • Pass through (Basic authentication)
    • No proxy for noProxy hosts defined by Edge
    • Man-in-the-middle (MITM)

    This integration is not supported on Edge sites installed using a Man-in-the-middle (MITM) proxy.

  • You have added a vault to your Edge site.
  • You have a global role that has the Manage connections and capabilities global permission, for example, Edge integration engineer.

In your Snowflake environment

You must grant the following privileges to a role, and not to an individual user. Authentication uses key-pair or a programmatic access token (PAT). The integration role requires:

  • USAGE privilege on:
    • Each database and schema that holds the objects you want to tag.
    • The database and schema where the tags are stored. Tags are often centralized in a governance schema, so this privilege is required for cross-database tagging.
  • OWNERSHIP privilege on each target object that receives a tag value or description: GRANT OWNERSHIP ON <object> TO ROLE <role>. Outbound synchronization needs this privilege to alter the object and apply the tag value or set a description. Without it, synchronization completes without error but does not apply the tag value or description. For more information, go to the Snowflake documentation.
  • The integration role has one of the following, so that Collibra can apply tag values:
    • APPLY TAG ON ACCOUNT works for all tags, or
    • APPLY on each specific tag object for individual tag-level access.

Steps

  1. Open a site.
    1. On the main toolbar, click Products icon → Cogwheel icon Settings.
      The Settings page opens.
    2. In the tab pane, click Edge.
      The Sites tab opens and shows a table with an overview of your sites.
    3. In the table, click the name of the site whose status is Healthy.
      The site page opens.
  2. In the Connections section, click Create connection.
    The Create connection page appears.
  3. Select the Snowflake connection to connect to Snowflake.
  4. Enter the required information.
    FieldDescriptionRequiredAvailable for vaults?
    Name

    The name of the Edge or Collibra Cloud site connection for Snowflake.

    		 Yes No
    Description

    The description of the connection.

    		 No No
    Vault The vault where you store your data source values. No No
    Account

    The Snowflake account identifier in the following format: org-account. To retrieve the organization account identifier, run this query in Snowflake:

    Copy
    SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME() AS org_account_form;

    Legacy formats such as xy123.eu-west-1 are also accepted. To retrieve the legacy account locator, run this query in Snowflake:

    Copy
    SELECT CURRENT_ACCOUNT() AS account_locator;

    This value can differ from the account name used in your Snowflake JDBC connection. Use the queries above to find the correct value instead of reusing the account name in the Snowflake JDBC connection.

    		 Yes Yes
    Authentication Type

    The type of authentication used to connect to Snowflake. Select one of the following options:

    • Key Pair
    • Username and Password
    • Programmatic Access token
    		 No No
    Username

    The username to authenticate against the Snowflake account.

    		 Yes Yes
    Private Key FileThe private key file in P8 format for key pair authentication. No Yes
    Private Key PassphraseThe password of the private key for key pair authentication. No Yes
    PasswordThe password for username and password authentication. No Yes
    Programmatic Access Token (PAT)The PAT generated for authentication. No Yes
    RoleThe role to use in the Snowflake session. No Yes
    WarehouseThe name of the Snowflake warehouse. If not specified, the user's default warehouse will be used. No  
  5. Click Create.
    The connection is added to the Edge or Collibra Cloud site.

What's next

You can now add the Snowflake capability to an Edge or Collibra Cloud site.