Skip to content

Snowflake Deployment Instructions

If you are installing Tecton on Snowflake, follow these steps.

Create Tecton database objects in Snowflake

Connect to Snowflake and run the following commands.

Note

Set the value of USER_PASS to an randomly generated password. It will be reset on first use by Tecton.

-- Configure the names of the objects created by the following commands.
SET ROLE_NAME='<service role name>'; -- Example: TECTON_SERVICE_ROLE
SET USER_NAME='<user name>'; -- Example: TECTON_SERVICE_USER
SET USER_PASS='<randomly generated password>';
SET DATABASE_NAME='<database name>'; -- Example: TECTON

-- Create the Tecton service role
CREATE ROLE IDENTIFIER($ROLE_NAME);
-- Granting every role to SYSADMIN is recommended by Snowflake.
GRANT ROLE IDENTIFIER($ROLE_NAME) TO ROLE SYSADMIN;

-- Create the Tecton database, owned by the Tecton service role.
CREATE DATABASE IDENTIFIER($DATABASE_NAME);
GRANT OWNERSHIP ON DATABASE IDENTIFIER($DATABASE_NAME) TO ROLE IDENTIFIER($ROLE_NAME);

-- Create the Tecton service user and grant it the Tecton service role
CREATE USER IDENTIFIER($USER_NAME)
    PASSWORD = $USER_PASS
    DEFAULT_ROLE = $ROLE_NAME
    MUST_CHANGE_PASSWORD = TRUE
    ;

GRANT ROLE IDENTIFIER($ROLE_NAME) TO USER IDENTIFIER($USER_NAME);

Create a cross-account role for the Tecton Control Plane

Next, you'll need to create an access policy and an IAM role which the Tecton control plane will use to orchestrate AWS resources in your account.

  1. In the AWS Console of the account you want to deploy Tecton into, go to the IAM service.
  2. Click the Policies tab in the sidebar.

  3. Click Create Policy.

    3a. Paste in the following JSON policy, replacing ${REGION} with the AWS region you selected for your deployment, ${ACCOUNT} with the account ID of your AWS account, ${DEPLOYMENT_NAME} with your Tecton deployment name.

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DynamoDB",
            "Effect": "Allow",
            "Action": [
                "dynamodb:BatchGetItem",
                "dynamodb:BatchWriteItem",
                "dynamodb:ConditionCheckItem",
                "dynamodb:CreateTable",
                "dynamodb:DeleteItem",
                "dynamodb:DeleteTable",
                "dynamodb:DescribeTable",
                "dynamodb:GetItem",
                "dynamodb:PutItem",
                "dynamodb:Query",
                "dynamodb:TagResource",
                "dynamodb:UpdateTable"
            ],
            "Resource": [
                "arn:aws:dynamodb:${REGION}:${ACCOUNT_ID}:table/tecton-${DEPLOYMENT_NAME}*"
            ]
        },
        {
            "Sid": "DynamoDBGlobal",
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTables",
                "dynamodb:DescribeLimits"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VerifyPermissions",
            "Effect": "Allow",
            "Action": [
                "iam:GetPolicy",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "iam:GetPolicyVersion",
                "iam:ListPolicyVersions",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole"
            ],
            "Resource": [
                "arn:aws:iam::${ACCOUNT_ID}:policy/tecton-*",
                "arn:aws:iam::${ACCOUNT_ID}:role/tecton-*"
            ]
        }
    ]
}

    3b. Click Next: Tags

    3c. Add the following tag to the policy 

    key: tecton-accessible:DEPLOYMENT_NAME
value: true

    3d. Click Next: Review

    3e. Give the policy an easy to remember name starting with tecton-, like tecton-{DEPLOYMENT_NAME}-cross-account-policy

    3f. Click Create Policy

  4. Click the Roles tab in the sidebar.

  5. Click Create role.

    5a. Under Select type of trusted entity, click the Another AWS account tile.

    assets/admin-guide/create-role.png

    5b. Specify Tecton's Account ID. Please contact your Account Manager to get the appropriate ID.

    5c. Enable the option "Require external ID."

    5d. Enter a random External ID of your choice (for example, a UUID works well). Make sure to note down the external ID that you choose -- you'll need to provide this to Tecton to complete the installation.

    5e. Click the Next: Permissions button

    5f. Search for the policy you just created (e.g. tecton-{DEPLOYMENT_NAME}-cross-account-policy), and click the check box next to that policy to attach the policy to the new role.

    5g. Click the Next: Tags button.

    5h. Click the Next: Review button.

    5i. In the Role name field, enter a role name starting with tecton-, such as tecton-{DEPLOYMENT_NAME}-cross-account-role.

    5j. Click Create role. You will see a list of roles displayed.

Request your Tecton installation

Once you've completed the above setup, you're ready to request your installation! Send the following information to the Tecton team:

  • Your Snowflake account identifier.
  • Your deployment name (e.g. mycompany-production).
  • The region in which you'd like Tecton deployed (e.g. us-west-2).
  • The ARN and External ID of the role you created for the Tecton control plane.
  • The values of the USER_NAME, USER_PASS and DATABASE_NAME variables.
  • The name of the warehouse that the service role (the value of ROLE_NAME) has access to. The service role runs materialization jobs against the warehouse.

After you send this information to Tecton, the team will deploy Tecton into your account.