Configuring Cross-Cloud Auto-Fulfillment¶
If you want to automatically replicate the data product associated with your listing to other Snowflake regions, configure Cross-Cloud Auto-Fulfillment.
When auto-fulfillment is enabled for a listing, Snowflake automatically replicates your data product to consumer regions as needed. A data product is the share or application package that is attached to your listing.
By using auto-fulfillment, you can avoid manually replicating your data products and approving requests for your listings, helping consumers access your listings faster.
Note
Auto-fulfillment is not currently supported for Snowflake U.S. Government Regions, such as AWS GovCloud.
About Cross-Cloud Auto-Fulfillment¶
Cross-Cloud Auto-Fulfillment lets you offer a data product in any supported Snowflake region, based on the availability and access options you select for your listing, without having to manually replicate data.
You can configure and enable auto-fulfillment when a listing is in either draft or published state. When auto-fulfillment is enabled for a listing, Snowflake automatically fulfills your listing’s product to regions as needed.
How you make your data product available in other regions depends on your data product and how consumers access your listing:
If your data product is an application package, use auto-fulfillment to make your data product available in other regions.
If your data product is a share, use auto-fulfillment in most cases:
For free or limited trial listings on the Snowflake Marketplace, you can use Cross-Cloud Auto-Fulfillment or manually replicate the data.
For paid listings, you use auto-fulfillment.
For all listings shared with specific consumer accounts, Snowsight automatically detects whether or not the target account is in a different region and enables auto-fulfillment. You cannot manually replicate private listings to other regions.
When you make a data product available in other regions, you incur additional costs. See Manage Cross-Cloud Auto-Fulfillment costs.
How Cross-Cloud Auto-Fulfillment works¶
When you set up Cross-Cloud Auto-Fulfillment for your listing, Snowflake manages provisioning secure share areas and the replication of your data product to remote regions. If your data product already exists in the remote region, consumers in that region can get the data product instantly.
Your listing has a data product associated with it, either a share or an application package, and the data product contains objects from one or more databases, as well as application logic for an application package.
If your data product is a share, the entire database that contains the objects in your data product gets auto-fulfilled to other regions.
If your data product is an application package, the objects and logic in the application package, as well as objects referenced by the application package, are auto-fulfilled to other regions.
When your data product is auto-fulfilled to a remote region depends on how you make your listing available:
When you share a private listing, the database is auto-fulfilled after the specified consumers get your listing.
When you offer a listing on the Snowflake Marketplace, the database is auto-fulfilled to a region after a consumer in a specific region gets your listing.
When your data product is auto-fulfilled to a new region for the first time, the database (for a share) or data content and application logic (for an application package) is replicated to a secure share area in that region. The secure share area is managed by Snowflake. Multiple listings can use the same database, but the database is only replicated once to a new region.
After the initial replication of your data product to the secure share area in a region, changes to your data product are synced from your account based on the configured refresh frequency:
If your data product is a share, you set a refresh frequency when you configure Cross-Cloud Auto-Fulfillment for a listing. The refresh frequency applies to the database associated with the listing. If multiple listings share objects from the database, they share the same refresh frequency. The date and time of the refresh depends on when the first consumer requested the data product in a region.
If your data product is an application package, you set a refresh frequency at the account level that applies to every application package that you offer from your account.
After Cross-Cloud Auto-Fulfillment of a database occurs for a region, future requests made to database objects, even those associated with other listings, are fulfilled from the database in the secure share area. This keeps future refresh and replication costs lower. See Manage Cross-Cloud Auto-Fulfillment costs for more details about cost.
Considerations for auto-fulfillment¶
When you use auto-fulfillment for your listings, consider the following:
If you signed up for Snowflake using AWS Marketplace, GCP Marketplace, or Azure Marketplace, you can only create accounts and secure share areas in those clouds. Fulfilling listings to regions outside of your current cloud service region will fail.
Depending on the size of your data product, it can take some time for the data product to be available to the consumer. The size of your data product can also affect the cost of auto-fulfillment. See Manage Cross-Cloud Auto-Fulfillment costs for details about cost.
You cannot use auto-fulfillment for listings in a data exchange. To replicate data to other regions for a data exchange, see Sharing Data Securely Across Regions and Cloud Platforms.
If you use Tri-Secret Secure, you must contact Snowflake Support to enable Tri-Secret Secure for the secure share areas used for auto-fulfillment.
Note
Auto-fulfillment enforces a 10TB limit on the size of the database being replicated. When attaching a share to a listing, Snowsight checks the size of the database and returns an error if the size of data to be replicated is larger than 10TB. See Troubleshooting Cross-Cloud Auto-Fulfillment.
When the listing is auto-fulfilled, the consumer receives an error if the source data is larger than 10TB.
After assessing the cost implications, you can contact Snowflake Support to increase the size limit for a secure share area using a parameter. See INITIAL_REPLICATION_SIZE_LIMIT_IN_TB
Objects supported for auto-fulfillment¶
Only specific database objects are supported for auto-fulfillment. The database included in or referenced by your share or application package must contain only objects supported for auto-fulfillment.
Depending on your data product, different objects are supported:
Object |
Share (Database) |
Application package |
|---|---|---|
Table |
✔ |
✔ |
View |
✔ |
✔ |
Materialized View |
✔ |
✔ |
Secure view that references data stored in other databases using the REFERENCE_USAGE privilege. |
✔ |
|
Dynamic Table |
✔ |
✔ (only from the application package) |
Database Roles |
✔ |
✔ |
SQL UDF |
✔ |
✔ (when called from shared views in referenced databases) |
Stored Procedure |
✔ |
|
Masking and Row Access Policies |
✔ |
|
Tags |
✔ |
|
Tasks (not used by sharing) |
✔ |
✔ |
Alerts (not used by sharing) |
✔ |
✔ |
Secrets (not used by sharing) |
✔ |
✔ |
If an object on this list is designated as part of a failover group, it is not supported for auto-fulfillment. See Introduction to Replication and Failover.
If your data product contains objects other than the listed supported objects, you must update your data product or manually replicate your data. See Manually replicate data to fulfill a listing request.
Auto-fulfillment for objects that depend on account roles¶
Auto-fulfillment does not replicate account roles. Instead, objects in secure share areas are owned by the ACCOUNTADMIN role.
If your share or application package contains objects that depend on an account role, the object might work differently than you expect when shared with consumers. For example:
If you share a secure view that includes data protected by a policy using the INVOKER_ROLE context function, the policy might evaluate to a different value than in the provider account region because the view owner role is different.
If you share a secure view where the objects referenced by the view are restricted to an account role, such as a table where only the SECURITYADMIN role has SELECT privileges, the view might fail to expand when queried by a user without the SECURITYADMIN role in the provider account, but return results when queried by a user without the SECURITYADMIN role in the consumer account.
Instead of using account roles, use database roles. For more information, see Share data protected by a policy and IS_DATABASE_ROLE_IN_SESSION.
Support for auto-fulfillment in Virtual Private Snowflake (VPS)¶
By default, VPS does not permit data sharing outside of the VPS. VPS customers may choose to enable all accounts within their organization to receive data products from non-VPS customers using data sharing and collaboration, such as a listing shared with the VPS account.
When auto-fulfillment for VPS customers is enabled, all accounts within the VPS customer’s organization can be targeted for data sharing by the non-VPS customer specified by the VPS customer. VPS customers are not permitted to send data to other VPS or non-VPS customers via data sharing using auto-fulfillment.
To start receiving data from non-VPS customers, contact Snowflake Support and see Allow providers to share private listings into your VPS for more details.
Internal Snowflake objects created for auto-fulfillment¶
Snowflake creates the following internal objects to support Cross-Cloud Auto-Fulfillment:
Object Type |
Name |
|---|---|
Roles |
SNOWFLAKE$GDS_RL AUTO_FULFILLMENT_EXECUTOR |
Database |
SNOWFLAKE$GDS |
Replication groups |
Prefixed with |
These internal objects are used to perform tasks for auto-fulfillment, such as to create a secure share area in another region, and create a database to store objects used for auto-fulfillment, such as fulfillment tasks.
These internal objects appear when you run SHOW DATABASES, SHOW ROLES, or SHOW REPLICATION GROUPS respectively. Do not modify these objects or grant them to other users or roles.
Set up auto-fulfillment¶
When you configure a listing and make it available in a region other than your local region, or you share a private listing with consumer accounts in another region, you can enable auto-fulfillment. See Region availability (Marketplace listings only).
You must add a data product to your listing before you can set up auto-fulfillment. The steps to set up auto-fulfillment are different depending on the data product you offer and how you make your listing available.
Required privileges¶
To perform auto-fulfillment tasks, you must use one of the following roles:
The ORGADMIN role.
The ACCOUNTADMIN role that has been delegated privileges to set up auto-fulfillment.
A custom role that has been granted the MANAGE LISTING AUTO FULFILLMENT privilege by a user with the ACCOUNTADMIN role with delegated privileges.
Any role that you use must also have OWNERSHIP or MODIFY privileges on the listing.
Monitoring and managing auto-fulfillment settings¶
Manage your listing to monitor the regions where consumers are using your listing, monitor the cost of replication, and make changes to the refresh frequency for your listing.
Note
You must use a role with the Required privileges for configuring auto-fulfillment.
Manage other auto-fulfillment settings¶
To manage or monitor auto-fulfillment settings for your listing, do the following:
Sign in to Snowsight.
In the navigation menu, select Data Products » Provider Studio » Listings.
Select the row for the listing that you want to manage.
From the listing details page, access the auto-fulfillment settings:
For a listing offered on the Snowflake Marketplace, in the Region Availability section, select Manage.
For a listing offered to specific consumers, in the Consumer Accounts section, select ….
Select the option that you want to manage for your listing:
Select Manage Regions & Replication to see the regions where the listing is fulfilled and the status of auto-fulfillment. You can add or remove availability for a particular region or check the replication status.
Select a region to see the timestamp of the last sync and how many consumers are accessing the data.
If no consumers have accessed your listing’s product in a region, you can select Remove Region.
If a consumer has accessed your listing’s product in a region, you cannot remove the region. Instead, if you want to remove your data product from that region, all consumers using the product must drop the database or application first, or you must delete the listing.
Select Update Refresh Frequency to update the refresh interval and frequency of your data product.
The refresh frequency of an application package must be set at the account level. See Set account-level refresh frequency.
The refresh frequency for a share is set at the listing level, but you can only specify one schedule for each database. If you have multiple shares attached to multiple listings that contain objects from the same database, updating the refresh frequency for one of the listings updates the refresh frequency for all other listings that use the same database.
You cannot manage when a refresh occurs. Instead, the refresh schedule for a data product in a region is based on the date and time that a consumer in that region first requests your data product.
Select Monitor Replication Cost to monitor the costs related to fulfilling the data product to other regions. See Manage Cross-Cloud Auto-Fulfillment costs.
For more details about modifying listings, see Modifying published listings.
Set account-level refresh frequency¶
If your data product is an application package that is auto-fulfilled to remote regions, updates to your product occur following a refresh frequency that you set at the account level.
If you have the ACCOUNTADMIN role, you can change the refresh frequency for the account using Snowsight or a SQL command. When you do this, you update the auto-fulfillment refresh frequency for every application package published by your account. This refresh frequency does not affect listings with shares attached.
Set refresh frequency using Snowsight¶
To set the refresh frequency for your application using Snowsight, you must use the ACCOUNTADMIN role and complete the following steps:
Sign in to Snowsight.
In the navigation menu, select Data Products » Provider Studio » Listings.
Select the row for the listing that you want to manage.
From the listing details page, access the auto-fulfillment settings:
For a listing offered on the Snowflake Marketplace, in the Region Availability section, select Manage.
For a listing offered to specific consumers, in the Consumer Accounts section, select ….
Select Update Refresh Frequency to update the refresh interval and frequency of your data product.
Select a frequency at which to refresh your data product, such as every minute or up to once every 8 days.
The refresh frequency you select affects all application packages published by your account. You can show all listings affected by the refresh frequency change before you make the change.
You can specify the refresh frequency, but the scheduled time when the refresh occurs in a region is based on the date and time that a consumer in that region first requests your data product.
Select Update to save the updated refresh frequency.
Set refresh frequency using SQL¶
To set the refresh frequency for your application using SQL, you must use the ACCOUNTADMIN role and run the following command:
ALTER ACCOUNT SET LISTING_AUTO_FULFILLMENT_REPLICATION_REFRESH_SCHEDULE = '<schedule>'
Where:
schedule:The time interval at which to refresh the data product to other regions. Specify a time period in minutes, including the unit:
MINUTES.
For example, to set the auto-fulfillment refresh frequency for every application package published by your account to every hour, run the following:
ALTER ACCOUNT SET LISTING_AUTO_FULFILLMENT_REPLICATION_REFRESH_SCHEDULE = '60 MINUTES'
Note
The refresh schedule for a data product in a region is based on the date and time that a consumer in that region first requests your data product.
Allow accounts to set up Cross-Cloud Auto-Fulfillment¶
If you are the organization administrator (i.e., if you are using the ORGADMIN role) for an account, delegate the privileges required to set up Cross-Cloud Auto-Fulfillment to the ACCOUNTADMIN role in the accounts in your organization.
After delegating privileges to the ACCOUNTADMIN role, the ACCOUNTADMIN role can grant the MANAGE LISTING AUTO FULFILLMENT privilege to other roles in the account. See Becoming a provider of listings.
You can delegate the privileges, revoke the privileges, and determine if the privileges have been delegated to a specific account. You can only delegate privileges to other accounts in your organization.
Delegate privileges to set up Cross-Cloud Auto-Fulfillment¶
To enable users with the ACCOUNTADMIN role to set up Cross-Cloud Auto-Fulfillment, call the system function named SYSTEM$ENABLE_GLOBAL_DATA_SHARING_FOR_ACCOUNT. The arguments for this system function are described below.
Calling this system function requires the ORGADMIN role.
SELECT SYSTEM$ENABLE_GLOBAL_DATA_SHARING_FOR_ACCOUNT(
'<account_name>'
);
Where:
account_nameSpecifies the name of the account in which to enable users with the ACCOUNTADMIN role to manage Cross-Cloud Auto-Fulfillment. See Account Identifiers.
Revoke privileges to set up Cross-Cloud Auto-Fulfillment¶
To prevent users with the ACCOUNTADMIN role from setting up Cross-Cloud Auto-Fulfillment, call the system function named SYSTEM$DISABLE_GLOBAL_DATA_SHARING_FOR_ACCOUNT. The arguments for this system function are described below.
Calling this system function requires the ORGADMIN role.
SELECT SYSTEM$DISABLE_GLOBAL_DATA_SHARING_FOR_ACCOUNT(
'<account_name>'
);
Where:
account_nameSpecifies the name of the account in which to prevent users with the ACCOUNTADMIN role from manage Cross-Cloud Auto-Fulfillment. See Account Identifiers.
Check if an account can set up Cross-Cloud Auto-Fulfillment¶
To determine whether users with the ACCOUNTADMIN role in a specific account are permitted to set up Cross-Cloud Auto-Fulfillment, call the system function named SYSTEM$IS_GLOBAL_DATA_SHARING_ENABLED_FOR_ACCOUNT. The arguments for this system function are described below.
Calling this system function requires the ORGADMIN role.
SELECT SYSTEM$IS_GLOBAL_DATA_SHARING_ENABLED_FOR_ACCOUNT(
'<account_name>'
);
Where:
account_nameSpecifies the name of the account for which you want to check if users with the ACCOUNTADMIN role can manage cross-cloud auto-fulfillment. See Account Identifiers.