Configure AWS PrivateLink Connections for Snowflake Data Sources

Alation Cloud Service Applies to Alation Cloud Service instances of Alation

Alation Cloud Services (ACS) supports connection through AWS PrivateLink enabling secure and private communication.

Alation offeres the following abilities for PrivateLink connections:

• Direct AWS PrivateLink connection between Snowflake on AWS and Alation. Alation supports metadata extraction, query log ingestion, and use of Compose through PrivateLink connection.

• AWS PrivateLink connection between other AWS-hosted data source and Alation. For details, refer to AWS PrivateLink with Alation Cloud Service.

Note

The information in this topic only applies to Snowflake on AWS.

In this configuration, you will authorize Alation to connect to Snowflake via AWS PrivateLink.

Before performing these configuration steps, Alation assumes you have already enabled the PrivateLink connection for your Snowflake instance. If you have not done so, see AWS PrivateLink to enable PrivateLink for Snowflake.

Important

To complete the configuration, Alation Support will need to restart your Alation instance, resulting in a brief downtime. The restart will be coordinated through Alation Support. Consider this when planning communications with your users.

To configure the connection via PrivateLink:

1. Obtain the PrivateLink CNAME and URLs from your Snowflake instance. You can use the following function to get this information:

   use role accountadmin;
   select system$get_privatelink_config();
   

   This function returns a response similar to the following with actual values:

   {
       "privatelink-account-name":"****.<region>.privatelink",
       "privatelink-vpce-id":"*************",
       "privatelink-account-url":"***.<region>.privatelink.snowflakecomputing.com",
       "regionless-privatelink-account-url":"<name>.privatelink.snowflakecomputing.com",
       "privatelink_ocsp-url":"***.<region>.privatelink.snowflakecomputing.com",
       "privatelink-connection-urls":"[]"
   }
   

2. Create a Support case to contact Alation Support. For information on how to create a Support case, see the Creating a new Alation Support Case section in Alation Support Portal.

   In the support case,

   1. Provide the PrivateLink CNAME and URLS you obtained in Step 1.

   2. Request the following information:

      • The AWS account ID for your Alation instance

      • The security Federation Token

      Note

      The Federation Token is valid for only 36 hours. If it expires before you can complete this configuration, you’ll need to contact Alation Support again and obtain a new token. To avoid delays, plan accordingly to complete the setup within the token’s validity period.

   3. Request the CIDR range for Alation’s VPC. For example, vpce-07067555df039243c-wd6bm845.vpce-svc-04feb610c994b312e.ap-northeast-1.vpce.amazonaws.com.

3. Once you receive a response, use the details you received to authorize PrivateLink connections from Alation by following the corresponding Snowflake documentation: Enabling AWS PrivateLink.

4. Allow Alation’s CIDR range on your network policy.

5. Inform the Alation Support once you complete the configuration at your end.

6. Alation Support will complete the configuration on Alation’s side and restart your instance. They will confirm the PrivateLink connectivity to your Snowflake instance in the ongoing Support case.

Once the Support interaction is complete, configure the connection to your Snowflake data source using the information in Configure Connection to Data Source.

Note

When configuring the connection to the data source, provide the JDBC URL in the format <CNAME>.privatelink.snowflakecomputing.com", over the usual Snowflake JDBC URL fromat (snowflake://<hostname>:<port>/?warehouse=<warehouse_name>&db=<db_name>&role=<role_name>).