--- schema_version: "1" id: dea2e6a6e1fc714cb72ff3eb92e9b51999203ccebfc0cfe42444537b08b4a779 title: Set Up a Snowflake Data Federation Connection collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/data-cloud/data-cloud-int/guides/snowflake/c360-a-set-up-data-federation-snowflake-connection.md canonical_url: https://developer.salesforce.com/docs/data/data-cloud-int/guide/c360-a-set-up-data-federation-snowflake-connection.html source_site: developer.salesforce.com content_type: documentation content_hash: 553923fd4e6d0c5f5fe14af25c5a7262ba44e117c63558b34d4dcb03357e9f69 products: - Data 360 Integration Guide - Data 360 Developer Documentation --- # Set Up a Snowflake Data Federation Connection Set up a connection between Snowflake and Data 360 to access the data. To set up a Snowflake data federation connection for Data 360, see [Private Connect for Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_private_connect_data_cloud.htm&type=5). | User Permissions Needed |   | | --------------------------------------------------------------- | ----------------------------------------------------------- | | To create a Snowflake Data Federation connection in Data Cloud. | System Admin profile or Data Cloud Architect permission set | Before you begin: - Review [Data 360 IP Allowlist](https://help.salesforce.com/s/articleView?id=data.c360_a_data_cloud_ip_address_allowlist.htm&type=5) and update your allowlists. See [Add an IP Networking Policy](https://help.salesforce.com/s/articleView?id=data.c360_a_add_ip_networking_policy.htm&type=5). - Get the Snowflake credentials and private key from Snowflake admin. See [Key-pair authentication and rotation](https://docs.snowflake.com/en/user-guide/key-pair-auth). - To support large data sizes, contact Snowflake admin and increase the security token expiry time in Snowflake to 24 hours. **note:** You can’t use an existing connection and change it to use Private Connect. This isn’t supported. 1. In Data Cloud, go to **Data Cloud Setup**. 2. Under External Integrations, select **Snowflake**. 3. Click **New**. 4. Enter a connection name and connection API name. 5. If you want to use private key-based authentication, get the Snowflake credentials and private key from Snowflake admin. See [Key-pair authentication and rotation](https://docs.snowflake.com/en/user-guide/key-pair-auth). To use an encrypted private key, enter the key passphrase in the optional passphrase field. When you enter the key, don’t include BEGIN PRIVATE KEY at the start of the key and END PRIVATE KEY at the end. For details on creating Integration User in Snowflake and assigning them your public key, see [Zero Copy Data Federation with Snowflake](https://developer.salesforce.com/blogs/2024/08/zero-copy-data-federation-with-snowflake-and-salesforce-data-cloud). If you are using private key-based authentication, skip the next step and continue setting up your connection. 6. If you want to use identity provider-based authentication, toggle the **Use Salesforce IDP Auth** button and copy the generated external ID. You must keep the connector window open till you finish configuring the authentication. 1. In your Snowflake worksheet, open the SQL Editor and create a dedicated role for Data Cloud using this command. ``` create role if not exists ; ``` This role to is used to attach to Snowflake OIDC user and pass on the privileges and accesses. 2. Grant access to the appropriate warehouse, database, and schema. ``` grant usage on warehouse to role ; grant usage on database to role ; grant usage on schema to role ``` 3. If required, add object-level privileges. ``` grant on future tables in schema to role ; ``` 4. Create a service user of type WORKLOAD_IDENTITY (OIDC) using this SQL blurb as reference. ``` CREATE OR REPLACE USER WORKLOAD_IDENTITY = ( TYPE = OIDC ISSUER=‘https://yourcompany.my.salesforce.com/services/connectors’ SUBJECT = ‘ OIDC_AUDIENCE_LIST =(‘https://yourcompany.my.salesforce.com) ) TYPE = SERVICE DEFAULT_ROLE = ``` **note:** Don't convert a human user to a service user. Create a new Snowflake service user specifically for Data 360. 1. In the ISSUER field, enter your org’s My Domain URL followed by */services/connectors*. For example, *https://yourcompany.my.salesforce.com/services/connectors*. See, [My Domain](https://help.salesforce.com/s/articleView?id=xcloud.domain_name_overview.htm&type=5). 2. For the SUBJECT field, enter the external ID copied from the Data Cloud new connection dialog box. **note:** The external ID is unique to each new connection. If you close the Data Cloud connection dialog box, a new external ID is generated. Keep the dialog box open until you've completed the Snowflake script and are ready to complete the connection. 3. For the OIDC_AUDIENCE_LIST field, enter your org’s My Domain URL. For example, *https://yourcompany.my.salesforce.com*. 5. Attach the role to the service user that you created. ``` grant role to user ; ``` 6. Copy the OIDC username from the query and paste it in the **Username** field in Data Cloud. 7. In the **Account URL** field, enter your Snowflake account URL. 8. Click **Next**. 9. Select a warehouse, and click **Save**. **note:** The unload function for enhanced acceleration is enabled by default. You can disable it here. Note that disabling this feature can degrade the performance of data movement when caching. ## See Also - [_Salesforce Help_: Add a Private Network Route for Snowflake](https://help.salesforce.com/s/articleView?id=data.c360_a_add_network_route_snowflake.htm&type=5) - [_Salesforce Developers Blog_: Zero Copy Data Federation with Snowflake and Salesforce Data Cloud](https://developer.salesforce.com/blogs/2024/08/zero-copy-data-federation-with-snowflake-and-salesforce-data-cloud)