Issue in creating snowflake connection with AWS Appflow

Question

I am configuring a connection with snowflake in AWS Appflow. But I consistently get a error **Error while communicating to connector: The test connection request failed due to connector timed out.**. I have configured the S3 , AWS role, snowflake stage, schema, snowflake storage integration , user and password.  I am using the network iD of my snowflake account e.g., My S3 has the following permission.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAppFlowDestinationActions",
            "Effect": "Allow",
            "Principal": {
                "Service": "appflow.amazonaws.com"
            },
            "Action": [
                "s3:PutObjectAcl",
                "s3:PutObject",
                "s3:ListMultipartUploadParts",
                "s3:ListBucketMultipartUploads",
                "s3:GetBucketAcl",
                "s3:AbortMultipartUpload"
            ],
            "Resource": [
                "arn:aws:s3:::engagement-uat-sfmc-snowflake-dpp/*",
                "arn:aws:s3:::engagement-uat-sfmc-snowflake-dpp"
            ]
        }
    ]
}

And IAM role that I am using for the integration has the policy

{
    "Statement": [
        {
            "Action": [
                "s3:PutObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts",
                "s3:ListBucketMultipartUploads",
                "s3:GetBucketAcl",
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:PutObjectAcl",
                "s3:ListBucket"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::engagement-uat-sfmc-snowflake-dpp/*",
                "arn:aws:s3:::engagement-uat-sfmc-snowflake-dpp"
            ]
        }
    ],
    "Version": "2012-10-17"
}

and trust relationship
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ExternalAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::672255977428:user/kpt80000-s"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringLike": {
                    "sts:ExternalId": "UG11430_SFCRole=2_kvQW4yCPyCk6lIEF3a7n43dRN7Q="
                }
            }
        }
    ]
}

Ujjyal Sarkar · Answer

The issue is related to IPs of AWS APPFLOW that needs to be white-listed in snowflake. After adding the IPs the issue is resolved
https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html

re:Post Agent · Answer

The issue you're experiencing with creating a Snowflake connection in AWS AppFlow could be due to several factors. Here are some potential areas to check and troubleshoot:

1. Network Configuration: Ensure that your Snowflake account is accessible from AWS AppFlow. You mentioned using the network ID of your Snowflake account, but make sure it's correctly configured to allow incoming connections from AppFlow.

2. Snowflake Storage Integration: Verify that your Snowflake storage integration is properly set up and linked to the correct S3 bucket. The storage integration should have the necessary permissions to access the S3 bucket.

3. S3 Bucket Policy: Your S3 bucket policy looks correct for allowing AppFlow to perform the necessary actions. However, ensure that the bucket name in the Resource section matches exactly with the bucket you're using for the Snowflake integration.

4. IAM Role: The IAM role policy you've provided seems to have the necessary permissions for S3 access. However, make sure this role is correctly associated with your AppFlow connection.

5. Trust Relationship: The trust relationship you've shown is for an IAM user, not for the AppFlow service. For AppFlow to assume this role, you need to add the AppFlow service to the trust relationship.

6. Snowflake Connection Parameters: Double-check that you've entered all the Snowflake connection parameters correctly in AppFlow, including the account name, warehouse, database, schema, and stage name.

7. VPC and Security Groups: If you're using a VPC for your Snowflake connection, ensure that the security groups and network ACLs are configured to allow traffic between AppFlow and Snowflake.

8. Snowflake User Permissions: Verify that the Snowflake user you're using for the connection has the necessary privileges to access the specified warehouse, database, and schema.

If you've verified all these points and are still encountering the timeout error, it might be worth reaching out to AWS support for more detailed troubleshooting, as they can inspect the specific configuration in your account.

**Sources**  
[SnowflakeConnectorProfileProperties - AmazonAppFlow](https://docs.aws.amazon.com/appflow/1.0/APIReference/API_SnowflakeConnectorProfileProperties.html)  
[S3 connection to Snowflake | AWS re:Post](https://repost.aws/questions/QUFygAZOXpSTGhJN6shkI-lg/s3-connection-to-snowflake)

Arul Singh · Answer

Above answer is correct. 
Additional references:
Ensure that AppFlow's "test connection" functionality operates over the public internet rather than PrivateLink, 
[+] Verify these IP ranges in the AWS IP ranges documentation: https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html

Issue in creating snowflake connection with AWS Appflow

Add your answer

Relevant content