Snowflake Oauth

Prerequisites

• ACCOUNTADMIN access, or a role with the global CREATE INTEGRATION privilege, to run SQL commands.

Integration steps

Step 1: Create a dedicated Zluri role

Go to Snowflake Admin Center. Click the + icon and select SQL File.

Run the following command to create a least-privilege role for the Zluri integration:

-- Switch to a role that can create roles
USE ROLE SECURITYADMIN;

-- Create a dedicated role for the Zluri integration
CREATE ROLE IF NOT EXISTS ZLURI_INTEGRATION_ROLE;

-- Grant only the privileges Zluri needs
GRANT USAGE ON WAREHOUSE <your_warehouse> TO ROLE ZLURI_INTEGRATION_ROLE;
GRANT USAGE ON DATABASE <your_database> TO ROLE ZLURI_INTEGRATION_ROLE;
GRANT USAGE ON SCHEMA <your_database>.<your_schema> TO ROLE ZLURI_INTEGRATION_ROLE;
GRANT SELECT ON ALL VIEWS IN SCHEMA <your_database>.<your_schema> TO ROLE ZLURI_INTEGRATION_ROLE;

-- Assign the role to the service user Zluri authenticates as
GRANT ROLE ZLURI_INTEGRATION_ROLE TO USER <zluri_service_user>;

• Replace <your_warehouse>, <your_database>, <your_schema>, and <zluri_service_user> with your account's values.
• Paste the command into the SQL file editor.
• Select and run the command.
• Confirm that it executed successfully.
• Grant only the objects Zluri needs for discovery and monitoring. Avoid account-wide privileges unless your use case requires them.

Step 2: Create the OAuth security integration

Run the following command as ACCOUNTADMIN or a role with the CREATE INTEGRATION privilege:

CREATE SECURITY INTEGRATION oauth_integration
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://integrations.zluri.com/connect_callback/snowflakeOauth'
  ALLOWED_ROLES_LIST = ('ZLURI_INTEGRATION_ROLE');

• Rename oauth_integration if your naming convention requires it.
• Paste the command into the SQL file editor.
• Select and run the command.
• Confirm that it executed successfully.
• The ALLOWED_ROLES_LIST parameter restricts the integration to the dedicated Zluri role. Do not add ACCOUNTADMIN, SECURITYADMIN, ORGADMIN, or GLOBALORGADMIN to this list. Snowflake blocks these roles from OAuth by default, and this guide keeps that default in place.

Step 3: Retrieve the OAuth client secret

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('OAUTH_INTEGRATION');

• Run the command.
• Copy the credentials from the results and store them securely.

Step 4: Retrieve your account details

• Click your profile icon in the bottom left.
• Click Account and view your account details.
• Copy the highlighted account information.

Step 5: Connect Snowflake OAuth in Zluri

• Confirm that the Snowflake integration connects successfully.

Migrating an existing integration

If you set up this integration using a previous version of this guide, it may use a privileged role, such as ACCOUNTADMIN, with account-wide OAuth privileged-role access enabled. Follow these steps to migrate to the least-privilege setup.

1. Create ZLURI_INTEGRATION_ROLE and grant it least-privilege access, as described in Step 1.
2. Update the existing security integration to restrict it to the new role:
   SQL

   ALTER SECURITY INTEGRATION oauth_integration
     SET ALLOWED_ROLES_LIST = ('ZLURI_INTEGRATION_ROLE');

3. Re-authenticate the Zluri connection using the new role.
4. Confirm that the connection works with the least-privilege role.
5. Revoke the privileged role from the integration.
6. Confirm that no other integration in your account depends on the account-wide privileged-role setting. If none do, restore the default:
   SQL

   ALTER ACCOUNT SET OAUTH_ADD_PRIVILEGED_ROLES_TO_BLOCKED_LIST = TRUE;