YAML
####################################################################################################
# Example YAML for Tot Plugin Snowflake (native API) #
# #
# This file has all the technical properties that can be edited for the client. #
# These properties have a default value in the application, #
# so there is no necessity to configure them. #
# Only configure these properties if they are going to be different to the value of this file, #
# this will make your files more clean and readable. #
####################################################################################################
#########################
### Server properties ###
#########################
server:
# the port where the service will be listening
port: 15030
#############################
### Tot Plugin properties ###
#############################
totplugin:
server:
# the tot server list of URLs, tot can have more than one instance running.
urls:
- {TOT_SERVER_URL}
connection:
- name: SF-1
# list of aris to define the different plugin functionalities
# the infrastructure/technology/zone triplet must match the one selected in Anjana when importing
aris:
- ari: "anja:totplugin:extract:/{INFRASTRUCTURE}/snowflake/{ZONE}/"
- ari: "anja:totplugin:sample:/{INFRASTRUCTURE}/snowflake/{ZONE}/"
- ari: "anja:totplugin:edit:/{INFRASTRUCTURE}/snowflake/{ZONE}/"
- ari: "anja:totplugin:im:/{INFRASTRUCTURE}/snowflake/{ZONE}/"
# the ari of the Entra ID plugin that manages groups and users for the governance
imAri: "anja:totplugin:im:/{ENTRA_ID_PATH}/"
## Connection properties
## host: the Snowflake account host, in the form {account}.snowflakecomputing.com
## warehouse: the warehouse used to run the statements sent through the Snowflake SQL API
## role: the role used to run the statements. It must be written in UPPERCASE:
## the Snowflake SQL API does not normalise it and the request fails otherwise
## timezone: time zone used by the Snowflake SQL API to format DATE/TIME/TIMESTAMP values.
## Examples: Europe/Madrid, UTC, America/Los_Angeles
## path-separator: character used to separate the parts of the path (database, schema, object)
## attribute-separator: separator used to build compound attribute names
## sample-rows: maximum number of rows returned by the sample operation
## obfuscation-string: value shown instead of the real one for sensitive fields (pi = true)
## imType: identity manager used for the governance
technology:
host: {ACCOUNT}.snowflakecomputing.com
warehouse: {WAREHOUSE}
role: {ROLE}
timezone: {TIMEZONE}
path-separator: /
attribute-separator: "_-"
sample-rows: 25
obfuscation-string: "*****"
imType: "ENTRA ID"
## OAuth2 properties, used to authenticate against Snowflake through Entra ID
## token-url: Entra ID endpoint where the access token is requested
## client-id: application registered in Entra ID for the Snowflake OAuth integration
## client-secret: secret of that application
## grant-type: OAuth2 flow. client_credentials is the one used for server to server processes
## scope: scope requested to obtain a token valid for Snowflake.
## It must end with /.default, otherwise Entra ID rejects the request
oauth:
token-url: https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token
client-id: {SNOWFLAKE_OAUTH_CLIENT_ID}
client-secret: {SNOWFLAKE_OAUTH_CLIENT_SECRET}
grant-type: client_credentials
scope: api://{SNOWFLAKE_APP_ID}/.default
## Retry policy applied to the calls to the Snowflake SQL API
## max-attempts: number of retries when a retry policy is applied
## backoff-ms: milliseconds to wait between retries
## http-statuses: HTTP codes considered transient, the only ones that are retried
## status-check-max-attempts: number of attempts to check the status of an asynchronous statement
retry:
max-attempts: 1
backoff-ms: 1000
http-statuses: 408,429,500,502,503,504
status-check-max-attempts: 60
## SCIM properties, used to provision the Entra ID groups into Snowflake as roles
## enabled: enables or disables the use of SCIM in the plugin.
## When disabled, the plugin creates the role directly in Snowflake
## tenant-id, client-id, client-secret: Entra ID application that allows calling Microsoft Graph.
## It needs the Synchronization.ReadWrite.All and Group.Read.All application permissions
## scope: scope requested to obtain a token valid for Microsoft Graph
## graph-base-url: base URL of the Microsoft Graph API
## snowflake-app-name: exact display name of the Snowflake Enterprise Application in Entra ID
## service-principal-id: Object ID of that Enterprise Application, not the one of the Graph app
## job-id: provisioning job of the Enterprise Application
## user-rule-id: synchronisation rule used to provision users on demand
## group-rule-id: synchronisation rule used to provision groups on demand
## role-sync-max-attempts: attempts to check in Snowflake that the role has been provisioned
## role-sync-backoff-ms: milliseconds to wait between those attempts
scim:
enabled: false
tenant-id: {TENANT_ID}
client-id: {GRAPH_CLIENT_ID}
client-secret: {GRAPH_CLIENT_SECRET}
scope: https://graph.microsoft.com/.default
graph-base-url: https://graph.microsoft.com/v1.0
snowflake-app-name: {ENTERPRISE_APP_NAME}
service-principal-id: {ENTERPRISE_APP_SERVICE_PRINCIPAL_ID}
job-id: {PROVISIONING_JOB_ID}
user-rule-id: {USER_PROVISION_ON_DEMAND_RULE_ID}
group-rule-id: {GROUP_PROVISION_ON_DEMAND_RULE_ID}
role-sync-max-attempts: 60
role-sync-backoff-ms: 5000
########################
## Logs properties ###
########################
logging:
pattern:
# Pattern to convert logs in the convenient format for the client
console: "%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){faint} [SNOWFLAKE] %clr(${LOG_LEVEL_PATTERN:%5p}) %clr(${PID:- }){magenta} %clr(---){faint} %clr([%15.15t]){faint} %clr(%-40.40logger{39}){cyan} %clr(:){faint} %m%n${LOG_EXCEPTION_CONVERSION_WORD:%wEx}"
# Mark the level of log to show for every package. ERROR > WARN > INFO > DEBUG > TRACE
level:
# The main log level this is the base fot all logs
root: info
# Every package of code can be marked with a different log level, every package of code printed on log is selectable to have a record here and mark a log level
com.anjana: DEBUG
#################################
### Hecate(Eureka) properties ###
#################################
eureka:
client:
serviceUrl:
# the url where Tot is listening
defaultZone: {TOT_SERVER_URL}/eureka