Configuring Snowflake for Cloud Connected
Overview
In a Cloud Connected deployment of Panther, your organization owns the Snowflake account and the AWS account in which your Panther instance is deployed, while Panther manages initial deployments and subsequent upgrades of the platform.
You must start with a new or empty Snowflake account. Panther does not support using Panther-managed Snowflake accounts with Cloud Connected deployments.
This page explains how to configure a Snowflake account for your deployment of Panther, and how to connect your credentials to your AWS account.
Panther features requiring Snowflake Enterprise or higher
In order to use the following Panther features, you must be using the Enterprise Edition of Snowflake or higher:
How to create a new Snowflake account and user for Panther
In your Snowflake organization, create a new, dedicated Snowflake account for Panther using the template below.
<YOUR_REGION>
should be the same AWS region where your Panther instance will eventually be deployed.In the output of the command above, copy the
url
value, and paste it into a browser window. Log in to the account you just created using the credentials you provided in the command above.In the new account, create a
pantheraccountadmin
user and grant it administrative roles using the following commands:In your Snowflake console, locate your account URL:
At the bottom of the left-hand navigation bar, click your name.
In the menu that opens, click Account.
In the menu that opens, hover over the name of your account.
In the menu that opens, click the Copy account URL icon.
The URL will be in this format:
<org-name>-<account-name>.snowflakecomputing.com
Return to the instructions Cloud Connected to continue with the deployment process.
(Optional) Creating read-only roles for Panther data tables
Panther maintains the PANTHERACCOUNTADMIN
user credentials in a secure location.
If you would like to create and maintain several users with read-only access to the Panther data lake tables, you can use the PANTHERACCOUNTADMIN
user or another SECURITYADMIN
enabled user on your Snowflake account to run the following commands:
(Optional) Disabling and Re-enabling the Panther Account Admin User
Disabling the PANTHERACCOUNTADMIN
user may prevent Panther from being able to:
Perform credential rotation
Enable certain functionality, such as Role-Based Access Control (RBAC)
Deploy new capabilities that require Panther to run
snowconfig
If you choose to disable the PANTHERACCOUNTADMIN
user despite the implications above, you may do so using the following commands:
If a Panther upgrade requires privileged access, the user can then be temporarily re-enabled:
Last updated