Snowflake DSR integration

Missing an action you need, or an integration we don't support yet? Contact your Customer Success Manager.

This integration automates privacy requests for Snowflake. You give MineOS a dedicated Snowflake role and three SQL queries (search, copy and delete). MineOS runs them with the requester's email address to preview, copy or delete their records.

To scan Snowflake for personal data, see Snowflake data classification integration.

How It Works

• Preview: MineOS runs your search query for the requester and shows a preview of the matching records.
• Delete: MineOS runs your delete query. Use it for deletion and opt-out rights.
• Get a copy: MineOS runs your copy query and includes the matching records in the copy sent to the requester.

MineOS does not validate your queries, so test each one in Snowflake first.

Before You Start

• Make sure you have permission in Snowflake to create a role and a user.
• Prepare three queries that use the {{endUserEmail}} variable, which MineOS replaces with the requester's email address:
  • Search: returns the records that belong to the requester, for example SELECT name, age, country FROM your_db.your_schema.your_table WHERE email = {{endUserEmail}}
  • Copy: returns everything you want to send to the requester, for example SELECT * FROM your_db.your_schema.your_table WHERE email = {{endUserEmail}}
  • Delete: removes the requester's records, for example DELETE FROM your_db.your_schema.your_table WHERE email = {{endUserEmail}}. An UPDATE statement is also allowed here.

Setting Up

Step 1: Create a user and role for MineOS in Snowflake

We recommend a dedicated user and role for MineOS. As a Snowflake account admin, open a new worksheet and run each of these commands separately, replacing the placeholders with your own values:

use role accountadmin;
CREATE ROLE MINEOS;
CREATE USER your-mineos-user PASSWORD = 'your-mineos-password' LOGIN_NAME = your-mineos-user;
GRANT ROLE MINEOS TO USER your-mineos-user;
grant usage on database your_db to role MINEOS;
grant usage on schema your_db.your_schema to role MINEOS;
grant monitor on warehouse your_warehouse to role MINEOS;
grant usage on warehouse your_warehouse to role MINEOS;
grant select on all tables in schema your_db.your_schema to role MINEOS;

You can give the role any name. Repeat the database, schema and select grants for every schema you want to scan.

Step 2: Connect in MineOS

1. Log in to MineOS. On the left sidebar, click Inventory, then click Add data source. Search for Snowflake and add it.
2. Open the Snowflake system and go to the DSR & integrations tab. If the system already has an integration, click Add instance.
3. Under Action for fulfilling requests, select Integration, then choose Snowflake in the Integration Type dropdown.
4. In the Set up integration wizard, under User Details, enter your Snowflake username, password and role in the format username;password;role.
5. Under Account Details, enter your account identifier, region and warehouse in the format accountIdentifier;region;warehouse. To find your account identifier, see Snowflake's documentation on account identifiers.

Step 3: Allow deletion

If you use Snowflake for deletion requests, give the MineOS role permission to delete. Repeat for every schema you handle requests in:

grant delete on all tables in schema your_db.your_schema to role MINEOS;

Step 4: Add your queries and finish

1. In the same Set up integration wizard, enter your three queries: Query used for search records & delete validation, Copy Query and Delete Query. All three are mandatory. MineOS also uses the search query to check that a deletion worked, so make sure it returns the records your delete query removes.
2. Click Finish. MineOS checks your Snowflake configuration and validates that it works.

You're done! MineOS has been connected to your Snowflake account.

To connect another account or warehouse, click Add instance on the DSR & integrations tab.

Using the Integration in Requests

To handle requests automatically, add the Snowflake integration to the workflows of the privacy rights it should handle: deletion and opt-out rights use the delete query, and get a copy uses the copy query.

Troubleshooting

Need Help?

If you need any help with this integration, please contact your Customer Success Manager. They will be happy to assist you!