About

This guide explains how to set up a Snowflake integration using a Snowflake Native App (SNA).

More specifically, this deployment presents an alternative option to the connection process outlined here, with the following benefits:

1. No Snowflake credentials are stored in the Monte Carlo Cloud.
2. Connectivity is initiated from your Snowflake account to Monte Carlo.
3. No cloud deployments (e.g., in AWS or Azure) are needed, as the agent is hosted in Snowflake as a Native App.
4. You may be able to use Snowflake credits for Monte Carlo. Contact your Monte Carlo and Snowflake representatives for more information.

To learn more about why you should connect Snowflake to Monte Carlo, visit this link.

To learn more about this SNA agent, explore the public repository here or review the FAQs below.

When you are ready to deploy, please be sure to review the requirements and follow the installation steps here.

Requirements

• Monte Carlo Role and Subscription: You must have the Account Owner role in Monte Carlo. Additionally, your account must be subscribed to either the Scale or Enterprise tier with the Advanced Networking add-on.
• Snowflake Admin: Administrative access to Snowflake is necessary for the setup. Furthermore, SNA with containers has certain limitations, such as which Snowflake clouds are supported. Please refer to the Snowflake documentation here for more details.

Installation

👍

If you wish to connect to Snowflake using an SNA deployment during the preview, please reach out to your account representative to enable it in your account. Learn more about lifecycles here.

This guide outlines how to setup an SNA agent with data store in your Snowflake account.

It is highly recommended to review the FAQs before proceeding.

Steps

1. Create a Snowflake integration
   Navigate to the Integrations tab in the Monte Carlo UI and select the option to create a new Snowflake integration from the menu. Note that if this is your first integration, you can also select the Snowflake icon from the onboarding wizard, as shown below:

   

2. Setup the Snowflake integration
   Select "Snowflake Native App" as the deployment model, fill in the on-screen information, and select "Create" when you are done. If you don't see this option, you might not have the correct subscription, or it might not be enabled in your account. If this is the case, please reach out to your account representative.

   

   Note that the integration will be labeled as disabled. This is expected until after the SNA agent is installed and fully configured.

3. Generate integration keys
   The UI should then prompt you to generate integration keys for use with the SNA. Select "Generate integration key" and save your key ID and token in a safe place. You will need them in subsequent steps, as the token will no longer be accessible from Monte Carlo after you close this window. You can always generate a new token if needed. The FAQs outline how to replace the token in the SNA after this initial setup.

   

   If the UI doesn't automatically prompt you to generate a key, you can navigate to the "Manage keys" option in the kebab (vertical triple dot) menu for the connection you want to set up and continue to generate the integration key from there.

   

4. Setup the Application
   Navigate to your Snowflake account and open Snowsight (the Snowflake web interface).
   
   Next, create a new worksheet, copy the setup script, and, after reviewing it, execute it as illustrated below:

   

   If you prefer, you can also use the Snowflake CLI or any tool of your choice to execute the script.
   
   As always, you can learn more about this script and other app details here.

5. Setup the Permissions
   From your Snowflake account, create a new worksheet and, after reviewing it, copy the permissions script. Next, update the script to include the database you wish to monitor, and then execute it. To monitor multiple databases, you can run the script multiple times, specifying a new database name each time as illustrated below:

   

   If you prefer, you can also use the Snowflake CLI or any tool of your choice to execute the script.
   
   As always, you can learn more about this script and other app details here.

6. Install the SNA Agent
   Navigate to the Snowflake Marketplace and install the MCD Snowflake Agent.
   
   Your account representative will provide you with a link if you do not already have one.

7. Activate the SNA Agent
   Open the agent and follow the on-screen wizard to activate it. First, review and grant account privileges. Then, review and connect to the artemis.getmontecarlo.com:443 endpoint.

   

8. Add Privileges to objects
   Before launching the app, you will need to add "Execute Query Stored Procedure" usage privileges to the MCD_AGENT_HELPER.MCD_AGENT.MCD_AGENT_EXECUTE_QUERY procedure for the app. This can be done from the "Privileges to Objects" subsection of the app, as shown below:

   

   

9. Launch the App
   Launch the app. Once this is complete, you should see a screen like the one shown below:

   

   If the app does not open, ensure you are logged in with the correct user account that has the necessary permissions to access it.

10. Update the token
    Select the "Update Token" button and enter the key ID and key secret you saved in step #3. Press "Update" to proceed, as illustrated below:

    

    The application will begin starting up after. Note that the first startup might take 5-10 minutes to allocate compute resources, so it’s a good time to grab a snack if you’d like.

11. Test status
    After 5-10 minutes have passed, select the "Container Status" button. This should display the following message when the application is ready:

    

    After this, it is a good idea to run a reachability test by selecting the corresponding button. This will confirm that the SNA agent can access Monte Carlo, and a successful connection will display an "ok:true" status, as illustrated below:

    

12. Enable the connection

    Navigate back to the Integrations tab or the onboarding wizard in the Monte Carlo UI, and select the "Edit" option in the kebab (triple vertical dot) menu for the relevant connection as illustrated below:

    

    From there, select "Enable Connection" as shown below:

    

    Then run the tests as show below:

    

    If the tests pass, your connection should be shown as "enabled," allowing you to proceed with using the integration as normal in the Monte Carlo platform. This can include setting up monitoring rules, creating monitors, reviewing assets, managing alerts, and other tasks.

FAQs

What integrations does the SNA Agent support?

The SNA agent supports only Snowflake across all available public clouds that are compatible with the Snowflake Native App Framework (with containers).

How can I add a non-Snowflake integration if I have an SNA agent deployment?

Monte Carlo supports multiple deployment options, which means you can have an SNA agent in addition to an AWS agent, Azure data store, etc.

You can start by reviewing all available options here. Then, reach out to [email protected] or contact your account representative if you would like to add a new deployment.

What if I have multiple Snowflake accounts? Can I use more than one SNA Agent?

Each Snowflake account can only have one SNA agent, but if you have more than one Snowflake account, you can install one agent per account.

Please reach out to [email protected] or contact your account representative to enable this.

Can I Migrate from an SNA Agent to another deployment option, or vice versa?

Yes! Please reach out to [email protected] or contact your account representative for assistance.

Can I review agent resources and code?

Absolutely! You can find details here:

The Application README provides a summary of the application permissions, objects created, and other necessary information to run the SNA agent.

These diagrams also provide pictorial examples of the high-level architecture and workflows.

Does the SNA Agent differ from a Monte Carlo Agent I can deploy in a public cloud?

The SNA agent is closely analogous to a "Hybrid: Customer-hosted Agent & Data Store Deployment," as the SNA application is a flavor of the Monte Carlo agent installed in Snowflake, rather than directly in a public cloud like AWS, Azure, or GCP. An internal Snowflake stage is used as a data store, and this deployment is designed to connect only to individual Snowflake accounts.

Key differences include:

1. Connectivity is initiated from the agent instead of from Monte Carlo.
2. No Snowflake credentials are stored in the Monte Carlo cloud.
3. Only Snowflake is supported, although you can still use other deployment options if you wish to connect more integrations.
4. You may be able to use Snowflake credits for Monte Carlo.

How do I manage network connectivity for the SNA Agent?

The SNA agent connects to Monte Carlo at artemis.getmontecarlo.com:443.

If you need to allowlist this, the following two IP addresses should be added to your outbound network policy in Snowflake:

• 34.192.158.164
• 18.232.212.157

Note that this differs from the networking overview and public IPs for other deployments, which are outlined here.

Can I disable remote changes to the SNA agent?

By default, remote changes, such as updating the execution properties of the agent, are enabled. You can disable this feature by reaching out to [email protected] or your account representative.

Please note that remote changes differ from application patches, which are applied by Snowflake. Disabling remote changes might increase the maintenance required for the agent.

How do I restart the SNA agent?

You can restart the SNA agent in your Snowflake account using the following command:

CALL MCD_AGENT.APP_PUBLIC.RESTART_SERVICE();

Please ensure that you have sufficient privileges, and note that executing this command may result in some downtime, typically lasting a few seconds

How do I validate reachability to Monte Carlo from my SNA agent?

You can verify reachability to Monte Carlo by selecting the corresponding button in the app's Streamlit UI. This action will confirm that the SNA agent can access Monte Carlo, and a successful connection will display an 'ok:true' status, as illustrated below:

How do I update the integration key for my SNA agent?

You can update the integration key (token) by following these steps:

1. Navigate to the corresponding Snowflake integration in the Monte Carlo UI (link) and select the 'Manage keys' option from the kebab (vertical triple dot) menu for the connection.
   
   Generate a new key and save the details. Importantly, do not revoke the existing key until all the following steps are complete, as doing so would result in downtime since the SNA agent would no longer be able to access Monte Carlo.

   

2. Navigate to the Streamlit UI in your Snowflake account for the SNA agent. Select 'Update Token' and enter the new ID and secret you saved in step #1. Press 'Update' to proceed, as illustrated below:

   

   If you prefer, you can use the following stored procedure in your Snowflake account instead:

   SQL

   CALL MCD_AGENT.APP_PUBLIC.UPDATE_TOKEN('KEY_ID', 'KEY_SECRET');
   

3. Restart your SNA agent as documented here.

4. Verify reachability to Monte Carlo as documented here. If this is confirmed you can revoke any old tokens.

Can I change the default warehouse size used by the SNA agent?

Yes! With the app_admin application role, you can use the following procedure to update the size:

CALL MCD_AGENT.APP_PUBLIC.SETUP_APP(wh_size => 'small')

Can I use more than one warehouse with the SNA agent?

Yes! If you want to use a different warehouse for certain monitors or jobs, you can do so. Please reach out to [email protected] or contact your account representative to enable this feature.

How do I review logs for the SNA agent?

You can review logs in Monte Carlo by selecting the corresponding button in the app's Streamlit UI. Alternatively, if you prefer, you can run the following stored procedure in your Snowflake account to retrieve the last 500 logs:

CALL MCD_AGENT.APP_PUBLIC.SERVICE_LOGS(500);

These operations require the app_user application role.