Allow access to a consumer account¶

Grant global privileges¶

To grant privileges or create references after installing an application, do the following:

1. Sign in to Snowsight.

2. In the navigation menu, select Data Products » Apps.

3. Select the app.

4. Select the Security icon in the toolbar.

5. Select the Privileges tab.

   The account level permissions requested by the app appear under Account level privileges

6. In the Account-level privileges section, select Review, and then toggle the slider for each privilege that you want to grant.

7. Select Save.

Authorize access to specific objects¶

If a provider implements a user interface for a Snowflake Native App, a consumer can use Snowsight to authorize access on objects in their account.

To authorize access to specific objects:

1. Sign in to Snowsight.

2. In the navigation menu, select Data Products » Apps.

3. Select the app.

4. Select the Security icon in the toolbar.

5. Select the Privileges tab.

6. In the Privileges to objects section, select Add next to the object to which you want to authorize access.

7. Select Select Data and choose the data product to which you want to authorize access.

8. Select Done.

Revoke privileges and access to objects¶

To revoke privileges or remove access to objects, do the following:

1. Sign in to Snowsight.

2. In the navigation menu, select Data Products » Apps.

3. Select the app.

4. Select the Security icon in the toolbar.

5. Select the Privileges tab.

   • To revoke a global privilege, select the Edit button, then toggle the slider for the privilege you want to revoke.

   • To revoke access from a specific object, select the Delete button, then select Revoke Privilege.

View the privileges requested by an app¶

When a provider specifies the privileges required by the app, the privilege request is included as part of the installed app. You can view these privileges after installing the app.

To view the privileges required by an app, run the SHOW PRIVILEGES command as shown in the following example:

SHOW PRIVILEGES IN APPLICATION hello_snowflake_app;

Grant privileges to a Snowflake Native App¶

After a consumer determines the privileges requested by an app, they can grant those privileges to the app.

For example, to grant the EXECUTE TASK privilege to an app, run the GRANT PRIVILEGE command as shown in the following example:

GRANT EXECUTE TASK ON ACCOUNT TO APPLICATION hello_snowflake_app;

Grant the MANAGE WAREHOUSES privilege to a Snowflake Native App¶

The MANAGE WAREHOUSES privilege allows an app to create, modify, and use warehouses within the consumer account. To grant the MANAGE WAREHOUSES privilege to an app, use the GRANT as shown in the following example:

GRANT MANAGE WAREHOUSES ON ACCOUNT TO APPLICATION hello_snowflake_app;

Grant the IMPORTED PRIVILEGES privilege on the SNOWFLAKE database¶

Some apps might request that a consumer grants the IMPORTED PRIVILEGES privilege on the SNOWFLAKE database in their account. This privilege can only be granted using SQL commands. It cannot be granted using Snowsight. If an app requires this privilege, the provider should communicate this requirement to the consumer, for example, in the README file of the app.

To grant the IMPORT privilege on the SNOWFLAKE database, run the following command:

GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO APPLICATION hello_snowflake_app;

View the references requested by an app¶

A consumer can view the references requested by an app by running the SHOW REFERENCES command as shown in the following example:

SHOW REFERENCES IN APPLICATION hello_snowflake_app;

This command displays a list of all the references defined in the app. It also displays the privileges that the consumer role must have on the object in order to create the reference.

Create the reference and associate the reference to the app¶

After viewing the references requested by the app, a consumer can create the reference by running the SYSTEM$REFERENCE system function as shown in the following example:

SELECT SYSTEM$REFERENCE('table', 'db1.schema1.table1', 'persistent', 'select', 'insert');

This command creates the reference and returns an identifier for the object. The identifier looks similar to the following example:

ENT_REF_TABLE_16617302895522_2CDD20F5C047A5B87B2CE36F6837715786AF9F2D

The consumer passes this identifier to a callback stored procedure to associate the reference to the app.

To associate a reference to an app, the consumer must pass the identifier returned by calling the SYSTEM$REFERENCE system function to a callback stored procedure. A callback procedure is a stored procedure that the provider creates in the Snowflake Native App to associates a reference to the app.

To use a callback procedure, run the following command:

CALL app.config.register_single_reference(
  'consumer_table', 'ADD', 'ENT_REF_TABLE_16617302895522_2CDD20F5C047A5B87B2CE36F6837715786AF9F2D');

In this example, the register_single_reference() stored procedure associates the reference with the identifier ENT_REF_TABLE_16617302895522_2CDD20F5C047A5B87B2CE36F6837715786AF9F2D to the app.

Create and associate the reference to the app in a single step¶

After viewing the references requested by the application, a consumer can create the reference and associate it to the app by passing the SYSTEM$REFERENCE system function as an argument to a callback stored procedure.

The following example shows the syntax for passing the SYSTEM$REFERENCE system function as an argument to a callback stored procedure:

CALL app.config.register_single_reference(
 'consumer_table', 'ADD', SYSTEM$REFERENCE('table', 'db1.schema1.table1',
 'PERSISTENT', 'SELECT', 'INSERT'));

This example creates the reference and passes the identifier to the callback function to associate the reference to the app.

Security and cost considerations¶

When allowing an app to accesses an external or Iceberg table, consumers should be aware of the following:

• External and Iceberg tables may pose data exfiltration risks to the consumer. For example, if an app exposes a view that contains an external table, a provider may be able to determine the types of queries the consumer makes by using their cloud provider access logs.

• External and Iceberg tables may incur additional costs related to egress and ingress usage if the object store containing the table is not in the same region where the app is published.

Enable external and Iceberg tables using Snowsight¶

Providers can configure the app to display a dialog to all consumers to allow an app to access an external or Iceberg tables.

To allow an app to access to an external or Iceberg table:

1. Sign in to Snowsight.

2. In the navigation menu, select Data Products » Apps.

3. Select the app.

4. Select the Security icon in the toolbar.

5. Select the Privileges tab.

6. Under External data access, select Review.

7. Select Enable.

Enable external and Iceberg tables using SQL¶

To enable access to external and Iceberg tables by using SQL use the SET_APPLICATION_RESTRICTED_FEATURE_ACCESS system function as shown in the following example:

SELECT SYSTEM$SET_APPLICATION_RESTRICTED_FEATURE_ACCESS(hello_snowflake_app, 'external_data', ‘{"allowed_cloud_providers" : "all"}’);

This command allows the hello_snowflake_app app to access the external or Iceberg tables in the that the app uses.

To determine if external and Iceberg tables have been enabled for an app, use the LIST_APPLICATION_RESTRICTED_FEATURES system function as shown in the following example:

SYSTEM$LIST_APPLICATION_RESTRICTED_FEATURES('hello_snowflake_app')

This system function returns a JSON object that indicates if external and Iceberg tables are allowed the for the hello_snowflake_app.