Add a Self-Managed Private Network Route for Snowflake on Azure

Connect your Snowflake instance and Data 360 tenant to a dedicated network route with Private Connect for Data 360. Create a single route to a specific instance even if you have multiple Data 360 instances. Before you set up a Snowflake federation connection or data share, establish a Private Network Route (PNR).

Prerequisites

Available in: Editions that support Data 360. See Data 360 edition availability

Note

User Permissions Needed
To create a Snowflake network route	Data 360 Architect and Manage External Connections or Customize App permission
To administer a Snowflake environment	Snowflake admin

Limitations

The maximum number of private network routes (PNRs) for a Snowflake URL is one per Data 360 functional domain (not per Data 360 org).
The virtual private cloud (VPC) endpoint ID must be added to your org’s allowlist to connect Data 360 to your Snowflake instance.
- You can get the VPC ID from the details page of an existing Private Network Route.
- Alternatively, add the internal IP address range 10.0.0.0/8 to your Snowflake network policy’s allowlist. Only private networks use this reserved address range. For more information, see Controlling network traffic with network policies in the Snowflake documentation.

This topic covers only the Salesforce steps. To complete the end-to-end procedure across all sources, see the Private Connect Implementation Reference Guide for Snowflake on Azure.

Prerequisites:

Use consumption-based Data 360.
You have the VPC endpoint service name for the Java Database Connectivity (JDBC) and Azure Blob endpoints. Information about this configuration is in the Implementation Guide.
You’ve configured the Data 360 Principal ID for this PNR as an allowed principal in Amazon Web Services (AWS). Information about this configuration is in the Implementation Guide.

Steps

From the App Launcher, select Data 360.
From Setup, select Data Cloud Setup.
From Data Cloud Setup, expand Admin Tools and select Private Connect.
Select New.

When you’ve exceeded the maximum number of licensed private network routes, the New button doesn’t appear. To get more private network routes, speak with your Salesforce account representative.
On the Add Private Network Route page, select the Snowflake tile.
In the Select a network panel, select Azure, and then Add Private Network Route.
On the Configure Snowflake Private Network Route page, enter these values.
1. Route Name: This name identifies the route.
2. Route API Name: Data 360 autopopulates this field based on the route name.
3. Description: Enter a description of the connection.
Go to Step 3: Account and complete these steps.
1. In the Snowflake Account URL field, enter the URL for your Snowflake account.
2. In the Virtual Private Cloud Endpoint Service Name field, enter the AWS VPC endpoint that you created earlier. For example: com.amazonaws.vpce.
Go to Step 4: Internal Stage and complete these steps.
1. In the Azure Blob URL field, add your Azure account URL. For example: https://.blob.core.windows.net//.
2. In the Virtual Private Cloud (VPC) Endpoint Service Name field, enter the AWS VPC endpoint. For example: com.amazonaws.vpce.
Save your changes and keep this browser open. Provisioning your network route takes several minutes. The next step is to confirm your connection request in Amazon Virtual Private Cloud.
Access the Amazon Virtual Private Cloud console.
Go to the endpoint service for both Snowflake and the Snowflake internal stage.
On the Endpoint connections tab, go to your pending connection request for Snowflake and the Snowflake internal stage. Then complete these steps.
1. Check the box next to the Snowflake endpoint.
2. Click the Actions dropdown.
3. Click Accept Endpoint Connection Request. If you don’t see the request, make sure that you added the Principal ID as an allowed principal. Repeat these steps for the Snowflake internal stage.
  
  Wait for 30 seconds before you proceed to the next step.
Return to Salesforce and go to Data Cloud Setup.
To refresh the configuration until it’s ready to use, click Data Cloud Setup Refresh.

Refreshing the browser has no effect.
To verify the setup, go to Data Cloud Setup and click Private Connect. The dashboard shows the status of Snowflake and the Snowflake internal stage. Verify that both PNRs display as connected. You can click the individual PNR record to see its details.

Next Steps

This procedure creates the private network route. Next, set up a Snowflake federation integration that uses the route.

The directions are similar to Set Up a Snowflake Federation Connection for Private Connect But, when instead of the directions for creating a connection, where appropriate, select Use Private Network Route and choose the private network route that you created.

After you create the integration, create the data stream for your data:

Create a Snowflake File Federation Data Stream if you want to use Snowflake File Federation.
Create a Snowflake Data Stream if you want to use Snowflake Data Federation.

When the network provisioning is complete, create a federated connection or data share for Snowflake. There can be a brief delay before you can proceed to create a federated connection or data share due to Domain Name Server (DNS) configuration.

Note

Edit the PNR

After you create the Private Network Route (PNR), you can edit its name and description.

From the App Launcher, find and select Data 360.
From Setup, in the Quick Find box, enter Data Cloud Setup, and then select Data Cloud Setup.
Expand Admin Tools, and then select Private Connect.
Find the row for the PNR that you created, and open its details page.
Click Edit.
Change the available settings and save your changes.
- PNR Name: Enter a different name.
- Description: Enter a different description.