> For the complete documentation index, see [llms.txt](https://docs.espresso.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.espresso.ai/snowflake-optimizer/snowflake-privatelink.md).

# Snowflake PrivateLink

Espresso AI can connect to Snowflake privately instead of using the public Snowflake endpoint.

On AWS, Snowflake uses AWS PrivateLink. On Azure, Snowflake uses Azure Private Link.

This page applies to Espresso-managed connections to your Snowflake account. For proxy traffic from your own tools, use the proxy onboarding guides.

## How it works

Snowflake private connectivity gives each Snowflake account private connection hostnames, including a Snowflake account URL and an OCSP URL. Espresso configures its Snowflake connection to use the private Snowflake account URL as its Snowflake host.

Espresso creates and operates the cloud-side private endpoint from the Espresso environment. You do not need to create another private endpoint, update DNS, or route Espresso through your VPC.

## Prerequisites

* Your Snowflake account is on Business Critical or higher.
* Your Snowflake administrator can use the `ACCOUNTADMIN` role.
* The Espresso Snowflake service user and role are already created.
* You have not enforced private-only Snowflake access for Espresso yet.

## 1. Send your PrivateLink configuration to Espresso

Before you open a Snowflake Support case, run this in Snowflake:

```sql
USE ROLE ACCOUNTADMIN;

SELECT SYSTEM$GET_PRIVATELINK_CONFIG();
```

Send the full JSON output to Espresso. Espresso will use the fields needed for your deployment, including:

| Value                                | Why Espresso needs it                                               |
| ------------------------------------ | ------------------------------------------------------------------- |
| `privatelink-account-name`           | Snowflake account identifier for Espresso's Snowflake connection.   |
| `privatelink-account-url`            | Private Snowflake hostname Espresso will use.                       |
| `regionless-privatelink-account-url` | Optional alternative hostname if you use organization/account URLs. |
| `privatelink-ocsp-url`               | OCSP hostname that Snowflake clients use for certificate checks.    |
| `regionless-privatelink-ocsp-url`    | Optional OCSP hostname for the regionless account URL.              |
| `privatelink-vpce-id`                | Snowflake endpoint service ID for AWS PrivateLink.                  |
| `privatelink-pls-id`                 | Snowflake Private Link Service ID for Azure Private Link.           |

Espresso will give you a private endpoint resource ID to include in your Snowflake Support case. On AWS, this is the VPC endpoint ID. On Azure, this is the full Azure private endpoint resource ID.

## 2. Ask Snowflake to authorize the connection

### AWS accounts

For Snowflake accounts hosted on AWS, Snowflake must authorize Espresso's AWS account and private endpoint before Espresso can use the connection.

After Espresso gives you the private endpoint resource ID, open a Snowflake Support case and ask Snowflake to authorize Espresso AI's AWS account and private endpoint for PrivateLink access to your Snowflake account.

In the [Espresso AI dashboard](https://dashboard.espressocomputing.com/), go to `Proxy Onboarding` and copy Espresso AI's AWS Account ID.

Suggested support case text:

```
Please authorize Espresso AI for AWS PrivateLink access to our Snowflake account as a managed cloud service / third-party vendor.

Espresso AI AWS account ID: <Espresso AI's AWS Account ID>
Private endpoint resource ID (VPC endpoint ID): <Private endpoint resource ID from Espresso>
```

Snowflake's self-service AWS PrivateLink flow does not support third-party vendor account authorization. Snowflake Support must complete this step.

### Azure accounts

For Snowflake accounts hosted on Azure, the equivalent private connectivity service is Azure Private Link.

After Espresso gives you the private endpoint resource ID, open a Snowflake Support case and ask Snowflake to allow Espresso AI to establish an Azure Private Link connection to your Snowflake account.

In the [Espresso AI dashboard](https://dashboard.espressocomputing.com/), go to `Proxy Onboarding` and copy Espresso AI's Azure subscription ID for Snowflake Private Link. If you do not see it, ask Espresso for the Azure subscription ID to use.

If Espresso will connect to more than one Snowflake account, include every Snowflake account URL in the support case.

Suggested support case text:

```
Please allow this Azure subscription to establish an Azure Private Link connection to our Snowflake account.

Azure subscription ID: <Azure subscription ID from Espresso>
Private endpoint resource ID: <Private endpoint resource ID from Espresso>
Snowflake account URL(s): <all Snowflake account URLs Espresso will connect to>
```

Snowflake uses the resource ID to approve the specific Espresso-managed private endpoint.

## 3. Tell Espresso when Snowflake approves the request

Send Espresso Snowflake's confirmation. Espresso will finish configuring the connection and validate that traffic uses the private endpoint.

## Wait for Espresso validation

Do not enable Snowflake private-only enforcement or remove existing network policy access for Espresso until Espresso confirms validation.

## After validation

After Espresso confirms the connection is using PrivateLink, you can restrict Snowflake public access for the Espresso service user according to your Snowflake network policy standards.

If you make this change, tell Espresso before enforcement so we can verify the cutover window and avoid interrupting warehouse optimization.

## Snowflake references

* [AWS PrivateLink and Snowflake](https://docs.snowflake.com/en/user-guide/admin-security-privatelink)
* [Azure Private Link and Snowflake](https://docs.snowflake.com/en/user-guide/privatelink-azure)
* [SYSTEM$GET\_PRIVATELINK\_CONFIG](https://docs.snowflake.com/en/sql-reference/functions/system_get_privatelink_config)