diff --git a/ingestion/src/metadata/ingestion/source/database/snowflake/queries.py b/ingestion/src/metadata/ingestion/source/database/snowflake/queries.py index 2a97dc7d127..d94f2d20983 100644 --- a/ingestion/src/metadata/ingestion/source/database/snowflake/queries.py +++ b/ingestion/src/metadata/ingestion/source/database/snowflake/queries.py @@ -296,7 +296,7 @@ SELECT ARGUMENT_SIGNATURE AS signature, COMMENT as comment, 'StoredProcedure' as procedure_type -FROM INFORMATION_SCHEMA.PROCEDURES +FROM SNOWFLAKE.ACCOUNT_USAGE.PROCEDURES WHERE PROCEDURE_CATALOG = '{database_name}' AND PROCEDURE_SCHEMA = '{schema_name}' """ @@ -312,7 +312,7 @@ SELECT ARGUMENT_SIGNATURE AS signature, COMMENT as comment, 'UDF' as procedure_type -FROM INFORMATION_SCHEMA.FUNCTIONS +FROM SNOWFLAKE.ACCOUNT_USAGE.FUNCTIONS WHERE FUNCTION_CATALOG = '{database_name}' AND FUNCTION_SCHEMA = '{schema_name}' """ diff --git a/openmetadata-docs/content/v1.4.x/connectors/database/snowflake/index.md b/openmetadata-docs/content/v1.4.x/connectors/database/snowflake/index.md index 92f5e336940..f026a4363ad 100644 --- a/openmetadata-docs/content/v1.4.x/connectors/database/snowflake/index.md +++ b/openmetadata-docs/content/v1.4.x/connectors/database/snowflake/index.md @@ -59,13 +59,18 @@ GRANT SELECT ON ALL TABLES IN SCHEMA TEST_SCHEMA TO ROLE NEW_ROLE; GRANT SELECT ON ALL EXTERNAL TABLES IN SCHEMA TEST_SCHEMA TO ROLE NEW_ROLE; GRANT SELECT ON ALL VIEWS IN SCHEMA TEST_SCHEMA TO ROLE NEW_ROLE; GRANT SELECT ON ALL DYNAMIC TABLES IN SCHEMA TEST_SCHEMA TO ROLE NEW_ROLE; + +-- Grant IMPORTED PRIVILEGES on all Schemas of SNOWFLAKE DB to New Role, +-- optional but required for usage, lineage and stored procedure ingestion +GRANT IMPORTED PRIVILEGES ON ALL SCHEMAS IN DATABASE SNOWFLAKE TO ROLE NEW_ROLE; ``` {% note %} If running any of: - Incremental Extraction - Ingesting Tags - - Usage Workflow + - Ingesting Stored Procedures + - Lineage & Usage Workflow The following Grant is needed {% /note %} @@ -74,24 +79,12 @@ The following Grant is needed - **Ingesting Tags**: Openmetadata fetches the information by querying `snowflake.account_usage.tag_references`. -- **Usage Workflow**: Openmetadata fetches the query logs by querying `snowflake.account_usage.query_history` table. For this the snowflake user should be granted the `ACCOUNTADMIN` role or a role granted IMPORTED PRIVILEGES on the database `SNOWFLAKE`. - -In order to be able to query those tables, the user should be either granted the `ACCOUNTADMIN` role or a role with the `IMPORTED PRIVILEGES` grant on the `SNOWFLAKE` database: - -```sql --- Grant IMPORTED PRIVILEGES on all Schemas of SNOWFLAKE DB to New Role -GRANT IMPORTED PRIVILEGES ON ALL SCHEMAS IN DATABASE SNOWFLAKE TO ROLE NEW_ROLE; -``` +- **Lineage & Usage Workflow**: Openmetadata fetches the query logs by querying `snowflake.account_usage.query_history` table. For this the snowflake user should be granted the `ACCOUNTADMIN` role or a role granted IMPORTED PRIVILEGES on the database `SNOWFLAKE`. You can find more information about the `account_usage` schema [here](https://docs.snowflake.com/en/sql-reference/account-usage). -Regarding Stored Procedures: -1. Snowflake only allows the grant of `USAGE` or `OWNERSHIP` -2. A user can only see the definition of the procedure in 2 situations: - 1. If it has the `OWNERSHIP` grant, - 2. If it has the `USAGE` grant and the procedure is created with `EXECUTE AS CALLER`. +- **Ingesting Stored Procedures**: Openmetadata fetches the information by querying `snowflake.account_usage.procedures` & `snowflake.account_usage.functions`. -Make sure to add the `GRANT ON PROCEDURE () to NEW_ROLE`, e.g., `GRANT USAGE ON PROCEDURE CLEAN_DATA(varchar, varchar) to NEW_ROLE`. ## Metadata Ingestion diff --git a/openmetadata-docs/content/v1.6.x-SNAPSHOT/connectors/database/snowflake/index.md b/openmetadata-docs/content/v1.6.x-SNAPSHOT/connectors/database/snowflake/index.md index a4c5d452b58..c6f7ab73803 100644 --- a/openmetadata-docs/content/v1.6.x-SNAPSHOT/connectors/database/snowflake/index.md +++ b/openmetadata-docs/content/v1.6.x-SNAPSHOT/connectors/database/snowflake/index.md @@ -59,13 +59,18 @@ GRANT SELECT ON ALL TABLES IN SCHEMA TEST_SCHEMA TO ROLE NEW_ROLE; GRANT SELECT ON ALL EXTERNAL TABLES IN SCHEMA TEST_SCHEMA TO ROLE NEW_ROLE; GRANT SELECT ON ALL VIEWS IN SCHEMA TEST_SCHEMA TO ROLE NEW_ROLE; GRANT SELECT ON ALL DYNAMIC TABLES IN SCHEMA TEST_SCHEMA TO ROLE NEW_ROLE; + +-- Grant IMPORTED PRIVILEGES on all Schemas of SNOWFLAKE DB to New Role, +-- optional but required for usage, lineage and stored procedure ingestion +GRANT IMPORTED PRIVILEGES ON ALL SCHEMAS IN DATABASE SNOWFLAKE TO ROLE NEW_ROLE; ``` {% note %} If running any of: - Incremental Extraction - Ingesting Tags - - Usage Workflow + - Ingesting Stored Procedures + - Lineage & Usage Workflow The following Grant is needed {% /note %} @@ -74,24 +79,11 @@ The following Grant is needed - **Ingesting Tags**: Openmetadata fetches the information by querying `snowflake.account_usage.tag_references`. -- **Usage Workflow**: Openmetadata fetches the query logs by querying `snowflake.account_usage.query_history` table. For this the snowflake user should be granted the `ACCOUNTADMIN` role or a role granted IMPORTED PRIVILEGES on the database `SNOWFLAKE`. - -In order to be able to query those tables, the user should be either granted the `ACCOUNTADMIN` role or a role with the `IMPORTED PRIVILEGES` grant on the `SNOWFLAKE` database: - -```sql --- Grant IMPORTED PRIVILEGES on all Schemas of SNOWFLAKE DB to New Role -GRANT IMPORTED PRIVILEGES ON ALL SCHEMAS IN DATABASE SNOWFLAKE TO ROLE NEW_ROLE; -``` +- **Lineage & Usage Workflow**: Openmetadata fetches the query logs by querying `snowflake.account_usage.query_history` table. For this the snowflake user should be granted the `ACCOUNTADMIN` role or a role granted IMPORTED PRIVILEGES on the database `SNOWFLAKE`. You can find more information about the `account_usage` schema [here](https://docs.snowflake.com/en/sql-reference/account-usage). -Regarding Stored Procedures: -1. Snowflake only allows the grant of `USAGE` or `OWNERSHIP` -2. A user can only see the definition of the procedure in 2 situations: - 1. If it has the `OWNERSHIP` grant, - 2. If it has the `USAGE` grant and the procedure is created with `EXECUTE AS CALLER`. - -Make sure to add the `GRANT ON PROCEDURE () to NEW_ROLE`, e.g., `GRANT USAGE ON PROCEDURE CLEAN_DATA(varchar, varchar) to NEW_ROLE`. +- **Ingesting Stored Procedures**: Openmetadata fetches the information by querying `snowflake.account_usage.procedures` & `snowflake.account_usage.functions`. ## Metadata Ingestion