Set up AWS private network link to Snowflake

||Connect docs via MCP

AWS PrivateLink creates a secure, private connection between services running in AWS. This document describes the steps to set this up between Snowflake and Atlan, when you use Atlan's Single Tenant SaaS deployment.

Who can do this?

You need Snowflake Support, and probably your Snowflake administrator involved - you may not have access or the tools to run these tasks.

Prerequisites

• Snowflake must be setup with Business Critical Edition (or higher).
• Open a ticket with Snowflake Support to enable PrivateLink for your Snowflake account.
• Snowflake support takes 1–2 days to review and enable PrivateLink.
• If you are using IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist. Please raise a support request to do so.

Cross-region support

Your Snowflake account doesn't need to be in the same AWS region as your Atlan tenant. Atlan supports cross-region private connectivity, so you can connect to Snowflake accounts in any AWS region.

(For all details, see the Snowflake documentation.)

Five phases at glance

Phase	What happens	Owner	Typical time
1. Gather	Export your account's private link configuration	Snowflake admin	10 minutes
2. Build	Atlan creates the endpoint on its side	Atlan support	1–2 business days
3. Approve	Authorize Atlan's connection on the Snowflake side	Snowflake admin	15 minutes
4. Allowlist	Update your Snowflake network policy (if you use one)	Snowflake admin	15 minutes
5. Connect & verify	Point the Atlan connection at the private endpoint and test	Atlan User	30 minutes

Phase 1: Gather your private link details

Owner: Snowflake admin

Log in to snowCLI using the ACCOUNTADMIN account, and run the following commands:

use role accountadmin;
select system$get_privatelink_config();

This produces output like the following (formatted here for readability):

{
  "privatelink-account-name":"abc123.ap-south-1.privatelink",
  "privatelink-vpce-id":"com.amazonaws.vpce.ap-south-1.vpce-svc-257a4d536bd8e3594",
  "privatelink-account-url":"abc123.ap-south-1.privatelink.snowflakecomputing.com",
  "regionless-privatelink-account-url":"xyz789-abc123.privatelink.snowflakecomputing.com",
  "privatelink_ocsp-url":"ocsp.abc123.ap-south-1.privatelink.snowflakecomputing.com",
  "privatelink-connection-urls":"[]"
}

Share details with Atlan support team

Share the following values with the Atlan support team:

• privatelink-account-name
• privatelink-vpce-id
• privatelink-account-url
• privatelink_ocsp-url

Atlan support finishes the configuration on the Atlan side using these values. Support then provides the Snowflake PrivateLink endpoint back to you.

Phase 2: Atlan builds its endpoint

Owner: Atlan support

Using the vpce-id you shared in Phase 1, Atlan support creates a private endpoint in your tenant's network and connects it to your Snowflake account. This usually takes 1–2 business days. When it's ready, support sends you:

• The private endpoint DNS name you'll use in Phase 5. It looks like: vpce-EXAMPLE-abc123.vpce-svc-EXAMPLE.us-east-1.vpce.amazonaws.com or an Atlan-managed alias like yourco.privatelink.snowflakecomputing.com
• Atlan's AWS account ID and the private CIDR ranges the connection originates from (also published on the Atlan Network Details page)

Phase 3: Authorize connection

Owner: Snowflake admin

Snowflake won't accept private connections from an unknown party. Authorize Atlan's AWS account with your Snowflake account:

use role accountadmin;
select system$authorize_privatelink('<atlan-aws-account-id-from-phase-2>');

-- Verify it registered:
select system$get_privatelink_authorized_endpoints();

The verify call must list Atlan's endpoint. If it doesn't appear after a few minutes, reply on your support ticket - don't proceed to Phase 5, it fails.

Phase 4: Update your network policy

Owner: Snowflake admin

Skip this phase only if your Snowflake account has no network policy. If it does, the private link traffic must be allowlisted - and it arrives from Atlan's private CIDR ranges, not the public IPs.

-- Option A: allowlist Atlan's private CIDRs (use the exact values Atlan support provides — do not copy these examples)
create network rule atlan_privatelink_rule
  mode = ingress  type = ipv4
  value_list = ('<cidr-range-1>', '<cidr-range-2>');

-- Option B (more robust): allowlist by endpoint identity instead of IP
create network rule atlan_vpce_rule
  mode = ingress  type = awsvpceid
  value_list = ('vpce-EXAMPLE01');

-- Then attach the rule to your existing network policy's allowed list.

Copy the whole range

Allowlisting a partial range (for example, a /17 when the published block is a /16) causes failures that appear only at certain times of day, when traffic rotates into the missing half. If you also apply per-user policies to the Atlan service account, update those too.

Phase 5: Connect and verify

Owner: Atlan User

1. In Atlan, open your Snowflake connection setup (New workflow → Snowflake Assets, Direct extraction).
2. In the Account Identifiers (Host) field, enter the private endpoint DNS name from Phase 2 - this replaces your regular Snowflake hostname.
3. Enter credentials as usual and click Test connection.

One more traffic path: stage storage

Large query results are downloaded from Snowflake's own cloud storage (sfc-*-customer-stage.s3.*.amazonaws.com) via temporary links, outside the private link. Atlan configures egress for this automatically on AWS tenants - but if your first large crawl fails with JDBC "communication errors" while the test connection passed, this is the cause. See Troubleshooting Snowflake connectivity.

Success checklist

• Test connection passes in the Atlan UI
• Preflight checks pass when you configure the crawler
• A crawl scoped to one small schema completes
• A full crawl (or miner run) completes - this is the first time stage-storage traffic is exercised

All four green? You're done. If any step fails, see Troubleshooting Snowflake connectivity.

Next steps

• Crawl Snowflake: Set up and run a workflow to extract metadata from your Snowflake account.
• Mine Snowflake: Extract query history and usage statistics from your Snowflake account.

Troubleshooting

If you encounter connectivity issues after setting up PrivateLink, see Troubleshooting Snowflake connectivity.

Multiple Snowflake accounts

Each Snowflake account needs its own private endpoint - endpoints aren't shared between accounts, even in the same org. To connect several accounts (prod, non-prod, regional):

1. Run Phase 1 (SYSTEM$GET_PRIVATELINK_CONFIG()) in each account and paste all outputs into one support ticket, clearly labeled per account.
2. Atlan returns one endpoint DNS per account; each Atlan connection uses its own.
3. Phases 3 and 4 repeat per account (each has its own approval and its own network policy).