You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/unify/linked-profiles/setup-guides/snowflake-setup.md
+16-16Lines changed: 16 additions & 16 deletions
Original file line number
Diff line number
Diff line change
@@ -24,25 +24,23 @@ Segment requires the following settings to connect to your Snowflake warehouse.
24
24
25
25
-**Account ID**: The Snowflake account ID that uniquely identifies your organization account.
26
26
-**Database Name**: The only database that Segment requires write access to in order to create tables for internal bookkeeping. This database is referred to as `segment_connection_db` in the script below.
27
-
-**Warehouse**: The warehouse in your Snowflake account that you want to use for Segment to run the SQL queries. This warehouse is referred to as `segment_connection_warehouse` in the script below.
27
+
-**Warehouse**: The [warehouse](https://docs.snowflake.com/en/user-guide/warehouses){:target="_blank”} in your Snowflake account that you want to use for Segment to run the SQL queries. This warehouse is referred to as `segment_connection_warehouse` in the script below.
28
28
-**Username**: The Snowflake user that Segment uses to run SQL in your warehouse. This user is referred to as `segment_connection_username` in the script below.
29
29
-**Password**: The password of the user above. This password is referred to as `segment_connection_password` in the script below.
30
30
31
31
## Set up Snowflake credentials
32
32
33
33
Segment recommends setting up a new Snowflake user and only giving this user permissions to access the required databases and schemas for Segment Linked Profiles.
34
34
35
-
Segment only requires write access to one database where it creates a schema for internal bookkeeping. Segment recommends creating an empty database for this purpose using the script below. All other databases and schemas require read-only access granted to the Segment user.
36
-
35
+
### Create Segment user and internal database
37
36
38
37
Use the following steps to set up your Snowflake credentials:
39
38
40
39
- Create a new role and user for Segment Linked Profiles.
41
40
- Grant the Segment user access to the warehouse of your choice. If you'd like to create a new warehouse, uncomment the SQL below.
42
-
- Create a new database that Segment will use for internal bookkeeping. You'll need to grant the Segment user **write** access to this database that is used to store checkpoint tables for the queries that are executed. This is the database you'll be required to specify for the "Database Name" when connecting Snowflake with the Segment app.
43
-
41
+
- Create a new database for Segment Linked Profiles. Segment only requires write access to this one database to create a schema for internal bookkeeping, and to store checkpoint tables for the queries that are executed. Segment recommends creating an empty database for this purpose using the script below. This is also the database you'll be required to specify for the "Database Name" when connecting Snowflake with the Segment app.
44
42
45
-
```ts
43
+
```
46
44
-- ********** SET UP THE FOLLOWING WAREHOUSE PERMISSIONS **********
47
45
-- Edit the following variables
48
46
SET segment_connection_username='SEGMENT_LINKED_USER';
@@ -91,11 +89,13 @@ GRANT CREATE SCHEMA ON DATABASE identifier($segment_connection_db) TO ROLE iden
91
89
92
90
```
93
91
92
+
### Grant access to other databases
93
+
94
94
Next, give the Segment user **read-only** access to all the other databases you want to use for Linked Profiles.
95
95
96
96
Run the SQL query below for **each** database you want to use for Linked Profiles:
97
97
98
-
```ts
98
+
```
99
99
100
100
SET segment_connection_role='SEGMENT_LINKED_ROLE';
101
101
@@ -115,11 +115,11 @@ GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE identifier($linked_read_on
115
115
116
116
```
117
117
118
-
### (Optional) Snowflake schema access
118
+
### (Optional) Restrict Snowflake schema access
119
119
120
-
[Snowflake schema access](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#table-privileges){:target="_blank”}: If you want to restrict access to specific schemas or tables, run the following commands:
120
+
If you want to restrict access to specific [Snowflake schemas and tables](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#table-privileges){:target="_blank”}, run the following commands:
121
121
122
-
```ts
122
+
```
123
123
-- [Optional] Further restrict access to only specific schemas and tables
124
124
SET db='MY_DB';
125
125
SET schema='MY_DB.MY_SCHEMA_NAME';
@@ -138,18 +138,18 @@ GRANT SELECT ON FUTURE TABLES IN SCHEMA identifier($schema) TO ROLE identifier($
Run the following SQL if you run into an error on the Segment app indicating that the user doesn't have sufficient privileges on an existing `_segment_reverse_etl` schema.
143
-
144
-
If Segment Reverse ETL has ever run in the database you are configuring as the Segment connection database, a Segment-managed schema is already created and you need to provide the new Segment user access to the existing schema.
141
+
### (If applicable) Update user acccess for Segment Reverse ETL schema
145
142
146
143
> warning ""
147
144
> This is only applicable if you choose to use an existing database as the Segment connection database that has also been used for Segment Reverse ETL.
148
145
146
+
Run the following SQL if you run into an error on the Segment app indicating that the user doesn't have sufficient privileges on an existing `_segment_reverse_etl` schema.
147
+
148
+
If Segment Reverse ETL has ever run in the database you are configuring as the Segment connection database, a Segment-managed schema is already created and you need to provide the new Segment user access to the existing schema.
149
149
150
150
Add the Snowflake table permissions by running the following commands:
151
151
152
-
```ts
152
+
```
153
153
-- If you want to use an existing database that already has Segment Reverse ETL schemas, you’ll need to run some additional steps below to grant the role access to the existing schemas.
154
154
155
155
SET retl_schema = concat($segment_internal_database,'.__segment_reverse_etl');
@@ -166,7 +166,7 @@ GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA identifier($retl_schem
166
166
167
167
To verify you have set up the right permissions for a specific table, log in with the username and password you created for `SEGMENT_CONNECTION_USERNAME` and run the following command to verify the role you created has the correct permissions. If this command succeeds, you should be able to view the respective table.
168
168
169
-
```ts
169
+
```
170
170
set segment_connection_role='SEGMENT_LINKED_ROLE';
0 commit comments