--- title: How to Protect Data on Snowflake with comforte Data Security Platform description: The comforte Data Security Platform helps businesses unlock the maximum value from sensitive data on Snowflake. image: https://insights.comforte.com/hubfs/blog%20header%20image%20snowflakes.jpeg --- [![Hubspot_blog_logo](https://insights.comforte.com/hs-fs/hubfs/Hubspot_blog_logo.png?width=295&name=Hubspot_blog_logo.png)](http://www.comforte.com) [![Subscribe](https://no-cache.hubspot.com/cta/default/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0) [![protect data snowflake](https://insights.comforte.com/hubfs/blog%20header%20image%20snowflakes.jpeg)](https://insights.comforte.com/how-to-protect-data-on-snowflake) [Giovanni Battista Spinelli Barrile](https://insights.comforte.com/author/giovanni-battista-spinelli-barrile) l Sep 14, 2022 l [Data Protection](https://insights.comforte.com/tag/data-protection), [Big Data Analytics](https://insights.comforte.com/tag/big-data-analytics), [Cloud Computing](https://insights.comforte.com/tag/cloud-computing) # How to Protect Data on Snowflake with comforte Data Security Platform Snowflake is one of the leading data warehousing solutions available today; its high performant and cloud-based design has been enabling thousands of customers around the world to create value out of their datasets. However, the risk of data breaches, strict security requirements, and regulations pose growing limitations and concerns to firms wanting to work with valuable information in cloud environments. Comforte empowers organizations to identify, classify, and protect sensitive data throughout their whole architecture. Modern data analytics solutions often involve technologies deployed on different cloud providers and on-prem. Our easy-to use, resilient, and scalable platform can flexibly implement data policies on different environments and tools. The comforte Data Security Platform’s tokenization engine offers different and customizable options including anonymization, pseudonymization, and format-preserving encryption. Tokenization is part of a data-centric protection strategy which significantly reduces the burdens of security and compliance by protecting the data itself rather than focusing exclusively on the applications’ perimeters. ![intercept and secure live data](https://insights.comforte.com/hs-fs/hubfs/intercept%20and%20secure%20live%20data.png?width=2216&name=intercept%20and%20secure%20live%20data.png) ![granular authorized access](https://insights.comforte.com/hs-fs/hubfs/granular%20authorized%20access.png?width=2070&name=granular%20authorized%20access.png) Snowflake can easily be set up to leverage external functions and invoke the comforte Data Security Platform through an API Gateway service. This method enables authorized users to easily tokenize and detokenize columns from Snowflake itself through a UDF.  Snowflake supports the creation of external functions using the main cloud services providers, including Amazon AWS, Microsoft Azure and Google GCP. The configuration can be slightly different for each provider. In this document we will be focusing on how to configure Snowflake external functions on Amazon AWS. ## 1. Protection cluster and REST API We will not cover the steps related to the creation of a protection cluster nor the setup of the REST API, but these are requirements to use the Snowflake integration. Please refer to the documentation of each product for information on how to configure them in each cloud platform. ## 2. API gateway The integration between Snowflake and the REST API requires an API Gateway to be configured. Each cloud platform has its own way to configure an API gateway, and we will describe the steps required to do it on Amazon AWS. For other cloud providers, please check their documentation. It is required that the AWS account has the privileges to: -Create AWS roles via IAM. -Create an API gateway endpoint. On Snowflake, it is required that the user account have ACCOUNTADMIN privileges or a role with the CREATE INTEGRATION privilege. ### a) Create an AWS role for the integration The first step is to create a new AWS role that will be used for the Snowflake integration. Create an empty text file to record some values and information for future reference. Some values will be required in different places, and it will be easier to copy and paste them from the text file. 1. Access the **Identity and Access Management (IAM)** console and click on **Roles** menu option and then on the **Create role** button. 2. On the **Select trusted entity** page select the **AWS account** entity type and specify which account ID will be able to access this role. 3. In the **Add permissions** page, optionally attach Permissions policies and click **Next**. 4. In the **Name, review, and create** page, define a name for the role. Suggestion is **SecurDPS\_Snowflake\_integration**, record this name for future reference. Finally, click the **Create role** button. 5. If everything is correct the new role will be created. Record the ARN of this role for future use. ### b) Create an AWS API Gateway endpoint After creating the role, we need to create the actual API Gateway endpoint that will be later used by Snowflake to call the SecurDPS Enterprise REST API to do the protect or reveal operations. 1. Access the **Amazon API Gateway** console and click on the **Create API** button. 2. Select the **REST API** option and click the **Build** button. 3. Select the **REST** protocol and choose to create a **New API**. In the **Settings** define a name for the API (suggested name is SecurDPS\_Snowflake\_Integration). Select the **Endpoint Type** based on your cloud deployment type. Click the **Create API** button to finish the initial steps. 4. If the API was created successfully you will see a new screen with a lot of options. Search for the **Actions** dropdown button and select the **Create Method** option. 5. Just below the **Actions** button you will notice a drop-down box where you can select the available methods. Select the **Post** method and click on the button with a "check" symbol to save the selected method. 6. Now you will be presented with the options for the **Post** method setup. Select the **HTTP** integration method and then inform the **Endpoint URL** to the REST API instance. The **Endpoint URL** will look like the example below. As we can notice, the REST API is reached at port 8080 and through the specific path /securdps/v1/snowflake/batch/. [http://\*\*\*\*\*\*\*\*\*\*4687b5daac5bb4a54f2-\*\*\*\*\*2279.us-east-2.elb.amazonaws.com:8080/securdps/v1/snowflake/batch/](http://**********4687b5daac5bb4a54f2-*****2279.us-east-2.elb.amazonaws.com:8080/securdps/v1/snowflake/batch/?hsLang=en) Save the changes to the API by clicking the Save button. 7. Next, deploy the API. Click the **Actions** drop down menu and select the **Deploy API** option. On the new form, select the **\[New stage\]** option for the **Deployment stage** field, then define a name for the stage (suggestion is **prod**) and click the **Deploy** button. 8. Record the **Invoke URL** information for future reference and click the "Save changes" button. ### c) Secure Your Amazon API Gateway Endpoint 1. At this point, you should be on the screen that displays your API Gateway information and you should see your resource and POST method. 2. In the left-hand pane, click on **Resources** and then click on the **POST** method. 3. Record the **Method Request ARN** from the Method Request box to your notes for future reference. 4. Click on the title **Method Request** to open the details window. Click the edit symbol beside **Authorization** and select **AWS\_IAM** to specify that the method request requires AWS\_IAM authorization. Then click on the small checkmark next to the menu to confirm your selection. 5. To set the resource policy for the API Gateway to specify who is authorized to invoke the gateway endpoint, click on Resource Policy in the left-hand column of the window for the API. Paste the JSON below in the Resource Policy editor: {    "Version": "2012-10-17",    "Statement":    \[       {       "Effect": "Allow",       "Principal":          {          "AWS": "arn:aws:sts::<12-digit-number>:assumed-role//snowflake"           },      "Action": "execute-api:Invoke",      "Resource": ""      }    \] } Edit the provided JSON changing the <12-digit-number> value with your AWS Account ID. In the same line change the value with the name the IAM role created earlier. Change also the with the ARN value you have recorded earlier for the POST method. After double-checking you have substituted all the variables in the Resource Policy JSON configuration, click the Save button. 6. Deploy all the changes. Select the **Resources** option in the left-hand column for the API, then use the **Action** menu, select **Deploy API** and use the stage created earlier (no need to create a new stage). 7. The next step is to create the Snowflake API integration. ## 3. Snowflake API integration ### a) Create the API Integration for AWS in Snowflake 1. Open a Snowflake session, typically a Snowflake web interface session. 2. Use a Snowflake role with ACCOUNTADMIN privileges or the CREATE INTEGRATION privilege, for example: use role ; 3. Type the CREATE API INTEGRATION command to create an API integration. The command should look similar to the following: create or replace api integration securdps\_api\_integration    api\_provider = aws\_api\_gateway    api\_aws\_role\_arn = ''    api\_allowed\_prefixes = ('https://')    enabled = true; The suggested name for the API integration can be edited. Please, record the name of the API integration. Provide the ARN value of the IAM role that was created in step 2.a. The api\_allowed\_prefixes field should contain the resource invocation URL that you recorded earlier in step 2.b. After doing the changes, click the Run button to create the API integration and check if you receive the "Integration SECURDPS\_API\_INTEGRATION successfully created" message.    4. Execute the DESCRIBE INTEGRATION command. describe integration ; For example: describe integration securdps\_api\_integration; Look for the property named API\_AWS\_IAM\_USER\_ARN and then record that property’s property\_value for future use. Find the property named API\_AWS\_EXTERNAL\_ID and record that property’s property\_value for future use. Note that the property\_value of the API\_AWS\_EXTERNAL\_ID often ends with an equals sign (“=”). That equals sign is part of the value; make sure that you cut and paste it along with the rest of the property\_value. ### b) Link the API Integration for AWS to the Proxy Service in the Management Console This topic provides instructions for linking the API integration object in Snowflake to the AWS API Gateway. You do this by creating a trust relationship between Snowflake and the IAM (identity and access management) role you created earlier. 1. Log into your AWS account and navigate to the **IAM management console**. 2. Select the **Roles** item under the **Access management** menu. 3. Locate the **role** created earlier using the search box. Click on the role name to open the details screen. Click on the **Trust relationships** tab, then click on the button **Edit trust policy**. This should open the **Trusted Entities** document into which you can add authentication information. Find the Statement Condition field. Initially, this should contain only curly brackets (“{}”). Paste the following between the curly brackets: "StringEquals": { "sts:ExternalId": "xxx" } Replace the xxx with the value for the API\_AWS\_EXTERNAL\_ID field recorded earlier in step 3.a).4. Finally, click the Update policy button. Now we are ready to create the External Function in Snowflake in the next step. ## 4. Snowflake External Function To create the external function access Snowflake web interface and type the CREATE EXTERNAL FUNCTION command as exemplified below: CREATE EXTERNAL FUNCTION my\_external\_function(v VARCHAR)    RETURNS VARIANT    API\_INTEGRATION =    HEADERS = ( 'Authorization' = ,                'Content-Type' = 'application/json',                'X-Operation' = ,                'X-Strategy' = )    AS ''; Change the "my\_external\_function" function name to something more meaningful, for example securdps\_protect\_SSN, so you can identify that this function will protect and return the passed SSN (social security number). Using the same principle, you could change the v variable to SSN. The datatype should also be adjusted accordingly with the actual database column datatype. Replace the with the previously recorded name of the API integration object. If you followed the suggestion, the name is securdps\_api\_integration. In the HEADERS parameters, change the    value to the corresponding bearer token of the REST API to authenticate the connection user. Modify the X-Operation header to the desired PROTECT or REVEAL operation to be executed and define the X-Strategy to be applied based on the configured protection strategies defined in the protection cluster. Finally, modify the to the previously recorded value of the API Gateway invoke URL recorded in step 2.b).8. The resulting command should look like: CREATE OR REPLACE EXTERNAL FUNCTION SDPS\_PROTECT\_SSN(value VARCHAR) RETURNS variant API\_INTEGRATION = securdps\_api\_integration HEADERS = ( 'Authorization' = 'Bearer \*\*\*\*\*672-5598-4480-aca5-\*\*\*\*\*\*\*\*\*',             'Content-Type' = 'application/json',             'X-Operation' = 'PROTECT',             'X-Strategy' = 'SSN') AS 'https://\*\*\*\*\*\*\*\*\*\*\*.execute-api.eu-central-1.amazonaws.com/Prod' Run the command to create the Snowflake external function. You can now test the external function running it with a single value as exemplified below: SELECT SDPS\_PROTECT\_SSN2('111-22-3333') If everything was correctly setup you should see a tokenized value as result. ## 5. Snowflake column masking Snowflake has the option to create column level masking to mask the data that is presented as result of SELECT statements. Using the external function we created earlier it is possible to apply column level tokenization in a few easy steps that we will describe next.       1. First, create a masking policy using the command CREATE MASKING POLICY as exemplified next: create or replace masking policy as (val string) returns string ->       (val) Using the previous implemented external function as example, we could define a masking policy that allow access to plain data only to the SECURITYADMIN role in Snowflake using the following example: create or replace masking policy SSN\_MASK as (val string) returns string ->    CASE      WHEN CURRENT\_ROLE() IN ('SECURITYADMIN') THEN val      ELSE SDPS\_PROTECT\_SSN(val)    END; In the example above we are assuming that data is stored in plain in Snowflake, and we want to protect this data from not allowed users - in this case all users that are not part of the SECURITYADMIN role will see only protected data.       2. After creating the masking policy you have to apply it to the table/column to be masked, using the SET MASKING POLICY command. A masking policy can be applied during CREATE TABLE statements or be applied later using the ALTER TABLE statement. To apply the masking policy to existing data we can use the following command: alter table if exists modify column set masking policy ; Using the samples we created in this document, the command would look like : alter table if exists CUSTOMERS modify column SSN set masking policy SSN\_MASK; After applying this masking policy, any user that does not belong to the SECURITYADMIN role that queries the CUSTOMERS table SSN column will get only protected results. For more information on how create objects in Snowflake, including external functions, masking policies, user roles, tables and columns, please refer to the links and references below: ## Links and references - [Snowflake documentation](https://docs.snowflake.com/en/index.html) - [Snowflake UDFs documentation](https://docs.snowflake.com/en/sql-reference/user-defined-functions.html) - [Snowflake External Functions documentation](https://docs.snowflake.com/en/sql-reference/external-functions.html) - [Snowflake External Function for AWS documentation](https://docs.snowflake.com/en/sql-reference/external-functions-creating-aws.html) --- | Share this:  | [![LinkedIn](https://insights.comforte.com/hubfs/Social%20Icons/linkedin%20icon.png)](https://www.linkedin.com/shareArticle?mini=true&url=https://insights.comforte.com/how-to-protect-data-on-snowflake&utm_medium=social&utm_source=linkedin) | [![Bluesky](https://insights.comforte.com/hubfs/Social%20Icons/bluesky_logo.png)](https://bsky.app/intent/compose?url=https://insights.comforte.com/how-to-protect-data-on-snowflake&utm_medium=social&utm_source=Bluesky) | ![Twitter](https://insights.comforte.com/hubfs/Social%20Icons/twitter_x_logo-1.png) | [![XING](https://insights.comforte.com/hubfs/Social%20Icons/xing-color2.png)](https://www.xing.com/spi/shares/new?url=https://insights.comforte.com/how-to-protect-data-on-snowflake&utm_medium=social&utm_source=xing) | [![Email](https://insights.comforte.com/hubfs/Social%20Icons/email%20icon.png)](mailto:?subject=Check%20out%20https://insights.comforte.com/how-to-protect-data-on-snowflake&utm_medium=social&utm_source=email%20&body=Check%20out%20https://insights.comforte.com/how-to-protect-data-on-snowflake&utm_medium=social&utm_source=email) | | --- | --- | --- | --- | --- | --- | ## Want to learn more? Check out our data analytics security page: [![Privacy-enabled Analytics](https://no-cache.hubspot.com/cta/default/4026697/a1472e52-3781-4626-859c-c9090c1b2ccd.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/a1472e52-3781-4626-859c-c9090c1b2ccd) ### Related posts ![Reuse, Reward: How Banks Can Safely Unlock the Value of Their Data](https://insights.comforte.com/hubfs/comforte%20AG_%20Reuse%20Reward_%20How%20Banks%20Can%20Safely%20Unlock%20the%20Value%20of%20Their%20Data_03.2025.png) Mar 12, 2026 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Payments Transformation](https://insights.comforte.com/tag/payments-transformation) , [Business Value](https://insights.comforte.com/tag/business-value) ### [Reuse, Reward: How Banks Can Safely Unlock the Value of Their Data](https://insights.comforte.com/reuse-reward-how-banks-can-safely-unlock-the-value-of-their-data?hsLang=en) The financial world is awash with data. But too few organizations are able to use it effectively. In [Bank Director’s *2025 Technology Survey*](https://www.bankdirector.com/wp-content/uploads/2025/09/2025TechReport-OpenVersion.pdf), one-third of US banking leaders cite an inability to harness data as a top technology challenge facing their... [Read more](https://insights.comforte.com/reuse-reward-how-banks-can-safely-unlock-the-value-of-their-data?hsLang=en) ![Delivering a Secure, Trusted Foundation for Cloud Growth at LGT](https://insights.comforte.com/hubfs/comforte%20AG_Delivering%20a%20Secure%2c%20Trusted%20Foundation%20for%20Cloud%20Growth%20at%20LGT_01.2026.png) Jan 15, 2026 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Business Value](https://insights.comforte.com/tag/business-value) ### [Delivering a Secure, Trusted Foundation for Cloud Growth at LGT](https://insights.comforte.com/delivering-a-secure-trusted-foundation-for-cloud-growth-at-lgt?hsLang=en) There’s a world of difference between retail and private banking. While the former is transactional and focused on the mass market, the latter is built on trust and personal relationships. That trust can be hard won, but is easily lost, especially... [Read more](https://insights.comforte.com/delivering-a-secure-trusted-foundation-for-cloud-growth-at-lgt?hsLang=en) ![Top Indicators You Have a Cybersecurity Problem—and What to Do About It](https://insights.comforte.com/hubfs/comforte%20AG_Top%20Indicators%20You%20Have%20a%20Cybersecurity%20Problem_and%20What%20to%20Do%20About%20It.png) May 22, 2025 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Digital Enablement](https://insights.comforte.com/tag/digital-enablement) ### [Top Indicators You Have a Cybersecurity Problem—and What to Do About It](https://insights.comforte.com/top-indicators-you-have-a-cybersecurity-problem-and-what-to-do-about-it?hsLang=en) Data is both blessing and curse to the modern enterprise. Yes, when analyzed effectively it can surface intelligence to improve decision making, customer engagement, process efficiency and, ultimately, drive revenue. But it also represents a major... [Read more](https://insights.comforte.com/top-indicators-you-have-a-cybersecurity-problem-and-what-to-do-about-it?hsLang=en) ### Service - [Contact](https://www.comforte.com/contact/) - [About us](https://www.comforte.com/company/) - [Blog](https://insights.comforte.com/) - [Press Releases](https://www.comforte.com/company/press-releases/) - [Career](https://www.comforte.com/company/career/) - [Resources](https://www.comforte.com/resources/) ### Germany comforte AG Abraham-Lincoln-Str. 22 65189 Wiesbaden Germany Phone: + 49 611 93199 00 Fax: + 49 611 93199 05 ### Australia comforte PTY Suite 20, 1 Rivett Road North Ryde NSW 2113 Australia Postal Address: PO Box 1710 Lane Cove NSW 1595 Australia Phone: +61 2 8197 0272 ### USA comforte Inc. 30 Wall Street, 8th Floor New York, NY 10005-2205 USA Phone: +1-646-438-5716 ### Singapore comforte Asia Pte. Ltd. 1 Raffles Place, #19-61 Tower 2  Singapore 048616 Phone: +65 6808 5507 - [Sitemap](https://www.comforte.com/sitemap/) - [Legal Notice](https://www.comforte.com/legal-notice/) - [Privacy Policy](https://www.comforte.com/privacy-policy/) © comforte AG 2026