Skip to content

Commit 92988fc

Browse files
rchinn1rchinn1
committed
Update Snowflake with new setup flow
1 parent 59f3845 commit 92988fc

File tree

1 file changed

+110
-97
lines changed

1 file changed

+110
-97
lines changed

‎src/unify/linked-profiles/setup-guides/snowflake-setup.md

Lines changed: 110 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ beta: true
55
---
66

77
> info "Linked Profiles is in private beta"
8-
> Linked Profiles (Data Graph, Linked Events, and Linked Audiences) is in private beta, and Segment is actively working on this feature. Some functionality may change before it becomes generally available. [Contact Segment](https://segment.com/help/contact/){:target="_blank"} with any feedback or questions.
8+
> Linked Profiles (Data Graph, Linked Events, and Linked Audiences) is in private beta, and Segment is actively working on this feature. Some functionality may change before it becomes generally available.
99
1010

1111
On this page, you'll learn how to connect your Snowflake data warehouse to Segment.
@@ -18,121 +18,134 @@ Be sure to log in with a user that has read and write permissions so that Segmen
1818

1919
## Getting started
2020

21-
To get started with Snowflake:
22-
23-
1. Log in to your Snowflake account.
24-
2. Navigate to *Worksheets*.
25-
26-
Segment recommends you use the `ACCOUNTADMIN` role to execute the commands below.
27-
28-
## Create a new warehouse
29-
30-
> info ""
31-
> This step is optional, and you can use an existing Snowflake warehouse if you'd like.
32-
33-
Enter and run the code below to create a virtual warehouse. Linked Profiles needs to execute queries on your Snowflake account, which requires a Virtual Warehouse to handle the compute.
34-
35-
```sql
36-
CREATE WAREHOUSE segment_entities
37-
WITH WAREHOUSE_SIZE = 'XSMALL'
38-
WAREHOUSE_TYPE = 'STANDARD'
39-
AUTO_SUSPEND = 600 -- 5 minutes
40-
AUTO_RESUME = TRUE;
41-
```
42-
43-
## Create a new role
44-
45-
Enter and run the code below to create specific roles for Linked Profiles. All Snowflake access is specified through roles, which are then assigned to the user you’ll create later.
46-
47-
```ts
48-
-- create role
49-
CREATE ROLE segment_entities;
50-
51-
-- warehouse access
52-
GRANT USAGE ON WAREHOUSE segment_entities TO ROLE segment_entities;
53-
54-
-- database access
55-
GRANT USAGE ON DATABASE <database-name> TO ROLE segment_entities;
56-
GRANT CREATE SCHEMA ON DATABASE <database-name> TO ROLE segment_entities;
57-
```
58-
59-
## Create a new user
60-
61-
Enter and run the code below to create the username and password combination that will be used to execute queries. Make sure to enter your password where it says `<my_strong_password>`.
62-
63-
```sql
64-
-- create user
65-
CREATE USER segment_entities_user
66-
MUST_CHANGE_PASSWORD = FALSE
67-
DEFAULT_ROLE = segment_entities
68-
PASSWORD = 'my_strong_password'; -- Do not use this password
69-
70-
-- role access
71-
GRANT ROLE segment_entities TO USER segment_entities_user;
72-
```
73-
74-
## Grant read access to tables
21+
Use the following steps to set up Snowflake for Linked Profiles.
22+
23+
### Set up Snowflake Credentials and create internal Segment DB
24+
25+
Run the SQL below to provide Segment Linked Profiles with the necessary permissions and roles to access the databases, tables, and schemas. These steps involve:
26+
- Creating a new role and user for Segment Linked Profiles.
27+
- Granting read-only access to specific databases and schemas that you want to use for Linked Profiles.
28+
- Granting write access to an internal database that Segment requires for bookkeeping purposes.
29+
- [Optional] Creating a new warehouse if it does not exist yet. You can skip this step if a warehouse already exists.
30+
- [Optional] As a best practice, Segment recommends that restrict access to specific databases and schemas.
31+
- Running the script below to configure the Warehouse permissions.
32+
33+
```ts
34+
-- ********** SET UP THE FOLLOWING WAREHOUSE PERMISSIONS **********
35+
-- Edit the following variables
36+
SET segment_linked_username='SEGMENT_LINKED_USER';
37+
SET segment_linked_password='my-safe-password';
38+
SET segment_linked_default_warehouse='SEGMENT_LINKED_WH';
39+
SET segment_linked_default_role='SEGMENT_LINKED_ROLE';
40+
41+
-- Use the same DB that has Profiles Sync configured. This DB is also used for Segment's internal bookkeeping. Note: Use this DB in the connection settings on the Segment app.
42+
SET segment_internal_database = 'SEGMENT_INTERNAL_DB';
43+
44+
-- Use for each DB you want Linked Profiles to access
45+
SET segment_linked_database='MARKETING_DB';
46+
47+
48+
-- ********** [OPTIONAL] UNCOMMENT THE CODE BELOW IF YOU NEED TO CREATE A NEW WAREHOUSE **********
49+
-- CREATE WAREHOUSE IF NOT EXISTS identifier($segment_linked_default_warehouse)
50+
-- WITH WAREHOUSE_SIZE = 'XSMALL'
51+
-- WAREHOUSE_TYPE = 'STANDARD'
52+
-- AUTO_SUSPEND = 600 -- 5 minutes
53+
-- AUTO_RESUME = TRUE;
54+
55+
56+
-- ********** RUN THE COMMANDS BELOW TO FINISH SETTING UP THE WAREHOUSE PERMISSIONS **********
57+
58+
-- Use admin role for setting grants
59+
USE ROLE ACCOUNTADMIN;
60+
61+
-- Create a role for Segment Linked Profiles
62+
CREATE ROLE IF NOT EXISTS identifier($segment_linked_default_role)
63+
COMMENT = 'Used for Segment Linked Profiles';
64+
65+
-- Create a user for Segment Linked Profiles
66+
CREATE USER IF NOT EXISTS identifier($segment_linked_username)
67+
MUST_CHANGE_PASSWORD = FALSE
68+
DEFAULT_ROLE = $segment_linked_default_role
69+
PASSWORD=$segment_linked_password
70+
COMMENT='Segment Linked Profiles User';
71+
72+
-- Grant permission to the role to use the warehouse
73+
GRANT USAGE ON WAREHOUSE identifier($segment_linked_default_warehouse) TO ROLE identifier($segment_linked_default_role);
74+
75+
-- Grant role to the user
76+
GRANT ROLE identifier($segment_linked_default_role) TO USER identifier($segment_linked_username);
77+
78+
-- Grant access to Segment internal DB used for bookkeeping. This is the same DB that contains the Profiles Sync schema.
79+
GRANT USAGE ON DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
80+
GRANT USAGE ON ALL SCHEMAS IN DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
81+
GRANT CREATE SCHEMA ON DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
82+
GRANT SELECT ON ALL TABLES IN DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
83+
GRANT SELECT ON FUTURE TABLES IN DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
84+
GRANT SELECT ON ALL VIEWS IN DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
85+
GRANT SELECT ON FUTURE VIEWS IN DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
86+
GRANT SELECT ON ALL EXTERNAL TABLES IN DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
87+
GRANT SELECT ON FUTURE EXTERNAL TABLES IN DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
88+
GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
89+
GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE identifier($segment_internal_database) TO ROLE identifier($segment_linked_default_role);
90+
91+
-- Grant read-only access to all DBs
92+
GRANT USAGE ON DATABASE identifier($segment_linked_database) TO ROLE identifier($segment_linked_default_role);
93+
GRANT USAGE ON ALL SCHEMAS IN DATABASE identifier($segment_linked_database) TO ROLE identifier($segment_linked_default_role);
94+
GRANT SELECT ON ALL TABLES IN DATABASE identifier($segment_linked_database) TO ROLE identifier($segment_linked_default_role);
95+
GRANT SELECT ON FUTURE TABLES IN DATABASE identifier($segment_linked_database) TO ROLE identifier($segment_linked_default_role);
96+
GRANT SELECT ON ALL VIEWS IN DATABASE identifier($segment_linked_database) TO ROLE identifier($segment_linked_default_role);
97+
GRANT SELECT ON FUTURE VIEWS IN DATABASE identifier($segment_linked_database) TO ROLE identifier($segment_linked_default_role);
98+
GRANT SELECT ON ALL EXTERNAL TABLES IN DATABASE identifier($segment_linked_database) TO ROLE identifier($segment_linked_default_role);
99+
GRANT SELECT ON FUTURE EXTERNAL TABLES IN DATABASE identifier($segment_linked_database) TO ROLE identifier($segment_linked_default_role);
100+
GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE identifier($segment_linked_database) TO ROLE identifier($segment_linked_default_role);
101+
GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE identifier($segment_linked_database) TO ROLE identifier($segment_linked_default_role);
102+
```
75103

76-
To use Linked Profiles, you'll need to grant access to `segment_entities_user` for the schemas and tables you'd like to read from to perform enrichments.
77104

78-
These tables need to live in the same database as the one used for storing sync deltas. You can give as broad or narrow of access as you require. If you give broad access to multiple schemas, you can sort through the schemas in Segment to select the appropriate tables to create models from.
105+
(Optional) [Snowflake Schema Access](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#table-privileges): If you want to restrict access to specific schemas or tables, then run the following command:
79106

80-
> info ""
81-
> Segment only supports tables, materialized views, views, and external tables as data sources.
82-
83-
> success ""
84-
> Visit Snowflake's docs to learn more about [schema priveleges](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#schema-privileges){:target="_blank"} and [table priveleges](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#table-privileges){:target="_blank"}.
107+
```ts
108+
-- [Optional] Further restrict access to only specific schemas and tables
109+
SET db='MY_DB';
110+
SET schema='MY_DB.MY_SCHEMA_NAME';
85111

86-
### Schema access
112+
-- View specific schemas in database
113+
GRANT USAGE ON DATABASE identifier($db) TO ROLE identifier($segment_linked_default_role);
87114

88-
Run the following command to give access to specific schemas you want to use for enrichment.
115+
GRANT USAGE ON SCHEMA identifier($schema) TO ROLE identifier($segment_linked_default_role);
89116

90-
```ts
91-
-- view specific schemas in database
92-
GRANT USAGE ON SCHEMA <schema-name-1> TO ROLE segment_entities;
93-
GRANT USAGE ON SCHEMA <schema-name-2> TO ROLE segment_entities;
117+
GRANT SELECT ON ALL TABLES IN SCHEMA identifier($schema) TO ROLE identifier($segment_linked_default_role);
94118

95-
-- query data from all tables in a schema
96-
GRANT SELECT ON ALL TABLES IN SCHEMA <schema-name-1> TO ROLE segment_entities;
97-
GRANT SELECT ON ALL TABLES IN SCHEMA <schema-name-2> TO ROLE segment_entities;
98-
99-
-- query data from future tables in a schema
100-
GRANT SELECT ON FUTURE TABLES IN SCHEMA <schema-name-1> TO ROLE segment_entities;
101-
GRANT SELECT ON FUTURE TABLES IN SCHEMA <schema-name-2> TO ROLE segment_entities;
119+
GRANT SELECT ON FUTURE TABLES IN SCHEMA identifier($schema) TO ROLE identifier($segment_linked_default_role);
102120
```
103121

104-
### Table access
122+
### (If applicable) Add table permissions if Reverse ETL has ever run in your database
105123

106-
If you'd like to restrict access to specific tables, use the following command:
124+
If Reverse ETL has ever run in the database you are configuring as the Segment Internal DB, a Segment-managed schema is created and a new user is added. Add the Snowflake table permissions by running the following command.
107125

108126
```ts
109-
-- query data from a specific table in a schema
110-
GRANT SELECT ON TABLE <schema-name>.<table_name> TO ROLE segment_entities;
111-
```
112-
113-
### Reverse ETL table permissions
127+
-- If you want to use an existing database that already has Segment Reverse ETL schemas, you’ll need to run some additional steps below to grant the role access to the existing schemas.
114128

115-
If you've ever run Segment's [Reverse ETL](/docs/connections/reverse-etl/) in your database, you'll need to add the following [table permissions](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#table-privileges){:target="_blank"}:
129+
SET retl_schema = concat($segment_internal_database,'.__segment_reverse_etl');
116130

117-
```sql
118-
GRANT USAGE ON SCHEMA __segment_reverse_etl TO ROLE segment_entities;
131+
GRANT USAGE ON SCHEMA identifier($retl_schema) TO ROLE identifier($segment_linked_default_role);
119132

120-
GRANT CREATE TABLE ON SCHEMA __segment_reverse_etl TO ROLE segment_entities;
133+
GRANT CREATE TABLE ON SCHEMA identifier($retl_schema) TO ROLE identifier($segment_linked_default_role);
121134

122-
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA __segment_reverse_etl TO ROLE segment_entities;
135+
GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA identifier($retl_schema) TO ROLE identifier($segment_linked_default_role);
123136
```
124137

125-
### Confirm table permissions
138+
### Confirm permissions
126139

127-
To confirm table permissions:
128-
1. Log in as the user you've created (`segment_entities_user`).
129-
2. Verify the role created has the correct permissions with the commands below.
140+
To verify you have set up the right permissions for a specific table, log in with the username and password you created for `SEGMENT_LINKED_USER` and run the following command to verify the role you created has the correct permissions. This command should succeed and you should be able to view the respective table.
130141

131142
```ts
132-
USE ROLE segment_entities;
133-
USE DATABASE <your_database>;
134-
SHOW SCHEMAS;
135-
SELECT * FROM <your_database>.<schema-name>.<table-name> LIMIT 10;
136-
```
143+
set segment_linked_default_role='SEGMENT_LINKED_ROLE';
144+
set segment_linked_database='YOUR_DB';
145+
set table_name = 'YOUR_DB.SCHEMA.TABLE';
137146

138-
The output should match the permissions you've given in previous steps.
147+
USE ROLE identifier($segment_linked_default_role);
148+
USE DATABASE identifier($segment_linked_database) ;
149+
SHOW SCHEMAS;
150+
SELECT * FROM identifier($table) LIMIT 10;
151+
```

0 commit comments

Comments
 (0)