Configure Cross-Cloud Auto-Fulfillment¶
If you want to automatically fulfill the data product associated with your listing to other Snowflake regions, configure Cross-Cloud Auto-Fulfillment.
When auto-fulfillment is enabled for a listing, Snowflake automatically fulfills your data product to consumer regions as needed. A data product is the share or application package that is attached to your listing.
By using auto-fulfillment, you can avoid manually replicating your data products and approving requests for your listings, helping consumers access your listings faster.
Note
Using Cross-Cloud Auto-Fulfillment in a Snowflake Native App with Snowpark Container Services is currently only supported on Amazon Web Services (AWS). See Known limitations with apps with containers for more information.
About Cross-Cloud Auto-Fulfillment¶
Cross-Cloud Auto-Fulfillment lets you offer a data product in any supported Snowflake region, based on the availability and access options you select for your listing, without having to manually replicate data.
You can configure and enable auto-fulfillment when a listing is in either draft or published state. When auto-fulfillment is enabled for a listing, Snowflake automatically fulfills your listing’s product to regions as needed.
How you make your data product available in other regions depends on your data product and how consumers access your listing:
If your data product is an application package, use auto-fulfillment to make your data product available in other regions.
If your data product is a share, use auto-fulfillment in most cases:
For free or limited trial listings on the Snowflake Marketplace, you can use Cross-Cloud Auto-Fulfillment or manually replicate the data.
For paid listings, you use auto-fulfillment.
For all listings shared with specific consumer accounts, Snowsight automatically detects whether or not the target account is in a different region and enables auto-fulfillment. You cannot manually replicate private listings to other regions.
When you make a data product available in other regions, you incur additional costs. See Manage Cross-Cloud Auto-Fulfillment costs.
How Cross-Cloud Auto-Fulfillment works¶
When you set up Cross-Cloud Auto-Fulfillment for your listing, Snowflake manages provisioning for a secure share area (SSA) and the auto-fulfillment of your data product to remote regions. The SSA is managed by Snowflake. If your data product already exists in the remote region, consumers in that region can get the data product instantly.
Your listing has a data product associated with it, either a share or an application package. The data product contains objects from one or more databases, as well as application logic for an application package.
Exactly when your data product is auto-fulfilled to a remote region depends on how you make your listing available:
Private listings are auto-fulfilled after the specified consumers get your listing.
Public listing shared on Snowflake Marketplace are auto-fulfilled after a consumer in the specific region gets the listing.
When your data product is auto-fulfilled to a new region for the first time, it is transferred to an SSA in that region. Unlike replication, auto-fulfillment doesn’t maintain a continuously synced replica. Auto-fulfillment can be configured with FULL_DATABASE or SUBDB settings. FULL_DATABASE makes all objects in a database available, but without ongoing synchronization. SUBDB allows selected objects to be available on-demand. In replication, FULL_DATABASE ensures a periodically synchronized copy, while SUB_DATABASE synchronizes specific components.
Multiple listings can use the same database, but the database is only auto-fulfilled once to a new region.
Note
For Business Critical Edition (BCE), the handling of shared data differs from high-security deployments like VPS. While BCE does not require creating a separate SSA per region, it enforces strict data security and compliance with features like Tri-Secret Secure encryption.
For deployments such as Virtual Private Snowflake (VPS) and government-specific Snowflake environments, there is a separate secure share area (SSA) for each deployment. This ensures that auto-fulfillment remains compliant with strict security and data isolation requirements unique to those environments.
After the initial auto-fulfillment of your data product to the SSA in a region, changes to your data product are synced from your account based on the configured refresh frequency:
If your data product is a share, you set a refresh frequency when you configure Cross-Cloud Auto-Fulfillment for a listing. The refresh frequency applies to the database associated with the listing. If multiple listings share objects from the database, they share the same refresh frequency. The date and time of the refresh depends on when the first consumer requested the data product in a region.
If your data product is an application package, you set a refresh frequency at the account level that applies to every application package that you offer from your account.
Considerations for auto-fulfillment¶
When you use auto-fulfillment for your listings, consider the following:
If you signed up for Snowflake using AWS Marketplace, GCP Marketplace, or Azure Marketplace, you can only create accounts and SSAs in those clouds. Fulfilling listings to regions outside of your current cloud service region will fail.
Depending on the size of your data product, it can take some time for the data product to be available to the consumer. The size of your data product can also affect the cost of auto-fulfillment. See Manage Cross-Cloud Auto-Fulfillment costs for details about cost.
Object-level mode (SUBDB) is used by default.
If a listing uses objects that are located in a database that’s already in full database mode (FULL_DATABASE), a warning displays in Snowsight and the database remains in full database mode.
If you use Tri-Secret Secure, you must contact Snowflake Support to enable Tri-Secret Secure for the secure share areas used for auto-fulfillment.
With Tri-Secret Secure, query results are encrypted using one key from the provider, one from Snowflake, and one from the consumer. Each key independently governs access. If a key is revoked, only its owner loses access. For example, revoking the provider key does not prevent the consumer from accessing data that has already been retrieved.
Note
Auto-fulfillment enforces a 10TB limit on the size of the data product. If you encounter a sizing error, see Troubleshoot Cross-Cloud Auto-Fulfillment.
After assessing the cost implications, you can contact Snowflake Support to increase the size limit.
Objects supported for auto-fulfillment¶
The database objects included in or referenced by your listing must contain only objects supported for auto-fulfillment.
Depending on your data product, different objects are supported:
Object |
Share (Database) |
Application package |
|---|---|---|
Table |
✔ |
✔ |
View (Regular, aka Non-Secure) |
✔ |
✔ |
View (Materialized) |
✔ |
✔ |
View (Secure) |
✔ |
✔ |
Secure view that references data stored in other databases using the REFERENCE_USAGE privilege. |
✔ |
|
Dynamic Table |
✔ |
✔ (only from the application package) |
Database Roles |
✔ |
✔ |
SQL UDF |
✔ |
✔ (when called from shared views in referenced databases) |
Stored Procedure (not used by sharing) |
✔ |
✔ |
Masking and Row Access Policies |
✔ |
✔ |
Tags |
✔ |
✔ |
Tasks (not used by sharing) |
✔ |
✔ |
Alerts (not used by sharing) |
✔ |
✔ |
Secrets (not used by sharing) |
✔ |
✔ |
If an object on this list is designated as part of a failover group, it is not supported for auto-fulfillment. See Introduction to Replication and Failover.
If your data product contains or references objects other than the listed supported objects, you must update your data product.
Auto-fulfillment for objects that depend on account roles¶
Auto-fulfillment does not replicate account roles. Instead, objects in SSAs are owned by the ACCOUNTADMIN role.
If your share or application package contains objects that depend on an account role, the object might work differently than you expect when shared with consumers. For example:
If you share a secure view that includes data protected by a policy using the INVOKER_ROLE context function, the policy might evaluate to a different value than in the provider account region because the view owner role is different.
If you share a secure view where the objects referenced by the view are restricted to an account role, such as a table where only the SECURITYADMIN role has SELECT privileges, the view might fail to expand when queried by a user without the SECURITYADMIN role in the provider account, but return results when queried by a user without the SECURITYADMIN role in the consumer account.
Instead of using account roles, use database roles. For more information, see Share data protected by a policy and IS_DATABASE_ROLE_IN_SESSION.
Internal Snowflake objects created for auto-fulfillment¶
Snowflake creates the following internal objects to support Cross-Cloud Auto-Fulfillment:
Object Type |
Name |
|---|---|
Roles |
SNOWFLAKE$GDS_RL AUTO_FULFILLMENT_EXECUTOR |
Database |
SNOWFLAKE$GDS |
Replication groups |
Prefixed with |
These internal objects are used to perform tasks for auto-fulfillment, such as to create a secure share area in another region, and create a database to store objects used for auto-fulfillment, such as fulfillment tasks.
These internal objects appear when you run SHOW DATABASES, SHOW ROLES, or SHOW REPLICATION GROUPS respectively. Do not modify these objects or grant them to other users or roles.
Set up auto-fulfillment¶
When you configure a listing and make it available in a region other than your local region, or you share a private listing with consumer accounts in another region, you can enable auto-fulfillment. See Region availability (Marketplace listings only).
You must add a data product to your listing before you can set up auto-fulfillment. The steps to set up auto-fulfillment are different depending on the data product you offer and how you make your listing available.
Required privileges¶
To perform auto-fulfillment tasks, you must use one of the following roles:
The ORGADMIN role.
The ACCOUNTADMIN role that has been delegated privileges to set up auto-fulfillment.
A custom role that has been granted the MANAGE LISTING AUTO FULFILLMENT privilege by a user with the ACCOUNTADMIN role with delegated privileges.
Any role that you use must also have OWNERSHIP or MODIFY privileges on the listing.
Set up object-level auto-fulfillment¶
If you want to automatically transfer the data product associated with your listing to other Snowflake regions, configure Cross-Cloud Auto-Fulfillment. When auto-fulfillment is enabled for a listing, Snowflake automatically transfers your data product to remote regions as needed.
To help reduce costs and ease the manageability burden, you can use SUBDB auto-fulfillment to let you choose to fulfill only the tables and views in a data product to a remote region using auto-fulfillment.
About object-level auto-fulfillment¶
When you configure object-level auto-fulfillment, SUBDB is used for supported objects. Objects that are referenced by these objects must also be supported. For a list of supported objects, see Objects supported for auto-fulfillment.
The first consumer in a region gets the listing.
Auto-fulfillment transfers the objects in the share to the secure share area.
Any consumer that gets the listing gets the data product from the secure share area in their Snowflake region.
What gets fulfilled by object-level auto-fulfillment¶
When you use SUBDB (object-level) auto-fulfillment for your data product, only the objects granted directly to the share or app, or referenced by an object in your share or app, are auto-fulfilled.
For example:
Object in data product |
What is transferred |
|---|---|
Table in a database and schema |
Table |
Secure view created from a table in the same database |
Secure view and table |
Table in a database using FULL_DATABASE auto-fulfillment |
Entire database |
Table in a database using SUBDB auto-fulfillment |
Table |
Set up object-level auto-fulfillment using Snowsight¶
You set up object-level auto-fulfillment when you set up the region availability (for a listing published on the Snowflake Marketplace) or when you add a consumer located in another region (for a listing shared privately).
Create a listing. See Create and publish a listing.
Add a data product that contains only supported objects.
Set up regions or accounts to share with to start setting up auto-fulfillment:
For a listing published to the Snowflake Marketplace:
Locate the Region Availability section and select Add.
For Region availability, keep the default of All regions or select Custom regions for your listing.
For a listing shared privately, add a consumer account in a remote region.
Select your preferred refresh frequency for updating the data product in remote regions.
Publish your listing or save it as a draft.
Monitoring and managing auto-fulfillment settings¶
Manage your listing to monitor the regions where consumers are using your listing, monitor the cost of auto-fulfillment, and make changes to the refresh frequency for your listing.
Note
You must use a role with the Required privileges for configuring auto-fulfillment.
Manage other auto-fulfillment settings¶
To manage or monitor auto-fulfillment settings for your listing, do the following:
Sign in to Snowsight.
In the navigation menu, select Data Products » Provider Studio » Listings.
Select the row for the listing that you want to manage.
From the listing details page, access the auto-fulfillment settings:
For a listing offered on the Snowflake Marketplace, in the Region Availability section, select Manage.
For a listing offered to specific consumers, in the Consumer Accounts section, select ….
Select the option that you want to manage for your listing:
Select Manage Regions & Replication to see the regions where the listing is fulfilled and the status of auto-fulfillment. You can add or remove availability for a particular region or check the status.
Select a region to see the timestamp of the last sync and how many consumers are accessing the data.
If no consumers have accessed your listing’s product in a region, you can select Remove Region.
If a consumer has accessed your listing’s product in a region, you cannot remove the region. Instead, if you want to remove your data product from that region, all consumers using the product must drop the database or application first, or you must delete the listing.
Select Update Refresh Frequency to update the refresh interval and frequency of your data product.
The refresh frequency of an application package must be set at the account level. See Set account-level refresh frequency.
The refresh frequency for a share is set at the listing level, but you can only specify one schedule for each database. If you have multiple shares attached to multiple listings that contain objects from the same database, updating the refresh frequency for one of the listings updates the refresh frequency for all other listings that use the same database.
You cannot manage when a refresh occurs. Instead, the refresh schedule for a data product in a region is based on the date and time that a consumer in that region first requests your data product.
Select Monitor Replication Cost to monitor the costs related to fulfilling the data product to other regions. See Manage Cross-Cloud Auto-Fulfillment costs.
For more details about modifying listings, see Modify published listings.
Set account-level refresh frequency¶
If your data product is an application package that is auto-fulfilled to remote regions, updates to your product occur following a refresh frequency that you set at the account level.
If you have the ACCOUNTADMIN role, you can change the refresh frequency for the account using Snowsight or a SQL command. When you do this, you update the auto-fulfillment refresh frequency for every application package published by your account. This refresh frequency does not affect listings with shares attached.
Set refresh frequency using Snowsight¶
To set the refresh frequency for your application using Snowsight, you must use the ACCOUNTADMIN role and complete the following steps:
Sign in to Snowsight.
In the navigation menu, select Data Products » Provider Studio » Listings.
Select the row for the listing that you want to manage.
From the listing details page, access the auto-fulfillment settings:
For a listing offered on the Snowflake Marketplace, in the Region Availability section, select Manage.
For a listing offered to specific consumers, in the Consumer Accounts section, select ….
Select Update Refresh Frequency to update the refresh interval and frequency of your data product.
Select a frequency at which to refresh your data product, such as every minute or up to once every 8 days.
The refresh frequency you select affects all application packages published by your account. You can show all listings affected by the refresh frequency change before you make the change.
You can specify the refresh frequency, but the scheduled time when the refresh occurs in a region is based on the date and time that a consumer in that region first requests your data product.
Select Update to save the updated refresh frequency.
Set refresh frequency using SQL¶
To set the refresh frequency for your application using SQL, you must use the ACCOUNTADMIN role and run the following command:
ALTER ACCOUNT SET LISTING_AUTO_FULFILLMENT_REPLICATION_REFRESH_SCHEDULE = '<schedule>'
Where:
schedule:The time interval at which to refresh the data product to other regions. Specify a time period in minutes, including the unit:
MINUTES.
For example, to set the auto-fulfillment refresh frequency for every application package published by your account to every hour, run the following:
ALTER ACCOUNT SET LISTING_AUTO_FULFILLMENT_REPLICATION_REFRESH_SCHEDULE = '60 MINUTES'
Note
The refresh schedule for a data product in a region is based on the date and time that a consumer in that region first requests your data product.
Allow accounts to set up Cross-Cloud Auto-Fulfillment¶
If you are the organization administrator (i.e., if you are using the ORGADMIN role) for an account, delegate the privileges required to set up Cross-Cloud Auto-Fulfillment to the ACCOUNTADMIN role in the accounts in your organization.
After delegating privileges to the ACCOUNTADMIN role, the ACCOUNTADMIN role can grant the MANAGE LISTING AUTO FULFILLMENT privilege to other roles in the account. See About listing providers.
You can delegate the privileges, revoke the privileges, and determine if the privileges have been delegated to a specific account. You can only delegate privileges to other accounts in your organization.
Delegate privileges to set up Cross-Cloud Auto-Fulfillment¶
To enable users with the ACCOUNTADMIN role to set up Cross-Cloud Auto-Fulfillment, call the system function named SYSTEM$ENABLE_GLOBAL_DATA_SHARING_FOR_ACCOUNT. The arguments for this system function are described below.
Calling this system function requires the ORGADMIN role.
SELECT SYSTEM$ENABLE_GLOBAL_DATA_SHARING_FOR_ACCOUNT(
'<account_name>'
);
Where:
account_nameSpecifies the name of the account in which to enable users with the ACCOUNTADMIN role to manage Cross-Cloud Auto-Fulfillment. See Account Identifiers.
Revoke privileges to set up Cross-Cloud Auto-Fulfillment¶
To prevent users with the ACCOUNTADMIN role from setting up Cross-Cloud Auto-Fulfillment, call the system function named SYSTEM$DISABLE_GLOBAL_DATA_SHARING_FOR_ACCOUNT. The arguments for this system function are described below.
Calling this system function requires the ORGADMIN role.
SELECT SYSTEM$DISABLE_GLOBAL_DATA_SHARING_FOR_ACCOUNT(
'<account_name>'
);
Where:
account_nameSpecifies the name of the account in which to prevent users with the ACCOUNTADMIN role from manage Cross-Cloud Auto-Fulfillment. See Account Identifiers.
Check if an account can set up Cross-Cloud Auto-Fulfillment¶
To determine whether users with the ACCOUNTADMIN role in a specific account are permitted to set up Cross-Cloud Auto-Fulfillment, call the system function named SYSTEM$IS_GLOBAL_DATA_SHARING_ENABLED_FOR_ACCOUNT. The arguments for this system function are described below.
Calling this system function requires the ORGADMIN role.
SELECT SYSTEM$IS_GLOBAL_DATA_SHARING_ENABLED_FOR_ACCOUNT(
'<account_name>'
);
Where:
account_nameSpecifies the name of the account for which you want to check if users with the ACCOUNTADMIN role can manage cross-cloud auto-fulfillment. See Account Identifiers.