Preflight checks for Snowflake integration via Edge

Before you can synchronize metadata from Snowflake to Collibra, ensure the CPSH Edge site and Snowflake are properly configured. These tasks, which are performed both in Snowflake and Collibra, enable secure, automated ingestion.

Possible extraction strategies and their impact on required Snowflake permissions

The Snowflake connector can retrieve metadata from 2 system schemas in Snowflake. During the integration process, you define which system you want to reference through the engine-strategy capability property. The chosen strategy has an impact on the permissions you need in Snowflake.

Review the following information to understand which strategy aligns with your environment's scale and freshness requirements and view the permissions impact.

In your Snowflake environment

Snowflake checks

• Identify the Snowflake schemas you want to ingest.
  Optional filtering is available when you configure the synchronization.
• Define the extraction strategy you want to use.

Snowflake required permissions

Note You need a user with the ACCOUNTADMIN role, who can issue grants to other users and roles.

Create the following user and role:

• Create a dedicated CPSH role, for example READONLY_COLLIBRA.

• Give the required warehouse, database, schema, and table-level permissions needed for the ingestion to this dedicated CPSH role.

  Functionality	Required permissions
  Minimum permissions	USAGE on the database and schema. For a schema to be ingested, you need the USAGE privilege on both the parent Database and the Schema. REFERENCES on each table that you want to ingest.
  To use the SNOWFLAKE_ACCOUNT_USAGE extraction strategy, which is optimized for large-scale environments	IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE This privilege gives access to the SNOWFLAKE.ACCOUNT_USAGE schema.
  To ingest source tags	USAGE on the database and schema where the tags must be retrieved from. This depends on the tags-strategy capability property. If the tags-strategy value is CALL_PER_TABLE (default), the sources are INFORMATION_SCHEMA.tag_references_all_columns and INFORMATION_SCHEMA.tag_references tables. You need: GRANT SELECT ON VIEW MY_DB.INFORMATION_SCHEMA.TAG_REFERENCES TO ROLE <role_name>; GRANT SELECT ON VIEW MY_DB.INFORMATION_SCHEMA.TAG_REFERENCES_ALL_COLUMNS TO ROLE <role_name>; If the tags-strategy value is SINGLE_CALL, the source is ACCOUNT_USAGE.tag_references table. You need GRANT SELECT ON VIEW SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES TO ROLE <role_name>; If the tags-strategy value is SKIP, no values are retrieved. For more information, go to About source tags in About synchronizing schemas.
  To ingest data usage statistics to calculate a popularity score:	SELECT on SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY. SELECT on SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTOR For more information, go to About data usage statistics and popularity score.
  To ingest Semantic Views	USAGE on the database and schema containing the Semantic Views. SELECT on the Semantic Views.

• Create a dedicated CPSH user and assign the dedicated CPSH role to this user.

-- 1. Create the integration role
CREATE ROLE COLLIBRA_ROLE;

-- 2. Grant basic access to data objects
GRANT USAGE ON DATABASE <database> TO ROLE COLLIBRA_ROLE;
GRANT USAGE ON SCHEMA <database>.<schema> TO ROLE COLLIBRA_ROLE;
GRANT SELECT, REFERENCES ON ALL TABLES IN SCHEMA <database>.<schema> TO ROLE COLLIBRA_ROLE;

-- 3. Grant access for Account Usage strategy (if selected)
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE COLLIBRA_ROLE;

-- 4. Create the service user
CREATE USER COLLIBRA_USER PASSWORD = 'YourSecurePassword' DEFAULT_ROLE = COLLIBRA_ROLE;
GRANT ROLE COLLIBRA_ROLE TO USER COLLIBRA_USER;

In your Collibra environment

Data source registration configuration setup

You have set up your environment to allow data source registration via Edge. This includes the definition of the Maximum number of ingestion rules setting.

Edge

• You created and installed an Edge site.
  
  Important If you're using a Collibra Cloud site, go the Collibra Cloud site documentation to check if your data source is supported.
• The Edge site status must be Healthy.

Vaults

If required, you have set up a vault (such as HashiCorp Vault) to securely store your connection credentials and tokens when creating your Edge connection.
Vaults are supported only for Edge sites. Collibra Cloud sites do not use external vaults for credential storage.

Collibra required permissions

To create a Snowflake connection and add the Catalog JDBC ingestion capability:

• You have a global role with the Product Rights > System administration global permission.
• You have a global role that has the Manage connections and capabilities global permission.

To register and synchronize the data source:

• You have a global role with the Catalog global permission, for example, Catalog Author.
• You have a global role with the View Edge connections and capabilities global permission, for example, Edge integration engineer.
• You have a resource role with the Configure external system resource permission, for example, Owner.

System asset

You have identified the System asset where you want to add the metadata. For information on how to create an asset, go to Manage assets.

Asset attributes cardinality

Ensure the max cardinality of the asset attributes that you want to ingest is at least 1.

What's next

Create a Snowflake JDBC connection