Snowflake Private Connectivity
Configure Snowflake private connectivity for Espresso AI.
Espresso AI can connect to Snowflake through private connectivity instead of the public Snowflake endpoint.
On AWS, Snowflake uses AWS PrivateLink. On Azure, Snowflake uses Azure Private Link.
This page applies to Espresso-managed connections to your Snowflake account. For proxy traffic from your own tools, use the proxy onboarding guides.
How it works
Snowflake private connectivity gives each Snowflake account private connection hostnames, including a Snowflake account URL and an OCSP URL. Espresso configures its Snowflake connection to use the private Snowflake account URL as its Snowflake host.
Espresso creates and operates the cloud-side private endpoint from the Espresso environment. You do not need to create another private endpoint, update DNS, or route Espresso through your VPC.
Prerequisites
Your Snowflake account is on Business Critical or higher.
Your Snowflake administrator can use the
ACCOUNTADMINrole.The Espresso Snowflake service user and role are already created.
You have not enforced private-only Snowflake access for Espresso yet.
1. Send your PrivateLink configuration to Espresso
Before you open a Snowflake Support case, run this in Snowflake:
USE ROLE ACCOUNTADMIN;
SELECT SYSTEM$GET_PRIVATELINK_CONFIG();Send the full JSON output to Espresso. Espresso will use the fields needed for your deployment, including:
privatelink-account-name
Snowflake account identifier for Espresso's Snowflake connection.
privatelink-account-url
Private Snowflake hostname Espresso will use.
regionless-privatelink-account-url
Optional alternative hostname if you use organization/account URLs.
privatelink-ocsp-url
OCSP hostname that Snowflake clients use for certificate checks.
regionless-privatelink-ocsp-url
Optional OCSP hostname for the regionless account URL.
privatelink-vpce-id
Snowflake endpoint service ID for AWS PrivateLink.
privatelink-pls-id
Snowflake Private Link Service ID for Azure Private Link.
Espresso will give you a private endpoint resource ID to include in your Snowflake Support case. On AWS, this is the VPC endpoint ID. On Azure, this is the full Azure private endpoint resource ID.
2. Ask Snowflake to authorize the connection
AWS accounts
For Snowflake accounts hosted on AWS, Snowflake must authorize Espresso's AWS account and private endpoint before Espresso can use the connection.
After Espresso gives you the private endpoint resource ID, open a Snowflake Support case and ask Snowflake to authorize Espresso AI's AWS account and private endpoint for PrivateLink access to your Snowflake account.
In the Espresso AI dashboard, go to Proxy Onboarding and copy Espresso AI's AWS Account ID.
Suggested support case text:
Snowflake's self-service AWS PrivateLink flow does not support third-party vendor account authorization. Snowflake Support must complete this step.
Azure accounts
For Snowflake accounts hosted on Azure, the equivalent private connectivity service is Azure Private Link.
After Espresso gives you the private endpoint resource ID, open a Snowflake Support case and ask Snowflake to allow Espresso AI to establish an Azure Private Link connection to your Snowflake account.
In the Espresso AI dashboard, go to Proxy Onboarding and copy Espresso AI's Azure subscription ID for Snowflake Private Link. If you do not see it, ask Espresso for the Azure subscription ID to use.
If Espresso will connect to more than one Snowflake account, include every Snowflake account URL in the support case.
Suggested support case text:
Snowflake uses the resource ID to approve the specific Espresso-managed private endpoint.
3. Tell Espresso when Snowflake approves the request
Send Espresso Snowflake's confirmation. Espresso will finish configuring the connection and validate that traffic uses the private endpoint.
Wait for Espresso validation
Do not enable Snowflake private-only enforcement or remove existing network policy access for Espresso until Espresso confirms validation.
After validation
After Espresso confirms the connection is using PrivateLink, you can restrict Snowflake public access for the Espresso service user according to your Snowflake network policy standards.
If you make this change, tell Espresso before enforcement so we can verify the cutover window and avoid interrupting warehouse optimization.
Snowflake references
Last updated