## Set up AWS private network link to Snowflake

URL: https://docs.atlan.com/apps/connectors/data-warehouses/snowflake/how-tos/set-up-an-aws-private-network-link-to-snowflake

> Set up AWS PrivateLink between your Snowflake account and your Atlan tenant, including cross-region configurations.

[AWS PrivateLink](https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-privatelink.html) creates a secure, private connection between services running in AWS. This document describes the steps to set this up between Snowflake and Atlan, when you use Atlan's Single Tenant SaaS deployment.

:::warning Who can do this?
 You need Snowflake Support, and probably your Snowflake administrator involved - you may not have access or the tools to run these tasks.

:::

## Prerequisites

- Snowflake must be setup with Business Critical Edition (or higher).
- Open a ticket with Snowflake Support to enable PrivateLink for your Snowflake account.
- Snowflake support takes 1–2 days to review and enable PrivateLink.
- If you are using IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist. Please [raise a support request](https://docs.atlan.com/support/submit-request) to do so.

:::info Cross-region support
 Your Snowflake account doesn't need to be in the same AWS region as your Atlan tenant. Atlan supports [cross-region private connectivity](https://docs.atlan.com/llms/governance/administration/cross-region-private-network-connectivity/llms.txt), so you can connect to Snowflake accounts in any AWS region.
:::

(For all details, see the [Snowflake documentation](https://docs.snowflake.com/en/user-guide/admin-security-privatelink.html).)

## Five phases at glance

| Phase | What happens | Owner | Typical time |
|---|---|---|---|
| 1. Gather | Export your account's private link configuration | Snowflake admin | 10 minutes |
| 2. Build | Atlan creates the endpoint on its side | Atlan support | 1–2 business days |
| 3. Approve | Authorize Atlan's connection on the Snowflake side | Snowflake admin | 15 minutes |
| 4. Allowlist | Update your Snowflake network policy (if you use one) | Snowflake admin | 15 minutes |
| 5. Connect & verify | Point the Atlan connection at the private endpoint and test | Atlan User | 30 minutes |

## Phase 1: Gather your private link details

**Owner:** Snowflake admin

Log in to snowCLI using the `ACCOUNTADMIN` account, and run the following commands:

```
use role accountadmin;
select system$get_privatelink_config();
```

This produces output like the following (formatted here for readability):

```
{
 "privatelink-account-name":"abc123.ap-south-1.privatelink",
 "privatelink-vpce-id":"com.amazonaws.vpce.ap-south-1.vpce-svc-257a4d536bd8e3594",
 "privatelink-account-url":"abc123.ap-south-1.privatelink.snowflakecomputing.com",
 "regionless-privatelink-account-url":"xyz789-abc123.privatelink.snowflakecomputing.com",
 "privatelink_ocsp-url":"ocsp.abc123.ap-south-1.privatelink.snowflakecomputing.com",
 "privatelink-connection-urls":"[]"
}
```

### Share details with Atlan support team

Share the following values with the [Atlan support](https://docs.atlan.com/support/submit-request) team:

- `privatelink-account-name`
- `privatelink-vpce-id`
- `privatelink-account-url`
- `privatelink_ocsp-url`

Atlan support finishes the configuration on the Atlan side using these values. Support then provides the Snowflake PrivateLink endpoint back to you.

## Phase 2: Atlan builds its endpoint

**Owner:** Atlan support

Using the `vpce-id` you shared in Phase 1, Atlan support creates a private endpoint in your tenant's network and connects it to your Snowflake account. This usually takes **1–2 business days**. When it's ready, support sends you:

- **The private endpoint DNS name** you'll use in Phase 5. It looks like: `vpce-EXAMPLE-abc123.vpce-svc-EXAMPLE.us-east-1.vpce.amazonaws.com` or an Atlan-managed alias like `yourco.privatelink.snowflakecomputing.com`
- **Atlan's AWS account ID** and the **private CIDR ranges** the connection originates from (also published on the [Atlan Network Details page](https://docs.atlan.com/llms/governance/administration/atlan-network-details/llms.txt))

## Phase 3: Authorize connection

**Owner:** Snowflake admin

Snowflake won't accept private connections from an unknown party. Authorize Atlan's AWS account with your Snowflake account:

```sql
use role accountadmin;
select system$authorize_privatelink('<atlan-aws-account-id-from-phase-2>');

-- Verify it registered:
select system$get_privatelink_authorized_endpoints();
```

The verify call must list Atlan's endpoint. If it doesn't appear after a few minutes, reply on your support ticket - don't proceed to Phase 5, it fails.

## Phase 4: Update your network policy

**Owner:** Snowflake admin

**Skip this phase only if your Snowflake account has no network policy.** If it does, the private link traffic must be allowlisted - and it arrives from Atlan's **private CIDR ranges**, not the public IPs.

```sql
-- Option A: allowlist Atlan's private CIDRs (use the exact values Atlan support provides — do not copy these examples)
create network rule atlan_privatelink_rule
 mode = ingress type = ipv4
 value_list = ('<cidr-range-1>', '<cidr-range-2>');

-- Option B (more robust): allowlist by endpoint identity instead of IP
create network rule atlan_vpce_rule
 mode = ingress type = awsvpceid
 value_list = ('vpce-EXAMPLE01');

-- Then attach the rule to your existing network policy's allowed list.
```

:::danger Copy the whole range

Allowlisting a partial range (for example, a `/17` when the published block is a `/16`) causes failures that appear only at certain times of day, when traffic rotates into the missing half. If you also apply per-user policies to the Atlan service account, update those too.

:::

## Phase 5: Connect and verify

**Owner:** Atlan User

1. In Atlan, open your Snowflake connection setup (**New workflow → Snowflake Assets**, Direct extraction).
2. In the **Account Identifiers (Host)** field, enter the private endpoint DNS name from Phase 2 - this replaces your regular Snowflake hostname.
3. Enter credentials as usual and click **Test connection**.

:::caution One more traffic path: stage storage

Large query results are downloaded from Snowflake's own cloud storage (`sfc-*-customer-stage.s3.*.amazonaws.com`) via temporary links, **outside the private link**. Atlan configures egress for this automatically on AWS tenants - but if your first *large* crawl fails with JDBC "communication errors" while the test connection passed, this is the cause. See [Troubleshooting Snowflake connectivity](https://docs.atlan.com/llms/connectors/snowflake/troubleshooting-snowflake-connectivity/llms.txt).

:::

### Success checklist

- **Test connection** passes in the Atlan UI
- Preflight checks pass when you configure the crawler
- A crawl scoped to one small schema completes
- A full crawl (or miner run) completes - this is the first time stage-storage traffic is exercised

All four green? You're done. If any step fails, see [Troubleshooting Snowflake connectivity](https://docs.atlan.com/llms/connectors/snowflake/troubleshooting-snowflake-connectivity/llms.txt).

## Next steps

* [Crawl Snowflake](https://docs.atlan.com/llms/connectors/snowflake/crawl-snowflake/llms.txt): Set up and run a workflow to extract metadata from your Snowflake account.
* [Mine Snowflake](https://docs.atlan.com/llms/connectors/snowflake/mine-snowflake/llms.txt): Extract query history and usage statistics from your Snowflake account.

## Troubleshooting

If you encounter connectivity issues after setting up PrivateLink, see [Troubleshooting Snowflake connectivity](https://docs.atlan.com/llms/connectors/snowflake/troubleshooting-snowflake-connectivity/llms.txt).

## Multiple Snowflake accounts

Each Snowflake account needs its own private endpoint - endpoints aren't shared between accounts, even in the same org. To connect several accounts (prod, non-prod, regional):

1. Run Phase 1 (`SYSTEM$GET_PRIVATELINK_CONFIG()`) in each account and paste all outputs into one support ticket, clearly labeled per account.
2. Atlan returns one endpoint DNS per account; each Atlan connection uses its own.
3. Phases 3 and 4 repeat per account (each has its own approval and its own network policy).

---