Setup PrivateLink for Snowflake Connector¶
Applies to Trust3AI Cloud connectors only
This page applies only to connectors that run entirely inside Trust3AI Cloud — where Trust3 hosts and operates the connector for you. If your connector runs in your own Kubernetes cluster (Self-Managed or runtime plane in your account), private connectivity is configured in your own network and this page does not apply.
Overview¶
By default, the Trust3 Snowflake connector reaches your Snowflake account over its public endpoint. With AWS PrivateLink, that traffic stays inside AWS private networking and never traverses the public internet.
Trust3 provisions and operates all AWS networking on its side. Your part is two steps: enable PrivateLink on your Snowflake account, then raise a ticket with Trust3.
This page covers PrivateLink setup only
These steps establish the private network path. They do not create or configure the connector itself. Once PrivateLink is active, continue to the Snowflake connector documentation to set it up.
Step 1: Enable AWS PrivateLink on your Snowflake account¶
Follow Snowflake's own AWS PrivateLink and Snowflake documentation. This requires Business Critical edition or higher — PrivateLink is not available on Standard or Enterprise. If you are on a lower edition, contact your Snowflake account team first.
Those steps ask you for the AWS account that needs private access to your Snowflake account. Use Trust3's:
| Item | Value |
|---|---|
| Trust3 AWS account ID | 870790086151 |
Because this is a third-party account, Snowflake's self-service SYSTEM$AUTHORIZE_PRIVATELINK function cannot authorize it — you will need to raise a case with Snowflake Support to have it applied.
Once the authorization is in place, Snowflake provides a VPC endpoint service name that looks like com.amazonaws.vpce.us-west-2.vpce-svc-0a1b2c3d4e5f67890. Keep it for Step 2.
Looking up the service name yourself
If you no longer have Snowflake's reply, you can read the same value from your account. In a Snowsight worksheet, using the ACCOUNTADMIN role, run:
| SQL | |
|---|---|
Take the privatelink-vpce-id value from the output and send that as the service name. Ignore the other fields — Trust3 does not need them, and the connector continues to use your standard account URL.
Step 2: Request PrivateLink from Trust3¶
Follow How to Get Support to raise a ticket, and include:
| Item | Description |
|---|---|
| Connector type | Snowflake |
| Your Trust3 account ID | Shown in the profile menu at the top right of the Trust3 portal |
| Snowflake account URL | The account URL you want to configure with the Trust3 connector, e.g. xy12345.us-west-2.snowflakecomputing.com |
| AWS region | The region your Snowflake account runs in |
| VPC endpoint service name | The service name from Step 1 |
Step 3: Trust3 completes the setup¶
Trust3 creates the VPC endpoint, configures private DNS for your account URL, verifies the private path, and confirms on the ticket when it is ready to use. Nothing further is needed from you in Snowflake — the endpoint is accepted automatically.
Next: Set up the connector¶
With the private path in place, go to Snowflake for the connector's prerequisites and setup steps.
Use your existing Snowflake account URL during connector setup — it does not change for PrivateLink. Trust3 changes only how that hostname resolves inside its own network, so your credentials and TLS work exactly as they do today.