Snowflake now reads secrets from external providers using workload identity

External secret providers allow Snowflake to query API keys and passwords directly from your cloud provider. This removes the need to maintain duplicate copies within Snowflake.

Use cases

Imagine you store credentials in AWS Secrets Manager and need to use them in queries without managing duplicate passwords in Snowflake. With this feature, you can:

• Read secrets from AWS Secrets Manager, Azure Key Vault, or Google Cloud Secret Manager on demand.
• Authenticate Snowflake using workload identity federation without storing static access keys.

How to use

You configure a security integration in Snowflake and use commands to interact with external secrets.

CREATE SECURITY INTEGRATION my_integration
  TYPE = API_AUTHENTICATION
  AUTH_TYPE = WORKLOAD_IDENTITY_FEDERATION;

What happens in this code:

1. Creates a security integration in Snowflake.
2. Sets the authentication type to API.
3. Configures the identity federation method to trust the cloud provider.

Limitations and requirements

• Feature is in Public Preview.
• Snowflake does not provide per-secret privileges; access is granted per integration.
• The role executing the operation requires the USAGE privilege on the security integration.