Connecting Through Snowflake PrivateLink

Hevo provides you with the option of connecting to your Snowflake Destination deployed in an AWS Virtual Private Cloud (VPC) using the PrivateLink service. AWS PrivateLink enables communication and network traffic to remain exclusively within the AWS private network while maintaining direct and secure access across VPCs. It allows Hevo to connect to your Destination without using the public internet, enhancing data security since your data never leaves the AWS network.

This option requires a business plan on your Hevo account. PrivateLink is also a feature of Snowflake Business Critical (or higher), so your Snowflake account must be on a supported edition. Refer to the Snowflake AWS PrivateLink documentation for the edition requirement.

When to Use Snowflake PrivateLink

Snowflake PrivateLink is recommended in the following scenarios:

• Your security or compliance policy prohibits accessing your data warehouse over the public internet.

• Your Snowflake account is deployed in an AWS VPC with no public internet access, so Hevo must connect through a private endpoint to reach it.

The following image illustrates how Hevo connects to your Snowflake Destination through AWS PrivateLink. During the setup, Hevo:

• Creates an intermediate VPC or uses an existing one.

• Creates a VPC interface endpoint for your Snowflake account’s PrivateLink endpoint service.

• Communicates with your Snowflake Destination through the VPC endpoints linked via the AWS PrivateLink.

The following image illustrates the steps for connecting your Snowflake Destination using an AWS PrivateLink. The steps are also described in the sections below.

Request AWS Snowflake PrivateLink

To set up an AWS Snowflake PrivateLink, you must contact Hevo Support. In response to your request, Hevo provides you with a secret file.

This secret file contains a pre-filled SYSTEM$AUTHORIZE_PRIVATELINK command that authorizes Hevo’s AWS account to establish a PrivateLink connection to your Snowflake account. The command includes:

• Hevo’s AWS account ID: The 12-digit identifier of the AWS account that Hevo uses to connect to your Snowflake account.

• Credentials: A short-lived AWS credential containing the access key, secret key, session token, and expiration time.

• FederatedUser: The identity details of the federated user, including the user ID and the ARN (Amazon Resource Name).

• PackedPolicySize: The size of the packed policy associated with the credential.

The following is a sample of the command in the secret file. The values shown are placeholders, and your secret file contains the actual values provided by Hevo. You do not need to change any of these values.

select SYSTEM$AUTHORIZE_PRIVATELINK ('my_account_id', '{
    "Credentials": {
        "AccessKeyId": "ACCESSKEYID",
        "SecretAccessKey": "secretAccessKey",
        "SessionToken": "SessionToken",
        "Expiration": "2022-07-28T21:52:16Z"
    },
    "FederatedUser": {
        "FederatedUserId": "my_account_id:my_iam_federated_user",
        "Arn": "arn:aws:sts::my_account_id:federated-user/my_iam_federated_user"
    },
    "PackedPolicySize": 0
}');

Note: The credentials in the secret file are time-bound and expire after a short period. If they expire before you use the file, contact Hevo Support to obtain a new one.

Authorize the PrivateLink Connection in Snowflake

To authorize Hevo’s account for the PrivateLink connection, run the command from the secret file on your Snowflake SQL worksheet. For this, perform the following steps:

Note: You must have a role with the ACCOUNTADMIN privilege to run the following commands.

1. Log in to your Snowflake account.

2. In the left navigation pane, click Projects.

   

3. In the Workspaces tab, click + Add new, and then click SQL file to create a SQL worksheet.

   

4. In the role selector at the top right of the worksheet, ensure that the ACCOUNTADMIN role is selected. If it is not, click the drop-down and select that role.

   

5. Copy the SYSTEM$AUTHORIZE_PRIVATELINK command from the secret file provided by Hevo, and paste it into the worksheet.

6. Click the Run icon to execute the command.

   Running this command creates a PrivateLink endpoint service for Hevo’s account in Snowflake’s AWS account.

Retrieve the PrivateLink Configuration and Share It with Hevo

After you authorize the connection, retrieve your Snowflake PrivateLink configuration and share it with Hevo Support. For this, perform the following steps:

1. In the same worksheet, run the following command:

   select SYSTEM$GET_PRIVATELINK_CONFIG();
   

2. This command returns your Snowflake account’s PrivateLink configuration as a set of values that Hevo needs to establish the connection from its side. The output includes the following values:

   • privatelink-account-name: The name of your Snowflake account in the PrivateLink format.

   • privatelink-vpce-id: The VPC endpoint service name that Hevo uses to create the interface endpoint for your account.

   • privatelink-account-url: The account URL used to connect to Snowflake over PrivateLink.

   • regionless-privatelink-account-url: The region-independent version of the account URL.

   • privatelink_ocsp-url: The URL used for certificate validation over the private connection.

   • privatelink-connection-urls: The list of authorized PrivateLink connection URLs for your account.

   Sample Output:

   {
       "privatelink-account-name":"account_id.region.privatelink",
       "privatelink-vpce-id":"com.amazonaws.vpce.region.vpc_id",
       "privatelink-account-url":"account_id.region.privatelink.snowflakecomputing.com",
       "regionless-privatelink-account-url":"eashymt-account_id.privatelink.snowflakecomputing.com",
       "privatelink_ocsp-url":"ocsp.account_id.region.privatelink.snowflakecomputing.com",
       "privatelink-connection-urls":"[]"
   }
   

3. Copy the complete output and provide it to Hevo Support.

Using this configuration, Hevo creates the VPC interface endpoint, configures the required DNS records, and finalizes the PrivateLink connection on Hevo’s side. Once Hevo confirms that the connection is established, you can configure your Snowflake Destination in Hevo.

Revision History