How to grant usage on an integration #251

MartinCairnsSQL · 2025-10-16T14:48:34Z

MartinCairnsSQL
Oct 16, 2025

Hi,

I'm trying to grant usage on an integration via a technical role but I'm having trouble. I'm using SnowDDL 0.58.2

using this in the techole_role.yaml

openflow_monitoring:
  grants:
    INTEGRATION:MONITOR:
      - OPENFLOW_DATAPLANE

I get this error

2025-10-16 15:33:05.595 - WARNING - Failed to validate config for [TechnicalRoleBlueprint] with name [OPENFLOW_MONITORING__T_ROLE]
Traceback (most recent call last):
  File "C:\Users\m_cairns\source\repos\tpicap_dataservices\venv\Lib\site-packages\snowddl\validator\abc_validator.py", line 25, in validate
    self.validate_blueprint(bp)
  File "C:\Users\m_cairns\source\repos\tpicap_dataservices\venv\Lib\site-packages\snowddl\validator\technical_role.py", line 10, in validate_blueprint
    self._validate_grant_patterns(bp)
  File "C:\Users\m_cairns\source\repos\tpicap_dataservices\venv\Lib\site-packages\snowddl\validator\technical_role.py", line 15, in _validate_grant_patterns
    if not self.config.get_blueprints_by_type_and_pattern(grant_pattern.on.blueprint_cls, grant_pattern.pattern):
                                                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\m_cairns\source\repos\tpicap_dataservices\venv\Lib\site-packages\snowddl\blueprint\object_type.py", line 369, in blueprint_cls
    return getattr(blueprint, self.value.get("blueprint_cls"))
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: attribute name must be string, not 'NoneType'

2025-10-16 15:33:05.595 - ERROR - Execution halted due to [1] error(s) in config validators

littleK0i · 2025-10-16T15:15:28Z

littleK0i
Oct 16, 2025
Maintainer

Integrations are a bit weird, since they all share INTEGRATION grant, while technically being different object types.

Most use cases should be covered automatically or by owner_integration_usage parameter on specific schema roles: https://docs.snowddl.com/basic/yaml-configs/schema

If it is not enough, I need to know a bit more about the integration type and specific use case.

Also, global_role is always an option. Anything can be granted to global role, which can be granted to business role later on.

2 replies

MartinCairnsSQL Oct 17, 2025
Author

The integration grants are for Snowflake Openflow so OPENFLOW_DATA_PLANE & OPENFLOW_RUNTIME, the different privileges allow different tasks to be done so MONITOR on the OPENFLOW_RUNTIME allows read-only viewing the dataflow graph.

Examples columns from SHOW GRANTS TO ROLE to a U_ROLE after using the Snowsight UI to grant access to Openflow.

privilege	granted_on	name	granted_to
MONITOR	INTEGRATION	OPENFLOW_DATAPLANE_1	ROLE
OPERATE	INTEGRATION	OPENFLOW_DATAPLANE_1	ROLE
USAGE	INTEGRATION	OPENFLOW_DATAPLANE_1	ROLE
MONITOR	INTEGRATION	OPENFLOW_RUNTIME_2	ROLE
USAGE	ROLE	SUPPORT_TEAM__B_ROLE	ROLE

littleK0i Oct 17, 2025
Maintainer

Hmm. It seems, OpenFlow introduced some new privileges for integrations. Previously it was only "USAGE" for everything, but now it is also "MONITOR" and "OPERATE". Afaik, it was never seen before.

Ok, right now the "global role" path is the best. Simply define a global role manually and give it either to:

owner_global_roles of SCHEMA (required for TASKS, FUNCTIONS, PROCEDURE to work properly);
global_roles of BUSINESS_ROLE (required for USER);

This should do the trick for now. And it will cover all other custom grants you may encounter.

I am not sure if implementing full support for OpenFlow is viable right now. In general, I do not think OpenFlow will see a wide adoption. In its current form it goes against everything Snowflake stands for. It is not simple, it is not fast.

I suspect, they will replace it with something else soon, or lean into APPLICATIONS more heavily.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

How to grant usage on an integration #251

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

littleK0i
Oct 16, 2025
Maintainer

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

How to grant usage on an integration #251

Uh oh!

MartinCairnsSQL Oct 16, 2025

Replies: 1 comment · 2 replies

Uh oh!

littleK0i Oct 16, 2025 Maintainer

Uh oh!

MartinCairnsSQL Oct 17, 2025 Author

Uh oh!

littleK0i Oct 17, 2025 Maintainer

MartinCairnsSQL
Oct 16, 2025

Replies: 1 comment 2 replies

littleK0i
Oct 16, 2025
Maintainer

MartinCairnsSQL Oct 17, 2025
Author

littleK0i Oct 17, 2025
Maintainer