Setup Omni Connector¶

• A workspace with Unity Catalog and a running SQL warehouse. The connector reads metadata and grants through JDBC.
• A service principal (OAuth M2M, recommended) or a personal access token.
• To scan, the credential needs USE CATALOG, USE SCHEMA and BROWSE on every catalog it should see. Unity Catalog has no wildcard grant, so grant on each catalog:

  SQL
  1	GRANT USE CATALOG, USE SCHEMA, BROWSE ON CATALOG `<catalog>` TO `<sp-application-id>`;

• To enforce policies, the credential must be able to GRANT and REVOKE on the objects it manages, for example as the owner or with MANAGE.
• To read the grants of a foreign catalog, grant MANAGE on it. To link a foreign catalog to its source, grant USE CONNECTION on its connection.

• A workspace with a running SQL warehouse that can reach the hive metastore.
• A service principal (OAuth M2M, recommended) or a personal access token.
• The credential must be able to read and grant on the legacy table ACLs of the databases it manages.
• If you turn on access audits, the credential must be a workspace admin, so that it can see other users' queries.

• A role that can create a role, warehouse and user (ACCOUNTADMIN, or SECURITYADMIN with SYSADMIN).
• A small, auto-suspending warehouse. Reading INFORMATION_SCHEMA needs compute.
• A least-privilege role and user for the connector:

  SQL

  1 2 3 4 5 6 7 8 9 10 11 12 13 14

  CREATE ROLE IF NOT EXISTS GOV_SNOWFLAKE_CONNECTOR; CREATE WAREHOUSE IF NOT EXISTS GOV_WH WITH WAREHOUSE_SIZE = 'XSMALL' AUTO_SUSPEND = 60 AUTO_RESUME = TRUE INITIALLY_SUSPENDED = TRUE; GRANT USAGE ON WAREHOUSE GOV_WH TO ROLE GOV_SNOWFLAKE_CONNECTOR; -- Repeat for each governed database GRANT USAGE ON DATABASE <db> TO ROLE GOV_SNOWFLAKE_CONNECTOR; GRANT USAGE ON ALL SCHEMAS IN DATABASE <db> TO ROLE GOV_SNOWFLAKE_CONNECTOR; GRANT USAGE ON FUTURE SCHEMAS IN DATABASE <db> TO ROLE GOV_SNOWFLAKE_CONNECTOR; GRANT REFERENCES ON ALL TABLES IN DATABASE <db> TO ROLE GOV_SNOWFLAKE_CONNECTOR; GRANT REFERENCES ON ALL VIEWS IN DATABASE <db> TO ROLE GOV_SNOWFLAKE_CONNECTOR; CREATE USER IF NOT EXISTS GOV_CONN DEFAULT_ROLE = GOV_SNOWFLAKE_CONNECTOR DEFAULT_WAREHOUSE = GOV_WH; GRANT ROLE GOV_SNOWFLAKE_CONNECTOR TO USER GOV_CONN;

• To enforce policies, the role needs the authority to GRANT and REVOKE. The scoped option is to make the role the owner of managed-access schemas. The broad option is GRANT MANAGE GRANTS ON ACCOUNT.
• For key-pair authentication, generate an RSA key pair and register the public key on the user:

  Bash
  1 2	openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out gov_snowflake_rsa.p8 -nocrypt openssl rsa -in gov_snowflake_rsa.p8 -pubout -out gov_snowflake_rsa.pub

  SQL
  1	ALTER USER GOV_CONN SET RSA_PUBLIC_KEY='<base64 body, without the PEM header and footer>';

• The connector user must be a superuser, or have SYSLOG ACCESS UNRESTRICTED together with the authority to grant. Redshift lets only the owner, a WITH GRANT OPTION holder or a superuser grant on objects, and the catalog views the connector reads return only the current user's own objects to a non-privileged user.
• For IAM authentication, the AWS identity must be allowed to get database credentials for the cluster (GetClusterCredentials) or the serverless workgroup (GetCredentials).
• If you turn on access audits, run the following for the connector login (not needed for a superuser):

  SQL
  1	ALTER USER <connector_login> SYSLOG ACCESS UNRESTRICTED;

• The connector's AWS identity needs glue:GetCatalogs, glue:GetCatalog, glue:GetDatabases, glue:GetDatabase, glue:GetTables, glue:GetTable, lakeformation:ListPermissions, lakeformation:ListResources, lakeformation:ListRLSPolicyAttachments, lakeformation:GetRLSPolicy and sts:GetCallerIdentity, plus Lake Formation read access: a read-only data lake administrator, or DESCRIBE on each governed database.
• To enforce policies, it also needs lakeformation:GrantPermissions, lakeformation:RevokePermissions, lakeformation:BatchGrantPermissions and lakeformation:BatchRevokePermissions, and the authority to grant (a data lake administrator in the region, or grant option).
• To apply row filters, it also needs lakeformation:CreateRLSPolicy, lakeformation:AttachRLSPolicy, lakeformation:DetachRLSPolicy and lakeformation:DeleteRLSPolicy.
• The recommended credential source is the pod's IAM role (IRSA), which keeps keys out of the configuration. To use another account, use an assumed role: the base identity must be allowed sts:AssumeRole on it, and its trust policy must allow the base identity.

The Lake Formation Federation section is optional. See Lake Formation Federation.

Each scan resumes the warehouse, and Snowflake bills a 60-second minimum. Use an XSMALL warehouse with AUTO_SUSPEND = 60, and keep the scan schedule modest.