Key Pair Authentication Setup

Snowflake supports using key pair authentication for enhanced authentication security as an alternative to basic authentication (i.e. username and password).

This authentication method requires, as a minimum, a 2048-bit RSA key pair. You can generate the Privacy Enhanced Mail (i.e. PEM) private-public key pair using OpenSSL.

Some of the Supported Snowflake Clients allow using encrypted private keys to connect to Snowflake. The public key is assigned to the Snowflake user who uses the Snowflake client to connect and authenticate to Snowflake.

Snowflake also supports rotating public keys in an effort to allow compliance with more robust security and governance postures.

Key pair authentication is a secure way to access your Snowflake data warehouse without relying solely on traditional username and password authentication. In this step-by-step guide, we will walk you through the process of setting up key pair authentication in Snowflake. We'll also cover how to install OpenSSL, a crucial tool for generating the necessary key pair.

Prerequisites:

Before we begin, ensure you have the following prerequisites in place:

OpenSSL is an open-source tool that allows you to generate cryptographic keys and certificates. You will need it to create the key pair for Snowflake.

If you don't have OpenSSL installed on your local computer or virtual machine, follow the complete the items below. If you do have OpenSSL already installed go to Step 1: Create Private Key:

Now that you have OpenSSL installed, let's generate an SSH key pair. The private key will be stored securely on your machine, while the public key will be uploaded to Snowflake.

Open a Terminal window and enter the below command. Depending on what your security and governance requirements are, you can generate either an encrypted or unencrypted key. If you are unsure of what security guidelines are, in general, it is safer to use an encrypted key.

For an encrypted key, use the following command:

You will be asked to enter a passphrase. Save it in a note or write it down somewhere; just make sure you don’t forget it! You will need it later. 

Enter the following command in your Terminal window:

Make sure you know where your keys are stored, because you will need the file path later. If you completed the above Preparation Steps and Steps 1 & 2 the files will be stored in a similar path as the one below. In this folder you will find two files that were created in the above Steps: rsa_key.p8 and rsa_key.pub

The private key (rsa_key.p8) is stored and encrypted using the passphrase you specified in Step 1. They will look like what is shown below when opening the files.

You must be in an ACCOUNTADMIN role to make edits to a user. You can view what role you have in the top right corner under your name. If you have the rights, it’s possible you can change your role by entering the following command in your worksheet or by clicking on the user setting bar in the top right corner of your worksheet:

Then enter the following command in your worksheet to assign the public key (rsa_key.pub) you created in Step 1 to your Snowflake user.

Note: If you do not have or can not get admin rights with the above command, it’s likely you do not have the permissions you need. Please reach out to the Admin of your Snowflake account to request the access you need.

Create a Snowflake Target Connection in DataLakeHouse.io

The Target Connection is now complete, create a Create a Sync Bridge to replicate data to Snowflake