Azure Private Link Snowflake

Step 2 :

• Create a virtual Network in which our Private Link and other Azure Services are going to reside.

For sake of simplicity and this demonstration, We will keep all default values and will only change those which are necessary

Step 3:

• Let's create a Private endpoint

• • In Virtual Network Section, Select the virtual network that we created in Step 2

• • We will skip DNS configuration for now, We are going to configure DNS in later sections.

Step 4:

• After successful deployment, we should be able to see:

  • Connection Status : Pending

  • Request Response: Awaiting Approval

• • This approval is required from Snowflake end. In order to approve this, we need two things:

    1. Resource ID of our Private Link endpoint.

    2. Access token for our Azure Subscription

  • We can get Private link endpoint Resource Id by clicking JSON View

• • Copy this Resource ID somewhere safe, we are going to need this after few steps

• • Next we need Access token for Azure subscription that we are using, Easiest way to get access token is using Azure CLI. 

  • Install Azure CLI using offical docs here

  • After installing, open terminal/command prompt and run following command

  • az login

  • A Browser pop up will open that will require login to Azure Portal. After successful login, return to Terminal/command prompt window and run following command to get access token

  • az account get-access-token --subscription <SubscriptionID>

  • We can get Subscription Id from Azure itself

• • From the output of above command, we need entire access token

• • Get the Private Link Resource ID from above step and access token to create statement in Snowflake.

  • Run following command in Snowflake to authorize Private Link from Snowflake End

SELECT SYSTEM$AUTHORIZE_PRIVATELINK (

  'PRIVATE_LINK_RESOURCE_ID',

  'ACCESS_TOKEN'

);

• • We can confrim that Private Link is Authorized successfully by going back to Azure. Connection Status should be Approved

We can now navigate to Private link NIC(Network Interface Card) to get the Private IP address of our endpoint. We can put that IP address in one of the VM(should be in same Vnet as Private Link) but it is going to give us 404 Error because snowflake expects us to access snowflake using a domain name rather than IP address, So we need to add entries in our DNS server for snowflake private link URL.

In our Case, Private IP address of our Snowflake Endpoint is 10.0.0.4. We need to map all the domain names given by snowflake with this static private IP address in our DNS

Use following command in snowflake to get all the Domain names which we need to put in DNS entries.

WITH CTE AS (

    SELECT 

        G.KEY,

        G.VALUE,

        G.SEQ

    FROM TABLE (FLATTEN(INPUT => PARSE_JSON(SYSTEM$ALLOWLIST_PRIVATELINK()))) F,

    LATERAL FLATTEN(INPUT => F.VALUE) G

)

SELECT

    MAX(CASE WHEN KEY = 'host' THEN VALUE::TEXT END) AS HOST,

    MAX(CASE WHEN KEY = 'port' THEN VALUE::NUMBER END) AS PORT,

    MAX(CASE WHEN KEY = 'type' THEN VALUE::TEXT END) AS TYPE

FROM CTE

GROUP BY SEQ;

1. Head over to Azure Portal and Search for "Private DNS Zones"

Make sure that you put name if your Private DNS Zone as snowflakecomputing.com.

This is because snowflake requires its URLs to be resolved by snowflakecomputing.com only, if we put any name as dns name for ex private.dns, then URL will become XXXX.privatelink.snowflakecomputing.com.private.dns, which snowflake is going to deny.

So by keeping our domain name as snowflakecomputing.com, our final URL will be XXXX.privatelink.snowflakecomputing.com

2. Navigate to your Private dns and click on Virtual Network Links.

We are going to create a new Virtual network Link, this is going to link our DNS to Virtual Network where our Private Link endpoint and other Azure resources resides.

3. Add a new Virtual Network Link and select the Vnet where our Private Link Endpoint resides

4. In DNS Sidebar, go to Recordsets

After entering Snowflake Privatelink URL, if you see somethink like this then there is a mis-configuration or a step is missed.

Instead of putting Privatelink URL into browser, try entering the IP address of privatelink endpoint. In our case that would be 10.0.0.4

To confirm that DNS configuration is the actual problem, then use nslookup from win10 VM command prompt and try to resolve private link URL

nslookup <snowflake private endpoint URL>