snowflake

README

vault-plugin-database-snowflake

A Vault plugin for Snowflake. It is one of the supported plugins for the HashiCorp Vault Database Secrets Engine and allows for the programmatic generation of unique, ephemeral Snowflake Database User credentials in a Snowflake account.

This project uses the database plugin interface introduced in Vault version 1.6.0.

This plugin is included in Vault version 1.7+.

Bugs and Feature Requests

Bugs should be filed under the Issues section of this repo.

Feature requests can be submitted in the Issues section as well.

Quick Links

• Database Secrets Engine for Snowflake - Docs
• Database Secrets Engine for Snowflake - API Docs
• Snowflake Website
• Vault Website

Please note: HashiCorp takes Vault's security and their users' trust very seriously.

If you believe you have found a security issue in Vault or with this plugin, please responsibly disclose by contacting HashiCorp at security@hashicorp.com.

Configure Plugin

A scripted configuration of the plugin is provided in this repository. You can use the script or manually configure the secrets engine using documentation.

To apply the scripted configuration, run the make configure target to register, enable, and configure the plugin with your local Vault instance. You can specify the plugin name, plugin directory, mount path, connection URL and private key path. Default values for plugin name and directory from the Makefile will be used if arguments aren't provided.

$ PLUGIN_NAME=vault-plugin-database-snowflake \
  PLUGIN_DIR=$GOPATH/vault-plugins \
  CONNECTION_URL=foo.snowflakecomputing.com/BAR \
  PRIVATE_KEY=/path/to/private/key/file \
  SNOWFLAKE_USERNAME=user1 \
  make configure

Acceptance Testing

In order to perform acceptance testing, you need to set the environment variable VAULT_ACC=1 as well as provide all the necessary information to connect to a Snowflake Project. All SNOWFLAKE_* environment variables must be provided in order for the acceptance tests to run properly. A cluster must be available during the test. A 30-day trial account can be provisioned manually to test.

Environment Variable	Description
SNOWFLAKE_ACCOUNT	The account string for your snowflake instance. If you are using a non-AWS provider, or a region that isn't us-west-1 for AWS, region and provider should be included here. (example: ec#####.east-us-2.azure)
SNOWFLAKE_USER	The accountadmin level user that you are using with Vault
SNOWFLAKE_PASSWORD	The password associated with the provided user
SNOWFLAKE_DB	optional: The DB you are restricting the connection to
SNOWFLAKE_SCHEMA	optional: The schema you are restricting the connection to
SNOWFLAKE_WAREHOUSE	optional: The warehouse you are restricting the connection to

To run the acceptance tests, invoke make testacc:

$ make testacc

Documentation

Index

• Variables
• func New() (interface{}, error)
• type SnowflakeSQL
  • func (c SnowflakeSQL) Close() error
  • func (c SnowflakeSQL) Connection(ctx context.Context) (interface{}, error)
  • func (s *SnowflakeSQL) DeleteUser(ctx context.Context, req dbplugin.DeleteUserRequest) (dbplugin.DeleteUserResponse, error)
  • func (c SnowflakeSQL) Init(ctx context.Context, initConfig map[string]interface{}, verifyConnection bool) (saveConfig map[string]interface{}, err error)
  • func (s *SnowflakeSQL) Initialize(ctx context.Context, req dbplugin.InitializeRequest) (dbplugin.InitializeResponse, error)
  • func (s *SnowflakeSQL) NewUser(ctx context.Context, req dbplugin.NewUserRequest) (dbplugin.NewUserResponse, error)
  • func (s *SnowflakeSQL) Type() (string, error)
  • func (s *SnowflakeSQL) UpdateUser(ctx context.Context, req dbplugin.UpdateUserRequest) (dbplugin.UpdateUserResponse, error)

Variables

var (
	ErrInvalidSnowflakeURL = fmt.Errorf("invalid connection URL format, expect <account_name>.snowflakecomputing.com/<db_name>")
	ErrInvalidPrivateKey   = fmt.Errorf("failed to read provided private_key")
)

Functions

func New

func New() (interface{}, error)

Types

type SnowflakeSQL

type SnowflakeSQL struct {
	// contains filtered or unexported fields
}

func (SnowflakeSQL) Close

func (c SnowflakeSQL) Close() error

Close terminates the database connection with locking

func (SnowflakeSQL) Connection

func (c SnowflakeSQL) Connection(ctx context.Context) (interface{}, error)

func (*SnowflakeSQL) DeleteUser

func (s *SnowflakeSQL) DeleteUser(ctx context.Context, req dbplugin.DeleteUserRequest) (dbplugin.DeleteUserResponse, error)

func (SnowflakeSQL) Init

func (c SnowflakeSQL) Init(ctx context.Context, initConfig map[string]interface{}, verifyConnection bool) (saveConfig map[string]interface{}, err error)

func (*SnowflakeSQL) Initialize

func (s *SnowflakeSQL) Initialize(ctx context.Context, req dbplugin.InitializeRequest) (dbplugin.InitializeResponse, error)

func (*SnowflakeSQL) NewUser

func (s *SnowflakeSQL) NewUser(ctx context.Context, req dbplugin.NewUserRequest) (dbplugin.NewUserResponse, error)

func (*SnowflakeSQL) Type

func (s *SnowflakeSQL) Type() (string, error)

func (*SnowflakeSQL) UpdateUser

func (s *SnowflakeSQL) UpdateUser(ctx context.Context, req dbplugin.UpdateUserRequest) (dbplugin.UpdateUserResponse, error)