Integration of Snowflake with CT-VL
This document describes how to configure and integrate CipherTrust Manager with Snowflake.
Snowflake’s Data Cloud is powered by an advanced data platform provided as a self-managed service. Snowflake enables data storage, processing, and analytic solutions that are faster, easier to use, and far more flexible than traditional offerings.
The Snowflake data platform is not built on any existing database technology or “big data” software platforms such as Hadoop. Instead, Snowflake combines a completely new SQL query engine with an innovative architecture natively designed for the cloud. Snowflake provides all of the functionality of an enterprise analytic database, along with many additional special features and unique capabilities.
Thales provides three different methods to protect sensitive data in Snowflake:
Bring Your Own Encryption (BYOE)
Data Ingest – with Thales Batch Data Transformation (BDT)
Data Access – external remote user defined functions for column level encrypt and decryption using Thales CADP and tokenization using Thales CT-VL.
Bring/Hold Your Own Key (BYOK) (HYOK)
- Snowflake Tri-Secret Secure – with Thales CM CCKM BYOK and HYOK.
Secrets Management
Snowflake Snowpipe – securing private RSA key in Thales CM for connecting to Snowflake.
Snowflake Credentials – Thales CipherTrust Secrets Manager (Akeyless) for secrets management in Snowflake.
Note
The above methods are NOT mutually exclusive. All three methods can be used to build a strong defense in depth strategy to protect sensitive data in the cloud. The focus of this integration will be on Data Access protecting sensitive data in snowflake columns by using CADP to create User Defined Functions (UDF) for encryption and decryption of sensitive data.
Architecture
Snowflake can run on all three major cloud service providers AWS, Azure and GCP. All three major CSP’s provide the ability to create a function as a service (FAAS). AWS refers this as AWS Lambda Functions, Google calls this as GCP Cloud Functions, and Azure calls them Azure Functions.
The steps provided in the links contain examples of both GCP and AWS functions, which provide you with information about how the integration works with GCP.
GCP Integration Example
Supported Product Versions
CipherTrust Manager
- CipherTrust Manager 2.11 and higher
CT-VL
- CT-VL 2.6.0 and higher
Snowflake
- Snowflake
This integration is validated using Google Cloud Functions Python Version 3.12.
Prerequisites
Steps performed for this integration are provided on this Snowflake link: https://docs.snowflake.com/en/sql-reference/external-functions.
Ensure that CT-VL is installed and configured. Refer to CT-VL Documentation.
Ensure that the CipherTrust Manager is installed and configured. Refer to the CipherTrust Manager Documentation for details.
