Connecting to the Snowflake source database

In the Source Settings section, provide the details for the connection to the source database.

Selecting whether to use a connection string

By default, you provide the connection information in the individual connection fields.

To instead use a connection string, toggle Use connection string to the on position.

Selecting the authentication method to use

Snowflake is phasing out the ability to use a simple password. We recommend that you use key pair authentication.

By default, the connection uses key pair authentication, and the Use Key Pair Authentication toggle is in the on position.

To instead use a password, toggle Use Key Pair Authentication to the off position.

Providing the source connection information

Populating the source connection fields

If Use connection string is off:

1. In the Server field, provide the server where the database is located. You must provide the full path to the server. https:// is optional. So the format of the server value can be either:

   • <account>.<region>.snowflakecomputing.com
   • https://<account>.<region>.snowflakecomputing.com

   For example: abc123456.us-east-1.snowflakecomputing.com or https://abc123456.us-east-1.snowflakecomputing.com
2. In the Database field, provide the name of the database.
3. In the Username field, provide the username for the account to use to connect to the database. If secrets managers are available, you can select a secret name from a secrets manager.

Providing a source connection string

If Use connection string is on, then in the Connection String field, provide the connection string.

The connection string uses the following format:

account=<account>;host=<account>.<region>.snowflakecomputing.com;user=<username>;db=<database>

Providing source authentication details

Key pair authentication

If key pair authentication is enabled (Use Key Pair Authentication is in the on position):

1. For RSA Private Key, click Browse, then select the key file.
2. If the key is encrypted, then in the Encrypted Key Passphrase field, provide the passphrase to use to decrypt the key.

Password authentication

If key pair authentication is disabled (Use Key Pair Authentication is in the off position), then in the Password field, either:

• Specify the password manually.
• If secrets managers are available, select a secret name from a secrets manager.

Testing the source connection

To test the connection to the source database, click Test Source Connection.

Indicating whether to trust the server certificate

To trust the server certificate, and ignore the certificate authority's revocation list, toggle Trust Server Certificate to the on position.

This option can be useful when your Tonic Structural instance cannot connect to the certificate authority.

Using an alternative connection method

To make the connection, you can optionally use either:

• A proxy connection
• Tailscale tunneling

To enable an alternative connection method, toggle Enable Connection Method to the on position.

Using a proxy connection

When you use a connection string to connect to the source database, Structural automatically adds the configured proxy connection parameters to the connection string.

If you manually include proxy connection parameters in the connection string, and also configure the proxy connection settings, the connection string will have duplicate proxy connection parameters.

We recommend that you use the configuration fields to enable the proxy connection, and do not include proxy connection parameters in the connection string.

To use a proxy server to connect to the source database:

1. From the Connection Method dropdown list, select Proxy.
2. In the Proxy Host field, provide the host name for the proxy connection.
3. In the Proxy Port field, provide the port for the proxy connection.
4. Optionally, in the Proxy User field, provide the name of the user for the proxy connection.
5. If you provide a proxy user, then in the Proxy Password field, provide the password for the specified user.
6. Optionally, in the Non-Proxy Hosts field, provide the list of hosts for which to bypass the proxy server and connect to directly.

Use a pipe symbol (|) to separate the host names. For example, host1|host2|host3.

You can also use an asterisk (*) as a wildcard. For example, to connect directly to all hosts with host names that start with myhost, use myhost*.

Using Tailscale tunneling

Snowflake requires a Tailscale App Connector that advertises *.privatelink.snowflakecomputing.com. Because Snowflake is a public endpoint and not a private IP address, a subnet router does not work.

To use a Tailscale tunnel to connect to the source database:

1. From the Connection Method dropdown list, select Tailscale Tunnel.
2. In the Tags field, provide a comma-separated list of ACL tags to use to join the tailnet. For example, tag:tonic-worker.
3. Optionally, in the Control Server URL field, provide the URL. This is intended for customers who use Headscale or a self-hosted Tailscale control plane.
4. In the Tailscale Auth Key field, provide a Tailscale OAuth client credential. Structural does not support other types of Tailscale keys, such as user auth keys. You create the credential from the OAuth clients page in your Tailscale admin console. If secrets managers are available, you can instead select a secret name from a secrets manager.

Limiting the included schemas

By default, the source database includes all of the schemas. To specify a list of specific schemas to either include or exclude:

1. Toggle Limit Schemas to the on position.
2. From the filter option dropdown list, select whether to include or exclude the listed schemas.
3. In the field, provide the list of schemas to either include or exclude. Use commas or semicolons to separate the schemas.

Do not exclude schemas that are referred to by included schemas, unless you create those schemas manually outside of Structural.