wehub-resource-sync
2.6 KiB
Snowflake Connection Setup
AWS Glue native Snowflake connection (type SNOWFLAKE, not JDBC). Required for Glue for Spark ETL jobs reading from or writing to Snowflake.
Contents
Connection Type
Use ConnectionType: SNOWFLAKE. Do NOT use a JDBC connection configured with the Snowflake JDBC URL -- that path is for Glue crawlers only and cannot be used by Glue for Spark ETL jobs. The two credential types are stored separately in the Data Catalog.
Authentication Modes
| Mode | When to use | Secret contents |
|---|---|---|
| User + password | Quick start, non-production | username, password |
| Key-pair (RSA) | Production, long-lived workloads | username, private_key (PEM, base64) |
| OAuth 2.0 | Enterprise SSO, credential-free for end users | client_id, client_secret, refresh_token, token URL |
OAuth 2.0 for Glue Snowflake connections was released April 2026. For current Snowflake OAuth setup steps, cite Snowflake's OAuth docs rather than repeating them.
Connection JSON Template
Password-based:
{
"Name": "snowflake-analytics",
"ConnectionType": "SNOWFLAKE",
"ConnectionProperties": {
"HOST": "<account>.<region>.snowflakecomputing.com",
"WAREHOUSE": "<warehouse-name>",
"ROLE": "<role-name>",
"DATABASE": "<default-database>",
"SECRET_ID": "<secrets-manager-arn>"
}
}
The secret must contain snowflakeUser and snowflakePassword keys per Glue's Snowflake connection convention.
Account identifier formats vary -- see Snowflake account identifier docs for the correct form for your region/cloud.
Private sources add PhysicalConnectionRequirements as in jdbc-setup.md.
PrivateLink
Snowflake accounts configured for AWS PrivateLink have a different hostname pattern. Glue jobs use the privatelink hostname directly. Configure the Glue connection's security group to allow outbound to the privatelink endpoint. See Snowflake PrivateLink docs.