# Egress PrivateLink Endpoint Setup: Snowflake on AWS for Confluent Cloud The Snowflake Sink connector for Confluent Cloud supports AWS PrivateLink connectivity through Egress PrivateLink Endpoints. Use this guide to configure the connector and set up the required endpoints. ## Prerequisites The following is a list of prerequisites for configuring the Snowflake Sink connector with an Egress PrivateLink Endpoint: * In Confluent Cloud, one of the following cluster types was set up with the specified network resource: * A Dedicated cluster with a Confluent Cloud network For the steps to create a Confluent Cloud network, see [Create a Confluent Cloud network](../../networking/ccloud-network/aws.md#ccn-config-aws). The Connection type of the network needs to be “PrivateLink Access”. * A Enterprise cluster with a network gateway For the steps to create a gateway, see [Create a gateway for outbound connectivity in Confluent Cloud](../../networking/aws-egress-privatelink-esku.md#aws-privatelink-egress-create-gateway-esku). * A source topic was created to sink data into the Snowflake database. * Snowflake instance was created to sink data into and is running within the same region and cloud as the Confluent Cloud cluster. * A database and a schema were created in Snowflake to sink data into. * Snowflake imposes restrictions on which DNS hostnames can be used to connect. Be sure to use the hostnames mentioned in [AWS PrivateLink and Snowflake](https://docs.snowflake.com/en/user-guide/admin-security-privatelink#specify-hostname-for-snowflake-clients). #### NOTE For added security, you can set up a Network rule within Snowflake to [restrict incoming traffic](https://docs.snowflake.com/en/user-guide/network-rules#incoming-requests) to the specific VPC Endpoint setup as part of Egress PrivateLink Endpoints. ## Step 1. Request Snowflake to allowlist Confluent’s AWS account 1. In the Confluent Cloud Console, go to **Environment** → **Network**, and select the associated Privatelink network you want to use. 2. In the **Egress PrivateLink Endpoints** tab, make note of Confluent’s AWS Account ID associated with the PrivateLink Endpoint.  3. Open a [support case with Snowflake](https://community.snowflake.com/s/article/How-To-Submit-a-Support-Case-in-Snowflake-Lodge) with the following information to request that Confluent’s AWS Account ID be allowlisted for private connectivity. * Your Snowflake Account URL. * Confluent’s AWS Account ID associated with the Egress PrivateLink Endpoint. You retrieved this in the previous step. 4. Wait to receive confirmation from Snowflake that Confluent’s AWS Account ID has been allowlisted before proceeding. ## Step 2. Obtain the Snowflake Private Link Service ID To obtain the Service ID associated with your Snowflake instance, execute the following statement from within your Snowflake account and make note of the value of `privatelink-vpce-id`: ```SQL USE ROLE ACCOUNTADMIN; SELECT KEY, VALUE::VARCHAR VPCE_SERVICE_ID FROM TABLE(FLATTEN(INPUT=>PARSE_JSON(SYSTEM$GET_PRIVATELINK_CONFIG()))) WHERE KEY = 'privatelink-vpce-id'; ```
 ## Step 3. Create an Egress PrivateLink Endpoint ### Dedicated cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the Confluent Cloud network you want to add the PrivateLink Endpoint to. The **Connection Type** of the network needs to be “PrivateLink Access”. 2. Click **Create endpoint** in the **Egress connections** tab. 3. Click the service you want to connect to, specifically, **Snowflake**. 4. Follow the guided steps to specify the field values, including: * **Name**: Name of the PrivateLink Endpoint. * **PrivateLink service name**: The name of the PrivateLink service you retrieved in [Step 2. Obtain the Snowflake Private Link Service ID](#cc-snowflake-sink-eap-aws-service-id). * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. 5. Click **Create** to create the PrivateLink Endpoint. 6. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and then click **Finish**. ### Enterprise cluster 1. In the **Network management** page or tab of the desired Confluent Cloud environment, click the **For serverless products** tab. 2. Click the gateway to which you want to add the PrivateLink Endpoint. 3. In the **Access points** tab, click **Add access point**. 4. Click the service you want to connect to. Select **Other** if you do not see the specific service. Specific services are listed based on the cloud provider for the gateway. 5. Follow the guided steps to specify the field values, including: * **Access point name**: Name of the PrivateLink Endpoint. * **Create an endpoint with high availability**: Check the box if you wish to deploy an endpoint with High Availability. Endpoints deployed with high availability have network interfaces deployed in multiple availability zones. * **PrivateLink service name**: The name of the PrivateLink service you retrieved in [Step 2. Obtain the Snowflake Private Link Service ID](#cc-snowflake-sink-eap-aws-service-id). 6. Click **Create access point** to create the PrivateLink Endpoint. 7. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and click **Finish**. ## Step 4. Create a DNS record ### Dedicated cluster 1. When the PrivateLink Endpoint status transitions to “Ready”, in the **DNS** tab, click **Create record** on the associated PrivateLink Endpoint.  2. Specify the following, and click **Save**. * **Access point**: Select the PrivateLink Endpoint you created above in [Step 3. Create an Egress PrivateLink Endpoint](#cc-snowflake-sink-eap-aws-access-point). * **Domain**: `privatelink.snowflakecomputing.com`  ### Enterprise cluster 1. In the **Network Management** tab of your environment, click the **For serverless products** tab, and click the Confluent Cloud gateway you want to add the DNS record to. 2. In the **DNS** tab, click **Create DNS record**. 3. Specify the following field values: * **Access point**: The Access Point ID you created in [Step 3. Create an Egress PrivateLink Endpoint](#cc-snowflake-sink-eap-aws-access-point). * **Domain**: `privatelink.snowflakecomputing.com` 4. Click **Save**. ## Step 5. Create the Snowflake Sink connector 1. Specify the authentication details for Snowflake. For the Connection URL, specify Snowflake’s private endpoint URL (`https://-.privatelink.snowflakecomputing.com`).  2. Follow the steps to create the [sink connector](cc-snowflake-sink.md#cc-snowflake-sink) in Confluent Cloud.