> ## Documentation Index
> Fetch the complete documentation index at: https://docs.elementum.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS PrivateLink for Snowflake CloudLink

> Connect Elementum on AWS to your Snowflake account over AWS PrivateLink so traffic stays on the AWS network instead of the public internet.

If your Elementum organization runs on AWS, you can connect to your Snowflake account over [AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) instead of the public internet. PrivateLink creates a private connection between Elementum's AWS Virtual Private Cloud (VPC) and your Snowflake VPC, so CloudLink traffic stays on the AWS network. This is offered as an alternative to [IP whitelisting](/administration/connect-snowflake-to-elementum#whitelist-elementum-ip-addresses) for customers with stricter security or compliance requirements.

## How it works

End users still reach Elementum over the public internet, but data traffic between Elementum and your Snowflake account is routed through an Amazon PrivateLink endpoint inside AWS. Elementum supports PrivateLink to customer Snowflake accounts in any AWS region with PrivateLink support.

## When to use PrivateLink

PrivateLink is a good fit when:

* Your Elementum organization is hosted on AWS.
* Your Snowflake account is on AWS in a region with PrivateLink support and is on the **Business Critical** Snowflake edition (or higher).
* Your security or compliance program requires data traffic to bypass the public internet.
* You want to block all public access to Snowflake and only allow connections from your corporate network and Elementum.

If any of these don't apply, the standard [IP-whitelisted CloudLink setup](/administration/connect-snowflake-to-elementum) is still secure (encrypted in transit with TLS) and is the simpler option.

## Prerequisites

<Steps>
  <Step title="Elementum on AWS">
    Confirm with your Elementum representative that your organization is deployed on AWS. PrivateLink is not available for Elementum organizations on other clouds.
  </Step>

  <Step title="Snowflake edition and region">
    Your Snowflake account must be on AWS, in a region with PrivateLink support, and on the **Business Critical** edition or higher. PrivateLink is not available on Standard or Enterprise editions.
  </Step>

  <Step title="Snowflake ACCOUNTADMIN access">
    You need a user with the `ACCOUNTADMIN` role to authorize PrivateLink and retrieve the configuration.
  </Step>

  <Step title="Snowflake CloudLink in place">
    PrivateLink replaces the IP whitelist on an existing or planned [Snowflake CloudLink](/administration/connect-snowflake-to-elementum) connection. The rest of the CloudLink setup — service user, role, warehouse, and key-pair authentication — is still required.
  </Step>
</Steps>

## Setup workflow

The customer-side setup happens in your Snowflake account. Elementum handles the consumer-side AWS VPC endpoint, DNS, and CloudLink hostname configuration.

<Info>
  Provisioning the Elementum-side VPC endpoint is handled by Elementum support. The steps below are the Snowflake actions you complete in your own account so Elementum can finish wiring up the connection.
</Info>

<Steps>
  <Step title="Contact Elementum to initiate PrivateLink">
    Open a request with your Elementum representative or [Elementum support](/support/resources). They will provide the **AWS account identifier** you authorize on your Snowflake account in the next step. Compare your Snowflake account's AWS region against [Elementum's hosting regions](#cross-region-considerations) and call out the mismatch in your request if your Snowflake account is in a different region, so the team can configure cross-region endpoint settings.
  </Step>

  <Step title="Generate an AWS federation token">
    `SYSTEM$AUTHORIZE_PRIVATELINK` requires a federated token from your AWS account. Generate one with the AWS CLI:

    ```bash theme={null}
    aws sts get-federation-token --name elementum-privatelink
    ```

    Save the JSON output — you'll pass it to Snowflake in the next step.

    <Warning>
      The federated token expires **12 hours** after it's generated. If authorization or verification fails because of an expired token, run `aws sts get-federation-token` again and re-issue the Snowflake command with the fresh token.
    </Warning>
  </Step>

  <Step title="Authorize Elementum's AWS account on your Snowflake account">
    Using the `ACCOUNTADMIN` role, call [`SYSTEM$AUTHORIZE_PRIVATELINK`](https://docs.snowflake.com/en/sql-reference/functions/system_authorize_privatelink) with the AWS account ID Elementum gave you and the federated token from the previous step:

    ```sql theme={null}
    USE ROLE ACCOUNTADMIN;

    SELECT SYSTEM$AUTHORIZE_PRIVATELINK(
      '<ELEMENTUM_AWS_ACCOUNT_ID>',
      '<FEDERATED_TOKEN_JSON>'
    );
    ```

    Replace **ELEMENTUM\_AWS\_ACCOUNT\_ID** with the 12-digit AWS account ID Elementum provided, and **FEDERATED\_TOKEN\_JSON** with the full JSON output from `aws sts get-federation-token`.
  </Step>

  <Step title="Verify the authorization">
    Confirm the authorization succeeded by calling [`SYSTEM$GET_PRIVATELINK`](https://docs.snowflake.com/en/sql-reference/functions/system_get_privatelink) with the same arguments:

    ```sql theme={null}
    SELECT SYSTEM$GET_PRIVATELINK(
      '<ELEMENTUM_AWS_ACCOUNT_ID>',
      '<FEDERATED_TOKEN_JSON>'
    );
    ```

    A successful response returns `Account is authorized for PrivateLink.`
  </Step>

  <Step title="Retrieve the PrivateLink configuration for Elementum">
    Get your account's PrivateLink endpoint details by calling [`SYSTEM$GET_PRIVATELINK_CONFIG`](https://docs.snowflake.com/en/sql-reference/functions/system_get_privatelink_config):

    ```sql theme={null}
    SELECT SYSTEM$GET_PRIVATELINK_CONFIG();
    ```

    Share the JSON output with your Elementum contact. Elementum primarily needs:

    * `privatelink-account-url` — the private hostname for your Snowflake account
    * `privatelink-vpce-id` — the VPC endpoint service identifier
    * `privatelink-ocsp-url` — the OCSP cache server hostname

    Elementum uses these values to provision the VPC endpoint on the Elementum side and update the CloudLink hostname.
  </Step>

  <Step title="Confirm connectivity from Elementum">
    After Elementum confirms the endpoint is provisioned, open **Settings > CloudLinks** in Elementum, edit the Snowflake connection (or create a new one following the [Connecting Snowflake to Elementum](/administration/connect-snowflake-to-elementum) guide), and click **Test Connection**. A successful test confirms traffic is flowing over PrivateLink.
  </Step>
</Steps>

## Block public access to Snowflake

After PrivateLink is verified, you can tighten security further by restricting your Snowflake account to PrivateLink and your corporate network only. Add a Snowflake [network policy](https://docs.snowflake.com/en/user-guide/network-policies) that allows only your corporate CIDR ranges and activate it for the account.

<Note>
  Once PrivateLink is in place for Elementum, the Elementum [public IP allow list](/administration/connect-snowflake-to-elementum#whitelist-elementum-ip-addresses) (`44.210.166.136`, `44.209.114.114`, etc.) is no longer required for Elementum traffic. You can safely remove those IPs from your Snowflake network policy after confirming the PrivateLink connection is healthy.
</Note>

## Cross-region considerations

Elementum hosts its production AWS environments in two regions:

| Elementum environment | AWS region     | Region name            |
| --------------------- | -------------- | ---------------------- |
| PROD                  | `us-east-1`    | US East (N. Virginia)  |
| PROD-EU               | `eu-central-1` | EU Central (Frankfurt) |

If your Snowflake account is in the same AWS region as the Elementum environment hosting your organization, no cross-region configuration is needed. If your Snowflake account is in a different region, AWS PrivateLink still supports the connection, but Elementum needs to enable cross-region endpoint settings during provisioning — flag the region mismatch in your initial request.

Cross-region PrivateLink is not supported for some Snowflake platform-as-a-service traffic (for example, Amazon S3 internal stages) — see Snowflake's [AWS PrivateLink documentation](https://docs.snowflake.com/en/user-guide/admin-security-privatelink) for the current matrix.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authorization fails or token expired">
    `SYSTEM$AUTHORIZE_PRIVATELINK` and `SYSTEM$GET_PRIVATELINK` require a federated token that's still valid. The token from `aws sts get-federation-token` expires after 12 hours. Regenerate the token and re-run the Snowflake command. Confirm you used the same AWS account ID Elementum provided, with no extra whitespace or quoting issues in the JSON value.
  </Accordion>

  <Accordion title="Connection still routes over the public internet">
    Verify Elementum has finished provisioning the VPC endpoint on its side and that the CloudLink **Account URL** has been updated to the `privatelink` hostname returned by `SYSTEM$GET_PRIVATELINK_CONFIG` (it should contain `.privatelink.snowflakecomputing.com`). If the CloudLink still points at the public account URL, traffic continues to use the public route. You can also call [`SYSTEM$ALLOWLIST_PRIVATELINK`](https://docs.snowflake.com/en/sql-reference/functions/system_allowlist_privatelink) in your Snowflake account to list the hostnames that should be reachable over the private endpoint.
  </Accordion>

  <Accordion title="How do I disable PrivateLink later?">
    Generate a fresh federated token and call [`SYSTEM$REVOKE_PRIVATELINK`](https://docs.snowflake.com/en/sql-reference/functions/system_revoke_privatelink) with the same `aws_id` and `federated_token` arguments you used to authorize. Notify Elementum so the consumer-side endpoint can be removed and the CloudLink hostname can be reverted. Re-add the Elementum public IP allow list before revoking if you want to fall back to public-internet CloudLink connectivity.
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Snowflake: AWS PrivateLink" icon="snowflake" href="https://docs.snowflake.com/en/user-guide/admin-security-privatelink">
    Snowflake's reference documentation for AWS PrivateLink, including all supported system functions and limitations.
  </Card>

  <Card title="AWS: What is AWS PrivateLink?" icon="cloud" href="https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html">
    AWS overview of PrivateLink concepts, security model, and VPC endpoint architecture.
  </Card>

  <Card title="Connecting Snowflake to Elementum" icon="link" href="/administration/connect-snowflake-to-elementum">
    Complete CloudLink setup for Snowflake — service user, role, warehouse, and key-pair authentication.
  </Card>

  <Card title="CloudLink overview" icon="cloud" href="/administration/setup-cloudlink">
    How CloudLink connections work across Snowflake, BigQuery, Databricks, and REST APIs.
  </Card>
</CardGroup>