Connecting to the Snowflake destination database

In the Destination Settings section, you specify the connection information for the destination database.

If the destination database is in the same location as the source database, then you can copy the connection details from the source database. The copied details include the proxy connection configuration.

If the destination database is in a different location, then you provide the connection details.

Copying the source database connection details

To copy the connection details from the source database:

1. Click Copy Settings from Source.
2. Provide the authentication information for the connection.
3. To test the connection to the destination database, click Test Destination Connection.

Selecting whether to use a connection string

If you do not copy the details from the source database, then by default, you provide the connection information in the individual connection fields.

To instead use a connection string, toggle Use connection string to the on position.

Selecting the authentication method to use

Snowflake is phasing out the ability to use a simple password. We recommend that you use key pair authentication.

By default, the workspace is configured to use key pair authentication, and Use Key Pair Authentication is the on position.

To instead use a password, toggle Use Key Pair Authentication to the off position.

Providing destination database connection information

Populating the destination connection fields

If Use connection string is off:

1. In the Server field, provide the server where the database is located. You must provide the full path to the server. The https:// is optional. So the format of the server value can be either:

   • <account>.<region>.snowflakecomputing.com
   • https://<account>.<region>.snowflakecomputing.com

   For example: abc123456.us-east-1.snowflakecomputing.com or https://abc123456.us-east-1.snowflakecomputing.com
2. In the Database field, provide the name of the database.
3. In the Username field, provide the username for the account to use to connect to the database. If secrets managers are available, you can select a secret name from a secrets manager.
4. For Password, you can either specify the password manually or, if secrets managers are available, you can select a secret name from a secrets manager.

Using a destination connection string

If Use connection string is on, then in the Connection String field, provide the connection string.

The connection string uses the following format:

account=<account>;host=<account>.<region>.snowflakecomputing.com;user=<username>;db=<database>

Providing the destination authentication details

Key pair authentication

If key pair authentication is enabled (Use Key Pair Authentication is in the on position):

1. For RSA Private Key, click Browse, then select the key file.
2. If the key is encrypted, then in the Encrypted Key Passphrase field, provide the passphrase to use to decrypt the key.

Password authentication

If key pair authentication is disabled (Use Key Pair Authentication is in the off position), then in the Password field, either:

• Specify the password manually.
• If secrets managers are available, select a secret name from a secrets manager.

Testing the destination database connection

To test the connection to the destination database, click Test Destination Connection.

Indicating whether to trust the server certificate

To trust the server certificate, and ignore the certificate authority's revocation list, toggle Trust Server Certificate to the on position.

This option can be useful when your Structural instance cannot connect to the certificate authority.

Using an alternative connection method

To make the connection, you can optionally use either:

• A proxy connection
• Tailscale

To enable an alternative connection method, toggle Enable Connection Method to the on position.

Using a proxy connection

When you use a connection string to connect to the destination database, Structural adds the proxy connection parameters to the connection string.

If you manually include proxy connection parameters in the connection string, and also configure the proxy connection settings, the connection string will have duplicate proxy connection parameters.

We recommend that you use the configuration fields to enable the proxy connection, and do not include proxy connection parameters in the connection string.

To enable and configure the proxy connection:

1. From the Connection Method dropdown list, select Proxy.
2. In the Proxy Host field, provide the host name for the proxy connection.
3. In the Proxy Port field, provide the port for the proxy connection.
4. Optionally, in the Proxy User field, provide the name of the user for the proxy connection.
5. If you provide a proxy user, then in the Proxy Password field, provide the password for the specified user.
6. Optionally, in the Non-Proxy Hosts field, provide the list of hosts for which to bypass the proxy server and connect to directly.

Use a pipe symbol (|) to separate the host names. For example, host1|host2|host3.

You can also use an asterisk (*) as a wildcard. For example, to connect directly to all hosts whose host names start with myhost, use myhost*.

Using Tailscale tunneling

Snowflake requires a Tailscale App Connector that advertises *.privatelink.snowflakecomputing.com. Because Snowflake is a public endpoint and not a private IP address, a subnet router does not work.

To use a Tailscale tunnel to connect to the source database:

1. From the Connection Method dropdown list, select Tailscale Tunnel.
2. In the Tags field, provide a comma-separated list of ACL tags to use to join the tailnet. For example, tag:tonic-worker.
3. Optionally, in the Control Server URL field, provide the URL. This is intended for customers who use Headscale or a self-hosted Tailscale control plane.
4. In the Tailscale Auth Key field, provide a Tailscale OAuth client credential. Structural does not support other types of Tailscale keys, such as user auth keys. You create the credential from the OAuth clients page in your Tailscale admin console. If secrets managers are available, you can instead select a secret name from a secrets manager.