Snowflake

Connect Snowflake to Trustle to get insight into over-privileged and unused accounts, and to adopt just-in-time access management.

Prerequisites

• An Account Admin user in the Snowflake console.

Configure Snowflake

Step 1: Create the trustle_setup.sql

1. Log in to the Snowflake console as an Account Admin user.
2. Go to your workspace in the Snowflake console (Work with data → Projects → Workspace).
3. Create a new file to run the Trustle setup queries.

Step 2: Create the Trustle Role

1. Create the role for the Trustle service account.
2. Grant IMPORTED privileges on the Snowflake database.
3. Grant the SECURITYADMIN role to the Trustle role.

CREATE ROLE IF NOT EXISTS TRUSTLE_ROLE COMMENT = 'Role for Trustle integration - DO NOT DELETE.';

GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE TRUSTLE_ROLE;

GRANT ROLE SECURITYADMIN TO ROLE TRUSTLE_ROLE;

Step 3: Create the Trustle Warehouse

1. Create the warehouse that the Trustle service account uses.
2. Grant USAGE to the Trustle role.

CREATE WAREHOUSE IF NOT EXISTS TRUSTLE_ETL_WH
WAREHOUSE_SIZE = 'XSMALL'
AUTO_SUSPEND = 60
AUTO_RESUME = TRUE;

GRANT USAGE ON WAREHOUSE TRUSTLE_ETL_WH TO ROLE TRUSTLE_ROLE;

Step 4: Create the Trustle Service Account User

1. Open a terminal on your local machine and create an RSA key for the service account.

   openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out trustle_rsa_key.p8 -nocrypt
   openssl rsa -in trustle_rsa_key.p8 -pubout -out trustle_rsa_key.pub

2. Create the service account user, replacing the RSA_PUBLIC_KEY contents with your generated public key.

3. Grant the Trustle role to the service account.

CREATE USER TRUSTLE_SERVICE_ACCOUNT
TYPE = SERVICE
DEFAULT_ROLE = SECURITYADMIN
DEFAULT_WAREHOUSE = TRUSTLE_ETL_WH
COMMENT = 'Service Account for Trustle integration - DO NOT DELETE.'
RSA_PUBLIC_KEY='<contents of trustle_rsa_key.pub>';

GRANT ROLE TRUSTLE_ROLE TO USER TRUSTLE_SERVICE_ACCOUNT;

Connect in Trustle

1. Go to the Connections page in Trustle from the left menu.
2. Under SaaS Applications, find the Snowflake logo and click Connect.
3. Provide the connection details.
4. Add the Snowflake Account Identifier, for example xy12345.us-east-1 or organization-account_name.
5. Add the Private Key you generated in Create the Trustle Service Account User, including the BEGIN and END lines.
6. Click Test Connection.
7. After the connection test succeeds, click Save Connection.