Choose how Atlan connects to Snowflake
There are three ways to connect Atlan to your Snowflake account. Use this page to quickly identify the right option for your setup before making any changes to your cloud configuration.
Before you start: Two facts you need
Before proceeding, collect the details below. Every connectivity option depends on them, and they determine which options are available to you.
| Fact | How to find it |
|---|---|
| Which cloud and region your Atlan tenant runs on (AWS, Azure, or GCP) | Ask your Atlan admin or raise a support request - say "which cloud and region is my tenant hosted in?" |
| Which cloud, region, and edition your Snowflake account runs on | Ask your Snowflake administrator, or run SELECT CURRENT_REGION(); in Snowflake. Private connectivity requires Business Critical edition or higher. |
Compare three methods
| Public + IP allowlisting | Private Link | Self-deployed agent | |
|---|---|---|---|
| Traffic path | Public internet, TLS-encrypted, from Atlan's fixed source IPs | Never leaves the cloud provider's private network | Extraction runs inside your own network |
| Snowflake edition | Any | Business Critical or higher | Any |
| Who is involved | You + Snowflake admin | You + Snowflake admin + your cloud/network team + Atlan support | Your infrastructure team |
| Available when your Atlan tenant is on | AWS, Azure, or GCP | AWS or Azure only | Any |
| Start here | Allowlist Atlan IPs | AWS guide · Azure guide | Self-deployed runtime docs |
Private Link to Snowflake isn't available for GCP-hosted Atlan tenants. Google Private Service Connect is currently supported for BigQuery only. Use IP allowlisting with the static IPs published for your region - no support ticket needed.
Which one do I pick?
- Pick public + IP allowlisting if your security policy permits TLS traffic over the internet from known IPs. It's the fastest path - GCP tenants self-serve from the Atlan Network Details page; AWS/Azure tenants get their tenant-specific IPs with one support ticket.
- Pick Private Link if your organization prohibits any public path to Snowflake, or your Snowflake account is already locked to private connectivity. Budget for the approval handshake and involve your cloud/network team early.
- Pick the self-deployed agent if Snowflake is reachable only from inside your network and no private link is possible (rare for Snowflake; common for on-premises sources).
Many customers run Private Link and enforce an IP-based network policy in Snowflake. That works - but the policy must allowlist Atlan's private address ranges, not the public ones. This is the most common misconfiguration reported; it's covered in the private network link guides.
Related pages
- How private connectivity works: The 5-minute explainer - no cloud knowledge assumed. Read this if terms like "endpoint" or "VPCE" are new to you.
- Atlan Network Details: Every IP, CIDR range, and endpoint identity Atlan uses - GCP values published, AWS/Azure tenant-specific via support.
- Set up an AWS private network link to Snowflake
- Set up an Azure private network link to Snowflake