---
description: Snowflake Integraiton Guide
---

# Snowflake Integration

This document describes how to integrate the Rezonate product with Snowflake, which provides IAM observability to users, groups, roles, and resources as well as detection of different security risks and threats.

{% hint style="info" %}
If your Snowflake tenant has an IP Restrictions policy, you will have to whitelist Rezonate's collector IP Address. More information available [collectors-ip-ranges](../troubleshooting-and-support/collectors-ip-ranges "mention")
{% endhint %}

### Integration Steps (In Snowflake Side)

To integrate, please log-in with a privileged user and perform the following actions

1. Create a new role for Rezonate integration

```
CREATE ROLE rezonate_integration
   COMMENT = 'Rezonate Integration Role';
```

2. Create a new role for Rezonate to log in through to utilize the role. Please replace the PLEASE-**PLEASE-PUT-YOUR-PASSWORD-HERE** With a random string that will be used as the password.&#x20;

```
CREATE OR REPLACE USER rezonate_integration_user
   DISABLED = false
   MUST_CHANGE_PASSWORD = false
   DEFAULT_ROLE = rezonate_integration
   COMMENT ='rezonate_integration_user'
   LOGIN_NAME = 'rezonate_integration_user'
   PASSWORD = 'PLEASE-PUT-YOUR-PASSWORD-HERE'
```

In case of Certificate based authentication, Execute the following instead

```
CREATE OR REPLACE USER rezonate_integration_user
   DISABLED = false
   MUST_CHANGE_PASSWORD = false
   DEFAULT_ROLE = rezonate_integration
   COMMENT ='rezonate_integration_user'
   LOGIN_NAME = 'rezonate_integration_user'
   RSA_PUBLIC_KEY='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh5+IBytPTbsKs3ajcn7H
   Mhy5JpmQmiqMWKfiJCa1iFYBnEnOHS/ZzUpkZRXflWoOYGnKyPlqSFOW14EJvec2
   iBODm36nD6z7dFz3q9tBjzjjLRPDWwLSScBkIv5Zx5QzopcNoZDa0FyEe72Jk99+
   e5Xxr+Hy+zmX3+/Fv0HPbWmG6IQXCN6V1uLY5B4V2xo0PFDFUw7pnGzYTQhmn3VT
   +SJEJ9i3FY6ZPcjUjfz1UP+v1KJO7ZbQANqHLwDMv5j0ETvRNdj6MtAjRo9kwZl1
   PIXFbRYYtFAo2nf+qqmOtQc7NSqgT+uKcfnFjzyt9Salzf3ISSu2r6XXOh8+cBUg
   KwIDAQAB'
```

3. Grant Rezonate the privileges to query against the information metadata db

```
GRANT imported privileges on database snowflake to role rezonate_integration;   
```

4. Grant Rezonate the privileges to "USAGE" a warehouse in the database. please replace **$WAREHOUSE\_NAME\_HERE$** with one of the warehouses in the database.

```
GRANT USAGE ON WAREHOUSE $WAREHOUSE_NAME_HERE$ TO ROLE rezonate_integration;
```

5. Grant Monitor Access (To support querying federation information and security settings)

```
USE DATABASE SNOWFLAKE;
GRANT MONITOR ON ACCOUNT TO  ROLE rezonate_integration;
GRANT APPLICATION ROLE TRUST_CENTER_VIEWER TO ROLE rezonate_integration;
```

5. Grant Rezonate with the ability to use the Rezonate role

```
GRANT ROLE rezonate_integration TO USER rezonate_integration_user
```

6. You will also need to provide the URL for your tenant ID. To extract its value please go to settings, tenant information and then click on the "Copy link" to show your URL&#x20;

<figure><img src="https://lh7-us.googleusercontent.com/VB7C5N9wOeSMVMLH7HEt_uubArHi2vtI47P90DX9JcJ_LrAquYCTcMmg0xvArS2O6vocNyS5ZBZhbb4NRmuqcRPz8RtYyCVzHWs8XKtkkkchbaWdrUd11zsvlUek8TqlcC255F8P1scd9Iznzr8scLg" alt=""><figcaption></figcaption></figure>

### Integration of the Creation user to Rezonate

After creating the required privileges, go to the Rezonate integration screen. select Snowflake and fill in the following information:

| Required Property | Value                                                                                          |
| ----------------- | ---------------------------------------------------------------------------------------------- |
| username          | created username (**rezonate** is default)                                                     |
| password          | your selected password (If selected Certificate, you will need to fill the public key instead) |
| account           | <p>your snowflake id, in the following format:<br><strong>account.region</strong></p>          |
| warehouse         | the warehouse that was enabled for the user.                                                   |
| role              | <p>the created role name <br>(default is <strong>rezonate_integration</strong>)</p>            |



