Configure AWS PrivateLink Connections for Snowflake Data Sources

Alation Cloud Service Applies to Alation Cloud Service instances of Alation

Alation Cloud Services (ACS) supports connection through AWS PrivateLink enabling secure and private communication.

Alation offers the following abilities for PrivateLink connections:

• Direct AWS PrivateLink connection between Snowflake on AWS and Alation. Alation supports metadata extraction, query log ingestion, and use of Compose through PrivateLink connection.

• AWS PrivateLink connection between other AWS-hosted data source and Alation. For details, refer to AWS PrivateLink with Alation Cloud Service.

Note

The information in this topic only applies to Snowflake on AWS and Alation Cloud Services (ACS) deployments.

In this configuration, you will authorize Alation to connect to Snowflake via AWS PrivateLink.

Before performing these configuration steps, Alation assumes you have already enabled the PrivateLink connection for your Snowflake instance. If you have not done so, see AWS PrivateLink to enable PrivateLink for Snowflake.

Important

To complete the configuration, Alation Support will need to restart your Alation instance, resulting in a brief downtime. The restart will be coordinated through Alation Support. Consider this when planning communications with your users.

ACS Authorization Process

For Alation Cloud Service, the authorization process works as follows:

• Snowflake requires third-party vendor accounts to be authorized through Snowflake Support rather than using self-service functions

• The SYSTEM$AUTHORIZE_PRIVATELINK function is not available for ACS deployments due to Snowflake’s vendor account policies

• Federation tokens are not needed in this process

• Alation Support will provide the ACS AWS account ID specific to your region

• You will provide this account ID to Snowflake Support for authorization

Configure Snowflake PrivateLink Connectivity for ACS

To configure the connection via PrivateLink for Alation Cloud Service:

1. Obtain the PrivateLink CNAME and URLs from your Snowflake instance. You can use the following function to get this information:

   use role accountadmin;
   select system$get_privatelink_config();
   

   This function returns a response similar to the following with actual values:

   {
       "privatelink-account-name":"****.<region>.privatelink",
       "privatelink-vpce-id":"*************",
       "privatelink-account-url":"***.<region>.privatelink.snowflakecomputing.com",
       "regionless-privatelink-account-url":"<name>.privatelink.snowflakecomputing.com",
       "privatelink_ocsp-url":"***.<region>.privatelink.snowflakecomputing.com",
       "privatelink-connection-urls":"[]"
   }
   

2. Create a Support case to contact Alation Support. For information on how to create a Support case, see the Creating a new Alation Support Case section in Alation Support Portal.

   In the support case:

   1. Provide the PrivateLink CNAME and URLs you obtained in Step 1.

   2. Request the following information:

      • The AWS account ID for your Alation Cloud Service instance (specific to your region)

      • The CIDR range for Alation’s VPC

   Important

   For Alation Cloud Service (vendor-managed accounts): Snowflake requires third-party vendor accounts to be authorized through Snowflake Support. You cannot use the self-service SYSTEM$AUTHORIZE_PRIVATELINK function for Alation Cloud Service connections. See Snowflake’s AWS PrivateLink documentation for details on vendor account restrictions.

3. Once you receive the ACS AWS account ID from Alation Support, open a Snowflake Support case to authorize the Alation Cloud Service AWS account:

   1. In your Snowflake Support case, provide:

      • The Alation Cloud Service AWS account ID (received from Alation Support)

      • Your Snowflake account identifier

      • Specify that this is for a third-party vendor (Alation Cloud Service)

   2. Wait for Snowflake Support to confirm that they have authorized the ACS AWS account for your Snowflake account.

   Note

   This authorization is handled by Snowflake Support and may take some time. Track your Snowflake Support ticket for status updates.

4. After Snowflake Support confirms authorization:

   1. Inform Alation Support of the authorization confirmation from Snowflake Support.

   2. Alation Support will configure the AWS resources in Alation’s managed AWS account:

      • Create VPC endpoint(s) in Alation’s AWS account pointing to your Snowflake PrivateLink service

      • Configure security groups and network ACLs

      • Configure DNS CNAMEs for your Snowflake account’s PrivateLink endpoints and OCSP endpoints

   3. While Alation Support configures the AWS resources, update your Snowflake network policy to allow Alation’s CIDR range (provided in Step 2).

5. Once both parties complete their setup (Alation’s AWS resources and your Snowflake network policy), Alation Support will:

   1. Complete the configuration on Alation’s side.

   2. Restart your Alation instance. A brief downtime will occur during the restart.

   3. In your active Alation Support case, confirm that PrivateLink connectivity to your Snowflake instance is functioning.

Once the Support interaction is complete, configure the connection to your Snowflake data source using the information in Configure Connection to Data Source.

Note

When configuring the connection to the data source, provide the JDBC URL in the format <CNAME>.privatelink.snowflakecomputing.com", over the usual Snowflake JDBC URL fromat (snowflake://<hostname>:<port>/?warehouse=<warehouse_name>&db=<db_name>&role=<role_name>).