Skip to main content

Snowflake

Snowflake Ingestion through the UI​

The following video shows you how to ingest Snowflake metadata through the UI.

Read on if you are interested in ingesting Snowflake metadata using the datahub cli, or want to learn about all the configuration parameters that are supported by the connectors. Certified

Important Capabilities​

CapabilityStatusNotes
Asset Containers✅Enabled by default
Column-level Lineage✅Enabled by default, can be disabled via configuration include_column_lineage
Data Profiling✅Optionally enabled via configuration profiling.enabled
Dataset Usage✅Enabled by default, can be disabled via configuration include_usage_stats
Descriptions✅Enabled by default
Detect Deleted Entities✅Optionally enabled via stateful_ingestion.remove_stale_metadata
Domains✅Supported via the domain config field
Extract Tags✅Optionally enabled via extract_tags
Platform Instance✅Enabled by default
Schema Metadata✅Enabled by default
Table-Level Lineage✅Enabled by default, can be disabled via configuration include_table_lineage and include_view_lineage

Prerequisites​

In order to execute this source, your Snowflake user will need to have specific privileges granted to it for reading metadata from your warehouse.

Snowflake system admin can follow this guide to create a DataHub-specific role, assign it the required privileges, and assign it to a new DataHub user by executing the following Snowflake commands from a user with the ACCOUNTADMIN role or MANAGE GRANTS privilege.

create or replace role datahub_role;

// Grant access to a warehouse to run queries to view metadata
grant operate, usage on warehouse "<your-warehouse>" to role datahub_role;

// Grant access to view database and schema in which your tables/views exist
grant usage on DATABASE "<your-database>" to role datahub_role;
grant usage on all schemas in database "<your-database>" to role datahub_role;
grant usage on future schemas in database "<your-database>" to role datahub_role;

// If you are NOT using Snowflake Profiling or Classification feature: Grant references privileges to your tables and views
grant references on all tables in database "<your-database>" to role datahub_role;
grant references on future tables in database "<your-database>" to role datahub_role;
grant references on all external tables in database "<your-database>" to role datahub_role;
grant references on future external tables in database "<your-database>" to role datahub_role;
grant references on all views in database "<your-database>" to role datahub_role;
grant references on future views in database "<your-database>" to role datahub_role;

// If you ARE using Snowflake Profiling or Classification feature: Grant select privileges to your tables
grant select on all tables in database "<your-database>" to role datahub_role;
grant select on future tables in database "<your-database>" to role datahub_role;
grant select on all external tables in database "<your-database>" to role datahub_role;
grant select on future external tables in database "<your-database>" to role datahub_role;

// Create a new DataHub user and assign the DataHub role to it
create user datahub_user display_name = 'DataHub' password='' default_role = datahub_role default_warehouse = '<your-warehouse>';

// Grant the datahub_role to the new DataHub user.
grant role datahub_role to user datahub_user;

// Optional - required if extracting lineage, usage or tags (without lineage)
grant imported privileges on database snowflake to role datahub_role;

The details of each granted privilege can be viewed in snowflake docs. A summarization of each privilege, and why it is required for this connector:

  • operate is required only to start the warehouse. If the warehouse is already running during ingestion or has auto-resume enabled, this permission is not required.
  • usage is required for us to run queries using the warehouse
  • usage on database and schema are required because without it tables and views inside them are not accessible. If an admin does the required grants on table but misses the grants on schema or the database in which the table/view exists then we will not be able to get metadata for the table/view.
  • If metadata is required only on some schemas then you can grant the usage privilieges only on a particular schema like
grant usage on schema "<your-database>"."<your-schema>" to role datahub_role;

This represents the bare minimum privileges required to extract databases, schemas, views, tables from Snowflake.

If you plan to enable extraction of table lineage, via the include_table_lineage config flag, extraction of usage statistics, via the include_usage_stats config, or extraction of tags (without lineage), via the extract_tags config, you'll also need to grant access to the Account Usage system tables, using which the DataHub source extracts information. This can be done by granting access to the snowflake database.

grant imported privileges on database snowflake to role datahub_role;

Authentication​

Authentication is most simply done via a Snowflake user and password.

Alternatively, other authentication methods are supported via the authentication_type config option.

Okta OAuth​

To set up Okta OAuth authentication, roughly follow the four steps in this guide.

Pass in the following values, as described in the article, for your recipe's oauth_config:

  • provider: okta
  • client_id: <OAUTH_CLIENT_ID>
  • client_secret: <OAUTH_CLIENT_SECRET>
  • authority_url: <OKTA_OAUTH_TOKEN_ENDPOINT>
  • scopes: The list of your Okta scopes, i.e. with the session:role: prefix

Datahub only supports two OAuth grant types: client_credentials and password. The steps slightly differ based on which you decide to use.

Client Credentials Grant Type (Simpler)​
  • When creating an Okta App Integration, choose type API Services
    • Ensure client authentication method is Client secret
    • Note your Client ID
  • Create a Snowflake user to correspond to your newly created Okta client credentials
    • Ensure the user's Login Name matches your Okta application's Client ID
    • Ensure the user has been granted your datahub role
Password Grant Type​
  • When creating an Okta App Integration, choose type OIDC -> Native Application
    • Add Grant Type Resource Owner Password
    • Ensure client authentication method is Client secret
  • Create an Okta user to sign into, noting the Username and Password
  • Create a Snowflake user to correspond to your newly created Okta client credentials
    • Ensure the user's Login Name matches your Okta user's Username (likely an email)
    • Ensure the user has been granted your datahub role
  • When running ingestion, provide the required oauth_config fields, including client_id and client_secret, plus your Okta user's Username and Password
    • Note: the username and password config options are not nested under oauth_config

Caveats​

  • Some of the features are only available in the Snowflake Enterprise Edition. This doc has notes mentioning where this applies.
  • The underlying Snowflake views that we use to get metadata have a latency of 45 minutes to 3 hours. So we would not be able to get very recent metadata in some cases like queries you ran within that time period etc. This is applicable particularly for lineage, usage and tags (without lineage) extraction.
  • If there is any incident going on for Snowflake we will not be able to get the metadata until that incident is resolved.

CLI based Ingestion​

Install the Plugin​

pip install 'acryl-datahub[snowflake]'

Starter Recipe​

Check out the following recipe to get started with ingestion! See below for full configuration options.

For general pointers on writing and running a recipe, see our main recipe guide.

source:
  type: snowflake
  config:
    # This option is recommended to be used to ingest all lineage
    ignore_start_time_lineage: true

    # Coordinates
    account_id: "abc48144"
    warehouse: "COMPUTE_WH"

    # Credentials
    username: "${SNOWFLAKE_USER}"
    password: "${SNOWFLAKE_PASS}"
    role: "datahub_role"

    # (Optional) Uncomment and update this section to filter ingested datasets 
    # database_pattern:
    #   allow:
    #     - "^ACCOUNTING_DB$"
    #     - "^MARKETING_DB$"

    profiling:
      # Change to false to disable profiling
      enabled: true
      # This option is recommended to reduce profiling time and costs.
      turn_off_expensive_profiling_metrics: true

    # (Optional) Uncomment and update this section to filter profiled tables
    # profile_pattern:
    #   allow:
    #   - "ACCOUNTING_DB.*.*"
    #   - "MARKETING_DB.*.*"

# Default sink is datahub-rest and doesn't need to be configured
# See https://datahubproject.io/docs/metadata-ingestion/sink_docs/datahub for customization options

Config Details​

Note that a . is used to denote nested fields in the YAML recipe.

FieldDescription
account_id ✅
string
Snowflake account identifier. e.g. xy12345, xy12345.us-east-2.aws, xy12345.us-central1.gcp, xy12345.central-us.azure, xy12345.us-west-2.privatelink. Refer Account Identifiers for more details.
apply_view_usage_to_tables
boolean
Whether to apply view's usage to its base tables. If set to True, usage is applied to base tables only.
Default: False
authentication_type
string
The type of authenticator to use when connecting to Snowflake. Supports "DEFAULT_AUTHENTICATOR", "OAUTH_AUTHENTICATOR", "EXTERNAL_BROWSER_AUTHENTICATOR" and "KEY_PAIR_AUTHENTICATOR".
Default: DEFAULT_AUTHENTICATOR
bucket_duration
Enum
Size of the time window to aggregate usage stats.
Default: DAY
connect_args
object
Connect args to pass to Snowflake SqlAlchemy driver
convert_urns_to_lowercase
boolean
Default: True
email_domain
string
Email domain of your organisation so users can be displayed on UI appropriately.
end_time
string(date-time)
Latest date of usage to consider. Default: Current time in UTC
extract_tags
Enum
Optional. Allowed values are without_lineage, with_lineage, and skip (default). without_lineage only extracts tags that have been applied directly to the given entity. with_lineage extracts both directly applied and propagated tags, but will be significantly slower. See the Snowflake documentation for information about tag lineage/propagation.
Default: skip
format_sql_queries
boolean
Whether to format sql queries
Default: False
ignore_start_time_lineage
boolean
Default: False
include_column_lineage
boolean
Populates table->table and view->table column lineage. Requires appropriate grants given to the role and the Snowflake Enterprise Edition or above.
Default: True
include_external_url
boolean
Whether to populate Snowsight url for Snowflake Objects
Default: True
include_operational_stats
boolean
Whether to display operational stats.
Default: True
include_read_operational_stats
boolean
Whether to report read operational stats. Experimental.
Default: False
include_table_lineage
boolean
If enabled, populates the snowflake table-to-table and s3-to-snowflake table lineage. Requires appropriate grants given to the role and Snowflake Enterprise Edition or above.
Default: True
include_table_location_lineage
boolean
If the source supports it, include table lineage to the underlying storage location.
Default: True
include_tables
boolean
Whether tables should be ingested.
Default: True
include_technical_schema
boolean
If enabled, populates the snowflake technical schema and descriptions.
Default: True
include_top_n_queries
boolean
Whether to ingest the top_n_queries.
Default: True
include_usage_stats
boolean
If enabled, populates the snowflake usage statistics. Requires appropriate grants given to the role.
Default: True
include_view_column_lineage
boolean
Populates view->view and table->view column lineage.
Default: False
include_view_lineage
boolean
If enabled, populates the snowflake view->table and table->view lineages. Requires appropriate grants given to the role, and include_table_lineage to be True. view->table lineage requires Snowflake Enterprise Edition or above.
Default: True
include_views
boolean
Whether views should be ingested.
Default: True
match_fully_qualified_names
boolean
Whether schema_pattern is matched against fully qualified schema name <catalog>.<schema>.
Default: False
options
object
Any options specified here will be passed to SQLAlchemy.create_engine as kwargs.
password
string(password)
Snowflake password.
platform_instance
string
The instance of the platform that all assets produced by this recipe belong to
private_key
string
Private key in a form of '-----BEGIN PRIVATE KEY-----\nprivate-key\n-----END PRIVATE KEY-----\n' if using key pair authentication. Encrypted version of private key will be in a form of '-----BEGIN ENCRYPTED PRIVATE KEY-----\nencrypted-private-key\n-----END ECNCRYPTED PRIVATE KEY-----\n' See: https://docs.snowflake.com/en/user-guide/key-pair-auth.html
private_key_password
string(password)
Password for your private key. Required if using key pair authentication with encrypted private key.
private_key_path
string
The path to the private key if using key pair authentication. Ignored if private_key is set. See: https://docs.snowflake.com/en/user-guide/key-pair-auth.html
role
string
Snowflake role.
scheme
string
Default: snowflake
start_time
string(date-time)
Earliest date of usage to consider. Default: Last full day in UTC (or hour, depending on bucket_duration)
store_last_profiling_timestamps
boolean
Enable storing last profile timestamp in store.
Default: False
store_last_usage_extraction_timestamp
boolean
Enable checking last usage timestamp in store.
Default: True
temporary_tables_pattern
array(string)
top_n_queries
integer
Number of top queries to save to each table.
Default: 10
upstream_lineage_in_report
boolean
Default: False
use_legacy_lineage_method
boolean
Whether to use the legacy lineage computation method. By default, uses new optimised lineage extraction method that requires less ingestion process memory. Table-to-view and view-to-view column-level lineage are not supported with the legacy method.
Default: False
username
string
Snowflake username.
validate_upstreams_against_patterns
boolean
Whether to validate upstream snowflake tables against allow-deny patterns
Default: True
warehouse
string
Snowflake warehouse.
env
string
The environment that all assets produced by this connector belong to
Default: PROD
classification
ClassificationConfig
For details, refer Classification.
Default: {'enabled': False, 'sample_size': 100, 'table_patt...
classification.enabled
boolean
Whether classification should be used to auto-detect glossary terms
Default: False
classification.info_type_to_term
map(str,string)
classification.sample_size
integer
Number of sample values used for classification.
Default: 100
classification.classifiers
array(object)
classification.classifiers.type ❓
string
The type of the classifier to use. For DataHub, use datahub
classification.classifiers.config
object
The configuration required for initializing the classifier. If not specified, uses defaults for classifer type.
classification.column_pattern
AllowDenyPattern
Regex patterns to filter columns for classification. This is used in combination with other patterns in parent config. Specify regex to match the column name in database.schema.table.column format.
Default: {'allow': ['.*'], 'deny': [], 'ignoreCase': True}
classification.column_pattern.allow
array(string)
classification.column_pattern.deny
array(string)
classification.column_pattern.ignoreCase
boolean
Whether to ignore case sensitivity during pattern matching.
Default: True
classification.table_pattern
AllowDenyPattern
Regex patterns to filter tables for classification. This is used in combination with other patterns in parent config. Specify regex to match the entire table name in database.schema.table format. e.g. to match all tables starting with customer in Customer database and public schema, use the regex 'Customer.public.customer.*'
Default: {'allow': ['.*'], 'deny': [], 'ignoreCase': True}
classification.table_pattern.allow
array(string)
classification.table_pattern.deny
array(string)
classification.table_pattern.ignoreCase
boolean
Whether to ignore case sensitivity during pattern matching.
Default: True
database_pattern
AllowDenyPattern
Default: {'allow': ['.*'], 'deny': ['^UTIL_DB$', '^SNOWFLAK...
database_pattern.allow
array(string)
database_pattern.deny
array(string)
database_pattern.ignoreCase
boolean
Whether to ignore case sensitivity during pattern matching.
Default: True
domain
map(str,AllowDenyPattern)
A class to store allow deny regexes
domain.key.allow
array(string)
domain.key.deny
array(string)
domain.key.ignoreCase
boolean
Whether to ignore case sensitivity during pattern matching.
Default: True
oauth_config
OAuthConfiguration
oauth configuration - https://docs.snowflake.com/en/user-guide/python-connector-example.html#connecting-with-oauth
oauth_config.authority_url ❓
string
Authority url of your identity provider
oauth_config.client_id ❓
string
client id of your registered application
oauth_config.provider ❓
Enum
Identity provider for oauth.Supported providers are microsoft and okta.
oauth_config.client_secret
string(password)
client secret of the application if use_certificate = false
oauth_config.encoded_oauth_private_key
string
base64 encoded private key content if use_certificate = true
oauth_config.encoded_oauth_public_key
string
base64 encoded certificate content if use_certificate = true
oauth_config.scopes
array(string)
oauth_config.use_certificate
boolean
Do you want to use certificate and private key to authenticate using oauth
Default: False
profile_pattern
AllowDenyPattern
Regex patterns to filter tables (or specific columns) for profiling during ingestion. Note that only tables allowed by the table_pattern will be considered.
Default: {'allow': ['.*'], 'deny': [], 'ignoreCase': True}
profile_pattern.allow
array(string)
profile_pattern.deny
array(string)
profile_pattern.ignoreCase
boolean
Whether to ignore case sensitivity during pattern matching.
Default: True
schema_pattern
AllowDenyPattern
Regex patterns for schemas to filter in ingestion. Specify regex to only match the schema name. e.g. to match all tables in schema analytics, use the regex 'analytics'
Default: {'allow': ['.*'], 'deny': [], 'ignoreCase': True}
schema_pattern.allow
array(string)
schema_pattern.deny
array(string)
schema_pattern.ignoreCase
boolean
Whether to ignore case sensitivity during pattern matching.
Default: True
table_pattern
AllowDenyPattern
Regex patterns for tables to filter in ingestion. Specify regex to match the entire table name in database.schema.table format. e.g. to match all tables starting with customer in Customer database and public schema, use the regex 'Customer.public.customer.*'
Default: {'allow': ['.*'], 'deny': [], 'ignoreCase': True}
table_pattern.allow
array(string)
table_pattern.deny
array(string)
table_pattern.ignoreCase
boolean
Whether to ignore case sensitivity during pattern matching.
Default: True
tag_pattern
AllowDenyPattern
List of regex patterns for tags to include in ingestion. Only used if extract_tags is enabled.
Default: {'allow': ['.*'], 'deny': [], 'ignoreCase': True}
tag_pattern.allow
array(string)
tag_pattern.deny
array(string)
tag_pattern.ignoreCase
boolean
Whether to ignore case sensitivity during pattern matching.
Default: True
user_email_pattern
AllowDenyPattern
regex patterns for user emails to filter in usage.
Default: {'allow': ['.*'], 'deny': [], 'ignoreCase': True}
user_email_pattern.allow
array(string)
user_email_pattern.deny
array(string)
user_email_pattern.ignoreCase
boolean
Whether to ignore case sensitivity during pattern matching.
Default: True
view_pattern
AllowDenyPattern
Regex patterns for views to filter in ingestion. Note: Defaults to table_pattern if not specified. Specify regex to match the entire view name in database.schema.view format. e.g. to match all views starting with customer in Customer database and public schema, use the regex 'Customer.public.customer.*'
Default: {'allow': ['.*'], 'deny': [], 'ignoreCase': True}
view_pattern.allow
array(string)
view_pattern.deny
array(string)
view_pattern.ignoreCase
boolean
Whether to ignore case sensitivity during pattern matching.
Default: True
profiling
GEProfilingConfig
Default: {'enabled': False, 'limit': None, 'offset': None, ...
profiling.catch_exceptions
boolean
Default: True
profiling.enabled
boolean
Whether profiling should be done.
Default: False
profiling.field_sample_values_limit
integer
Upper limit for number of sample values to collect for all columns.
Default: 20
profiling.include_field_distinct_count
boolean
Whether to profile for the number of distinct values for each column.
Default: True
profiling.include_field_distinct_value_frequencies
boolean
Whether to profile for distinct value frequencies.
Default: False
profiling.include_field_histogram
boolean
Whether to profile for the histogram for numeric fields.
Default: False
profiling.include_field_max_value
boolean
Whether to profile for the max value of numeric columns.
Default: True
profiling.include_field_mean_value
boolean
Whether to profile for the mean value of numeric columns.
Default: True
profiling.include_field_median_value
boolean
Whether to profile for the median value of numeric columns.
Default: True
profiling.include_field_min_value
boolean
Whether to profile for the min value of numeric columns.
Default: True
profiling.include_field_null_count
boolean
Whether to profile for the number of nulls for each column.
Default: True
profiling.include_field_quantiles
boolean
Whether to profile for the quantiles of numeric columns.
Default: False
profiling.include_field_sample_values
boolean
Whether to profile for the sample values for all columns.
Default: True
profiling.include_field_stddev_value
boolean
Whether to profile for the standard deviation of numeric columns.
Default: True
profiling.limit
integer
Max number of documents to profile. By default, profiles all documents.
profiling.max_number_of_fields_to_profile
integer
A positive integer that specifies the maximum number of columns to profile for any table. None implies all columns. The cost of profiling goes up significantly as the number of columns to profile goes up.
profiling.max_workers
integer
Number of worker threads to use for profiling. Set to 1 to disable.
Default: 20
profiling.offset
integer
Offset in documents to profile. By default, uses no offset.
profiling.partition_datetime
string(date-time)
For partitioned datasets profile only the partition which matches the datetime or profile the latest one if not set. Only Bigquery supports this.
profiling.partition_profiling_enabled
boolean
Default: True
profiling.profile_if_updated_since_days
number
Profile table only if it has been updated since these many number of days. If set to null, no constraint of last modified time for tables to profile. Supported only in snowflake and BigQuery.
profiling.profile_table_level_only
boolean
Whether to perform profiling at table-level only, or include column-level profiling as well.
Default: False
profiling.profile_table_row_count_estimate_only
boolean
Use an approximate query for row count. This will be much faster but slightly less accurate. Only supported for Postgres and MySQL.
Default: False
profiling.profile_table_row_limit
integer
Profile tables only if their row count is less then specified count. If set to null, no limit on the row count of tables to profile. Supported only in snowflake and BigQuery
Default: 5000000
profiling.profile_table_size_limit
integer
Profile tables only if their size is less then specified GBs. If set to null, no limit on the size of tables to profile. Supported only in snowflake and BigQuery
Default: 5
profiling.query_combiner_enabled
boolean
This feature is still experimental and can be disabled if it causes issues. Reduces the total number of queries issued and speeds up profiling by dynamically combining SQL queries where possible.
Default: True
profiling.report_dropped_profiles
boolean
Whether to report datasets or dataset columns which were not profiled. Set to True for debugging purposes.
Default: False
profiling.turn_off_expensive_profiling_metrics
boolean
Whether to turn off expensive profiling or not. This turns off profiling for quantiles, distinct_value_frequencies, histogram & sample_values. This also limits maximum number of fields being profiled to 10.
Default: False
stateful_ingestion
StatefulStaleMetadataRemovalConfig
Base specialized config for Stateful Ingestion with stale metadata removal capability.
stateful_ingestion.enabled
boolean
The type of the ingestion state provider registered with datahub.
Default: False
stateful_ingestion.remove_stale_metadata
boolean
Soft-deletes the entities present in the last successful run but missing in the current run with stateful_ingestion enabled.
Default: True

Code Coordinates​

  • Class Name: datahub.ingestion.source.snowflake.snowflake_v2.SnowflakeV2Source
  • Browse on GitHub

Questions

If you've got any questions on configuring ingestion for Snowflake, feel free to ping us on our Slack.