226 lines
8.9 KiB
Plaintext
226 lines
8.9 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Snowflake - Database - Secrets Engines
|
|
description: |-
|
|
Snowflake is one of the supported plugins for the database secrets engine.
|
|
This plugin generates database credentials dynamically based on configured
|
|
roles for Snowflake hosted databases.
|
|
---
|
|
|
|
# Snowflake Database Secrets Engine
|
|
|
|
Snowflake is one of the supported plugins for the database secrets engine. This plugin
|
|
generates database credentials dynamically based on configured roles for Snowflake-hosted
|
|
databases and supports [Static Roles](/docs/secrets/databases#static-roles).
|
|
|
|
See the [database secrets engine](/docs/secrets/databases) docs for
|
|
more information about setting up the database secrets engine.
|
|
|
|
The Snowflake database secrets engine uses
|
|
[gosnowflake](https://pkg.go.dev/github.com/snowflakedb/gosnowflake).
|
|
|
|
## Capabilities
|
|
|
|
| Plugin Name | Root Credential Rotation | Dynamic Roles | Static Roles | Username Customization | Credential Types |
|
|
| --------------------------- | ------------------------ | ------------- | ------------ | ---------------------- |---------------------------|
|
|
| `snowflake-database-plugin` | Yes | Yes | Yes | Yes (1.8+) | password, rsa_private_key |
|
|
|
|
## Setup
|
|
|
|
1. Enable the database secrets engine if it is not already enabled:
|
|
|
|
```shell-session
|
|
$ vault secrets enable database
|
|
Success! Enabled the database secrets engine at: database/
|
|
```
|
|
|
|
By default, the secrets engine will enable at the name of the engine. To
|
|
enable the secrets engine at a different path, use the `-path` argument.
|
|
|
|
1. Configure Vault with the proper plugin and connection information:
|
|
|
|
```shell-session
|
|
$ vault write database/config/my-snowflake-database \
|
|
plugin_name=snowflake-database-plugin \
|
|
allowed_roles="my-role" \
|
|
connection_url="{{username}}:{{password}}@ecxxxx.west-us-1.azure/db_name" \
|
|
username="vaultuser" \
|
|
password="vaultpass"
|
|
```
|
|
|
|
A properly formatted data source name (DSN) needs to be provided during configuration of the
|
|
database. This DSN is typically formatted with the following options:
|
|
|
|
```shell-session
|
|
{{username}}:{{password}}@account/db_name
|
|
```
|
|
|
|
`{{username}}` and `{{password}}` will typically be used as is during configuration. The
|
|
special formatting is replaced by the username and password options passed to the configuration
|
|
for initial connection.
|
|
|
|
`account` is your Snowflake account identifier. You can find out more about this value by reading
|
|
the `server` section of
|
|
[this document](https://docs.snowflake.com/en/user-guide/odbc-parameters.html#connection-parameters).
|
|
|
|
`db_name` is the name of a database in your Snowflake instance.
|
|
|
|
~> **Note:** The user being utilized should have `ACCOUNT_ADMIN` privileges, and should be different
|
|
from the root user you were provided when making your Snowflake account. This allows you to rotate
|
|
the root credentials and still be able to access your account.
|
|
|
|
## Usage
|
|
|
|
After the secrets engine is configured, configure dynamic and static roles to
|
|
enable generating credentials.
|
|
|
|
### Dynamic Roles
|
|
|
|
#### Password Credentials
|
|
|
|
1. Configure a role that creates new Snowflake users with password credentials:
|
|
|
|
```shell-session
|
|
$ vault write database/roles/my-password-role \
|
|
db_name=my-snowflake-database \
|
|
creation_statements="CREATE USER {{name}} PASSWORD = '{{password}}'
|
|
DAYS_TO_EXPIRY = {{expiration}} DEFAULT_ROLE=myrole;
|
|
GRANT ROLE myrole TO USER {{name}};" \
|
|
default_ttl="1h" \
|
|
max_ttl="24h"
|
|
Success! Data written to: database/roles/my-password-role
|
|
```
|
|
|
|
1. Generate a new credential by reading from the `/creds` endpoint with the name
|
|
of the role:
|
|
|
|
```shell-session
|
|
$ vault read database/creds/my-password-role
|
|
Key Value
|
|
--- -----
|
|
lease_id database/creds/my-password-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
|
|
lease_duration 1h
|
|
lease_renewable true
|
|
password SsnoaA-8Tv4t34f41baD
|
|
username v_root_my_password_role_fU0jqEy4wMNoAY2h60yd_1610561532
|
|
```
|
|
|
|
#### Key Pair Credentials
|
|
|
|
1. Configure a role that creates new Snowflake users with key pair credentials:
|
|
|
|
```shell-session
|
|
$ vault write database/roles/my-keypair-role \
|
|
db_name=my-snowflake-database \
|
|
creation_statements="CREATE USER {{name}} RSA_PUBLIC_KEY='{{public_key}}'
|
|
DAYS_TO_EXPIRY = {{expiration}} DEFAULT_ROLE=myrole;
|
|
GRANT ROLE myrole TO USER {{name}};" \
|
|
credential_type="rsa_private_key" \
|
|
credential_config=key_bits=2048 \
|
|
default_ttl="1h" \
|
|
max_ttl="24h"
|
|
Success! Data written to: database/roles/my-keypair-role
|
|
```
|
|
|
|
1. Generate a new credential by reading from the `/creds` endpoint with the name
|
|
of the role:
|
|
|
|
```shell-session
|
|
$ vault read database/creds/my-keypair-role
|
|
Key Value
|
|
--- -----
|
|
lease_id database/creds/my-keypair-role/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
|
|
lease_duration 1h
|
|
lease_renewable true
|
|
rsa_private_key -----BEGIN PRIVATE KEY-----
|
|
...
|
|
-----END PRIVATE KEY-----
|
|
username v_token_my_keypair_role_n20WjS9U3LWTlBWn4Wbh_1654718170
|
|
```
|
|
|
|
You can directly use the PEM-encoded `rsa_private_key` value to establish a connection
|
|
to Snowflake. See [connection options](https://docs.snowflake.com/en/user-guide/key-pair-auth.html#step-6-configure-the-snowflake-client-to-use-key-pair-authentication)
|
|
for a list of clients and instructions for establishing a connection using key pair
|
|
authentication.
|
|
|
|
### Static Roles
|
|
|
|
#### Password Credentials
|
|
|
|
1. Configure a static role that rotates the password credential for an existing Snowflake user.
|
|
|
|
```shell-session
|
|
$ vault write database/static-roles/my-password-role \
|
|
db_name=my-snowflake-database \
|
|
username="snowflake_existing_user" \
|
|
rotation_period="24h" \
|
|
rotation_statements="ALTER USER {{name}} SET PASSWORD = '{{password}}'"
|
|
Success! Data written to: database/static-roles/my-password-role
|
|
```
|
|
|
|
1. Retrieve the current password credential from the `/static-creds` endpoint:
|
|
|
|
```shell-session
|
|
$ vault read database/static-creds/my-password-role
|
|
Key Value
|
|
--- -----
|
|
last_vault_rotation 2020-08-07T16:50:48.393354+01:00
|
|
password Z4-KH8F-VK5VJc0hSkXQ
|
|
rotation_period 24h
|
|
ttl 23h59m39s
|
|
username my-existing-couchbase-user
|
|
```
|
|
|
|
#### Key Pair Credentials
|
|
|
|
1. Configure a static role that rotates the key pair credential for an existing Snowflake user:
|
|
|
|
```shell-session
|
|
$ vault write database/static-roles/my-keypair-role \
|
|
db_name=my-snowflake-database \
|
|
username="snowflake_existing_user" \
|
|
rotation_period="24h" \
|
|
rotation_statements="ALTER USER {{name}} SET RSA_PUBLIC_KEY='{{public_key}}'" \
|
|
credential_type="rsa_private_key" \
|
|
credential_config=key_bits=2048
|
|
Success! Data written to: database/static-roles/my-keypair-role
|
|
```
|
|
|
|
1. Retrieve the current key pair credential from the `/static-creds` endpoint:
|
|
|
|
```shell-session
|
|
$ vault read database/static-creds/my-keypair-role
|
|
Key Value
|
|
--- -----
|
|
last_vault_rotation 2022-06-08T13:13:02.355928-07:00
|
|
rotation_period 24h
|
|
rsa_private_key -----BEGIN PRIVATE KEY-----
|
|
...
|
|
-----END PRIVATE KEY-----
|
|
ttl 23h59m55s
|
|
username snowflake_existing_user
|
|
```
|
|
|
|
You can directly use the PEM-encoded `rsa_private_key` value to establish a connection
|
|
to Snowflake. See [connection options](https://docs.snowflake.com/en/user-guide/key-pair-auth.html#step-6-configure-the-snowflake-client-to-use-key-pair-authentication)
|
|
for a list of clients and instructions for establishing a connection using key pair
|
|
authentication.
|
|
|
|
## Key Pair Authentication
|
|
|
|
Snowflake supports using [key pair authentication](https://docs.snowflake.com/en/user-guide/key-pair-auth.html)
|
|
for enhanced authentication security as an alternative to username and password authentication.
|
|
The Snowflake database plugin can be used to manage key pair credentials for Snowflake users
|
|
by using the `rsa_private_key` [credential_type](/api-docs/secret/databases#credential_type).
|
|
|
|
See the [usage](/docs/secrets/databases/snowflake#usage) section for examples using both
|
|
dynamic and static roles.
|
|
|
|
## API
|
|
|
|
The full list of configurable options can be seen in the [Snowflake database
|
|
plugin API](/api-docs/secret/databases/snowflake) page.
|
|
|
|
For more information on the database secrets engine's HTTP API please see the
|
|
[Database secrets engine API](/api-docs/secret/databases) page.
|