This is an updated and improved version of the Snowflake connector! If you’re setting up Snowflake with ConductorOne for the first time, you’re in the right place.

Capabilities

Available hosting methods

Choose the hosting method that best suits your needs:

Gather Snowflake credentials

Each setup method requires you to pass in credentials generated in Snowflake. Gather these credentials before you move on.

A user with Manage Grants global privilege in Snowflake must perform this task.

For best results, use a dedicated service account. ConductorOne will use the DEFAULT_WAREHOUSE, DEFAULT_NAMESPACE, and DEFAULT_ROLE properties of the user used for the integration. For this reason, we recommend creating a dedicated service account in Snowflake for integrating with ConductorOne with these default user properties.

Generate a private key and set the public key on a Snowflake user

1. Generate an unencrypted private key in PEM format by running the following command:

   openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
   

2. Next, use the private key to generate the public key. Run the following command:

   openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
   

3. To enable public key authentication for a Snowflake user, execute the following ALTER USER command. You must have the ACCOUNTADMIN role to perform this operation:

   ALTER USER <SNOWFLAKEUSER> SET RSA_PUBLIC_KEY='MIIBIj...';
   

   Tip: When setting the RSA_PUBLIC_KEY, extract the key content between the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines from your public key file. Do not include the header or footer. The key should be a single continuous string.

4. Carefully save the private key.

Look up your account identifier

1. Find your account identifier by navigating in the Snowflake console to your account, selecting your user, and finding the alphanumeric code listed under Locator.

That’s it! Next, move on to the instructions for your chosen setup method.

Set up a Snowflake cloud-hosted connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in ConductorOne
• Access to the set of Snowflake credentials generated by following the instructions above

1. In ConductorOne, click Connectors > Add connector.

2. Search for Snowflake and click Add.

3. Choose how to set up the new Snowflake connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. In the Account URL field, enter the full URL of your Snowflake instance.

8. In the Account ID / Locator field, enter your Snowflake account identifier.

9. In the Username field, enter your Snowflake username.

10. In the RSA Private Key (PEM Format) field, upload the private key file.

11. Click Save.

12. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Snowflake connector is now pulling access data into ConductorOne.

Set up a Snowflake cloud-hosted connector using Terraform

As an alternative to the cloud-hosted setup process described above, you can use Terraform to configure the integration between Snowflake and ConductorOne.

See the ConductorOne Snowflake v2 integration resource page in the ConductorOne Terraform registry for example usage and the full list of required and optional parameters.

Set up a Snowflake self-hosted connector

To complete this task, you’ll need:

• The Connector Administrator or Super Administrator role in ConductorOne
• Access to the set of Snowflake credentials generated by following the instructions above

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals. This data is immediately available in the ConductorOne UI for access reviews and access requests.

Why use Kubernetes? Kubernetes provides automated deployment, scaling, and management of your connectors. It ensures high availability and reliable operation of your connector services.

Step 1: Configure the Snowflake connector

1. In ConductorOne, navigate to Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Snowflake connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Snowflake connector deployment:

Secrets configuration

# baton-snowflake-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-snowflake-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>
  
  # Snowflake credentials
  BATON_ACCOUNT_IDENTIFIER: <Snowflake account identifier>
  BATON_ACCOUNT_URL: <Snowflake account URL>
  BATON_PRIVATE_KEY: <Path to saved Snowflake private key in PEM format>

  # Optional: include if you want ConductorOne to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-snowflake.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-snowflake
  labels:
    app: baton-snowflake
spec:
  selector:
    matchLabels:
      app: baton-snowflake
  template:
    metadata:
      labels:
        app: baton-snowflake
        baton: true
        baton-app: snowflake
    spec:
      containers:
      - name: baton-snowflake
        image: ghcr.io/conductorone/baton-snowflake:latest
        args: ["service"]
        imagePullPolicy: IfNotPresent
        envFrom:
        - secretRef:
            name: baton-snowflake-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run ConductorOne connectors (if desired):

   kubectl create namespace baton-snowflake
   

2. Apply the secret configuration:

   kubectl -n baton-snowflake apply -f baton-snowflake-secrets.yaml
   

3. Apply the deployment:

   kubectl -n baton-snowflake apply -f baton-snowflake.yaml
   

Step 4: Verify the deployment

1. Check that the deployment is running:

   kubectl -n c1 get pods
   

2. View the connector logs:

   kubectl -n c1 logs -l app=baton-${baton-snowflake}
   

3. Check that the connector data uploaded correctly. In ConductorOne, click Applications. On the Managed apps tab, locate and click the name of the application you added the Snowflake connector to. Snowflake data should be found on the Entitlements and Accounts tabs.

That’s it! Your Snowflake connector is now pulling access data into ConductorOne.

Troubleshooting the Snowflake v2 connector

If you’re seeing a 422 unprocessible entity or 401 unauthorized error in the logs, make sure that your service account has the DEFAULT_WAREHOUSEproperty, and that you’ve correctly looked up your Snowflake account identifier.