Snowflake Private Connectivity Design: PrivateLink / PSC Compared Across 3 Clouds

Snowflake supports TLS over the public internet by default, but environments with strict compliance requirements — finance, healthcare, and similar — typically demand connectivity over a cloud provider's private backbone. On AWS you use AWS PrivateLink, on Azure Azure Private Link, and on GCP Private Service Connect (PSC) to keep traffic to Snowflake off the public internet and inside the cloud's internal network. Business Critical Edition or higher is required.

3-Cloud Comparison Table

AWS PrivateLink Setup Steps

-- Step 1: Authorize PrivateLink for the Snowflake account
-- Run as ACCOUNTADMIN
SELECT SYSTEM$AUTHORIZE_PRIVATELINK(
  '<aws_account_id>',
  '<vpc_endpoint_id>'
);

-- Step 2: Retrieve PrivateLink configuration
SELECT SYSTEM$GET_PRIVATELINK_CONFIG();
-- The return value contains VPC Service Name, OCSP URL, etc.

-- Step 3 (AWS Console / CLI):
-- Create an Interface-type VPC Endpoint
-- Service Name: com.amazonaws.vpce.<region>.vpce-svc-xxxxxxxxx
-- Specify the VPC and subnets

-- Step 4: Create a Route 53 Private Hosted Zone
-- Zone name: privatelink.snowflakecomputing.com
-- CNAME records:
--   <account_locator> → VPC Endpoint DNS name
--   <orgname>-<account_name> → VPC Endpoint DNS name

Azure Private Link Setup Steps

-- Step 1: Authorize PrivateLink in Snowflake
SELECT SYSTEM$AUTHORIZE_PRIVATELINK(
  '<azure_subscription_id>',
  '<private_endpoint_resource_id>'
);

-- Step 2: Retrieve configuration
SELECT SYSTEM$GET_PRIVATELINK_CONFIG();

-- Step 3 (Azure Portal / CLI):
-- Create a Private Endpoint
-- Resource Type: Microsoft.Snowflake/accounts
-- Target Sub-resource: snowflake

-- Step 4: Private DNS Zone configuration
-- Zone name: privatelink.snowflakecomputing.com
-- A record: <account_locator> → Private Endpoint IP

GCP Private Service Connect Setup Steps

-- Step 1: Authorize PSC in Snowflake
SELECT SYSTEM$AUTHORIZE_PRIVATELINK(
  '<gcp_project_id>'
);

-- Step 2: Retrieve configuration (Service Attachment URI, etc.)
SELECT SYSTEM$GET_PRIVATELINK_CONFIG();

-- Step 3 (GCP Console / gcloud):
-- Create a PSC Endpoint
-- gcloud compute forwarding-rules create snowflake-psc \
--   --region=<region> \
--   --network=<vpc-name> \
--   --address=<reserved-internal-ip> \
--   --target-service-attachment=<service-attachment-uri>

-- Step 4: Cloud DNS Private Zone configuration
-- Zone name: privatelink.snowflakecomputing.com
-- A record: <account_locator> → reserved internal IP address

Key Points for DNS Design

• Private Hosted Zone / DNS Zone is mandatory: Even with PrivateLink / PSC configured, clients will still connect to the public endpoint if DNS is not set up correctly. Always verify that DNS resolution returns the Private Endpoint IP.
• Use a wildcard CNAME: Adding a *.privatelink.snowflakecomputing.com wildcard record covers Internal Stage traffic and client redirect connections as well.
• DNS for OCSP: Either configure name resolution for ocsp.privatelink.snowflakecomputing.com to traverse the Private Endpoint, or rely on OCSP Fail-Open mode.

OCSP Certificate Revocation Check Requirements

Snowflake client drivers check certificate revocation via OCSP (Online Certificate Status Protocol) as part of every TLS handshake. The following considerations apply in PrivateLink environments:

Private Connectivity to Internal Stages

-- Enable PrivateLink access to an Internal Stage
SELECT SYSTEM$AUTHORIZE_STAGE_PRIVATELINK_ACCESS(
  '<account_locator>',
  '<aws_account_id>'
);

-- AWS: a separate S3 VPC Endpoint (Gateway type) is required
-- Azure: a separate Blob Storage Private Endpoint is required
-- GCP: a separate GCS PSC Endpoint is required

-- Verify stage operations over PrivateLink
PUT file:///tmp/data.csv @~;
GET @~/data.csv file:///tmp/;

Combining with a Network Policy

-- Network Policy that allows traffic over PrivateLink only
CREATE NETWORK POLICY private_only_policy
  ALLOWED_IP_LIST = ('<private_endpoint_ip_range>')
  BLOCKED_IP_LIST = ('0.0.0.0/0');

-- Apply at the account level
ALTER ACCOUNT SET NETWORK_POLICY = private_only_policy;

-- With this setting, access via the public endpoint
-- is fully blocked.

Check Your Understanding

Frequently Asked Questions