Grant access to a Snowflake Native App¶

Grant global privileges¶

To grant privileges or create references after installing an application, do the following:

1. Sign in to Snowsight.

2. In the navigation menu, select Data Products » Apps.

3. Select the application.

4. Select the Security icon in the toolbar.

5. Select the Privileges tab.

   The account level permissions requested by the application appear under Account level privileges

6. In the Account-level privileges section, select Review, and then toggle the slider for each privilege that you want to grant.

7. Select Save.

Authorize access to specific objects¶

If a provider implements a user interface for a Snowflake Native App, a consumer can use Snowsight to authorize access on objects in their account.

To authorize access to specific objects:

1. Sign in to Snowsight.

2. In the navigation menu, select Data Products » Apps.

3. Select the application.

4. Select the Security icon in the toolbar.

5. Select the Privileges tab.

6. In the Privileges to objects section, select Add next to the object to which you want to authorize access.

7. Select Select Data and choose the data product to which you want to authorize access.

8. Select Done.

Revoke privileges and access to objects¶

To revoke privileges or remove access to objects, do the following:

1. Sign in to Snowsight.

2. In the navigation menu, select Data Products » Apps.

3. Select the application.

4. Select the Security icon in the toolbar.

5. Select the Privileges tab.

   • To revoke a global privilege, select the Edit button, then toggle the slider for the privilege you want to revoke.

   • To revoke access from a specific object, select the Delete button, then select Revoke Privilege.

View the privileges requested by an application¶

When a provider specifies the privileges required by the application, the privilege request is included as part of the installed application. You can view these privileges after installing the application.

To view the privileges required by an application, run the SHOW PRIVILEGES command as shown in the following example:

SHOW PRIVILEGES IN APPLICATION hello_snowflake_app;

Grant privileges to a Snowflake Native App¶

After a consumer determines the privileges requested by an app, they can grant those privileges to the app.

For example, to grant the EXECUTE TASK privilege to an app, run the GRANT PRIVILEGE command as shown in the following example:

GRANT EXECUTE TASK ON ACCOUNT TO APPLICATION hello_snowflake_app;

Grant the MANAGE WAREHOUSES privilege to a Snowflake Native App¶

The MANAGE WAREHOUSES privilege allows an application to create, modify, and use warehouses within the consumer account. To grant the MANAGE WAREHOUSES privilege to an app, use the GRANT as shown in the following example:

GRANT MANAGE WAREHOUSES ON ACCOUNT TO APPLICATION hello_snowflake_app;

Grant the IMPORTED PRIVILEGES privilege on the SNOWFLAKE database¶

Some applications might request that a consumer grants the IMPORTED PRIVILEGES privilege on the SNOWFLAKE database in their account. This privilege can only be granted using SQL commands. It cannot be granted using Snowsight. If an application requires this privilege, the provider should communicate this requirement to the consumer, for example, in the README file of the application.

To grant the IMPORT privilege on the SNOWFLAKE database, run the following command:

GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO APPLICATION hello_snowflake_app;

View the references requested by an app¶

A consumer can view the references requested by an app by running the SHOW REFERENCES command as shown in the following example:

SHOW REFERENCES IN APPLICATION hello_snowflake_app;

This command displays a list of all the references defined in the app. It also displays the privileges that the consumer role must have on the object in order to create the reference.

Create the reference and associate the reference to the app¶

After viewing the references requested by the application, a consumer can create the reference by running the SYSTEM$REFERENCE system function as shown in the following example:

SELECT SYSTEM$REFERENCE('table', 'db1.schema1.table1', 'persistent', 'select', 'insert');

This command creates the reference and returns an identifier for the object. The identifier looks similar to the following example:

ENT_REF_TABLE_16617302895522_2CDD20F5C047A5B87B2CE36F6837715786AF9F2D

The consumer passes this identifier to a callback stored procedure to associate the reference to the app.

To associate a reference to an application, the consumer must pass the identifier returned by calling the SYSTEM$REFERENCE system function to a callback stored procedure. A callback procedure is a stored procedure that the provider creates in the Snowflake Native App to associates a reference to the app.

To use a callback procedure, run the following command:

CALL app.config.register_single_reference(
  'consumer_table', 'ADD', 'ENT_REF_TABLE_16617302895522_2CDD20F5C047A5B87B2CE36F6837715786AF9F2D');

In this example, the register_single_reference() stored procedure associates the reference with the identifier ENT_REF_TABLE_16617302895522_2CDD20F5C047A5B87B2CE36F6837715786AF9F2D to the app.

Create and associate the reference to the app in a single step¶

After viewing the references requested by the application, a consumer can create the reference and associate it to the app by passing the SYSTEM$REFERENCE system function as an argument to a callback stored procedure.

The following example shows the syntax for passing the SYSTEM$REFERENCE system function as an argument to a callback stored procedure:

CALL app.config.register_single_reference(
 'consumer_table', 'ADD', SYSTEM$REFERENCE('table', 'db1.schema1.table1',
 'PERSISTENT', 'SELECT', 'INSERT'));

This example creates the reference and passes the identifier to the callback function to associate the reference to the app.