Network rule

As explained in Snowflake Data Engineering

A network rule is a Snowflake object that specifies permitted network locations and the direction and type of network traffic.

A network rule specifies permitted external network locations together with the direction and type of traffic. In an external-access pipeline, it provides the location boundary that an external access integration allows a stored procedure or UDF to reach. section 7.1 section 7.5

Configure the rule as one component of controlled external API access:

• Choose the external API host and represent it with a network rule. section 7.1
• Set the traffic mode and location type; the demonstrated rule uses EGRESS and HOST_PORT. section 7.1
• Combine the rule with a secret in an external access integration, then pass that integration to the function or procedure. section 7.1 section 7.5

Allow the Yelp API host

use role SYSADMIN; create network rule YELP_API_NETWORK_RULE mode = EGRESS type = HOST_PORT value_list = ('api.yelp.com'); section 7.1

Figure 7.1 Snowflake's external network access architecture consists of a network rule pointing to an external network location and a secret containing a token, key, or password. The network rule and secret are included as parameters when creating an external access integration object. This object is passed as a parameter to a Python function or stored procedure so that the function or procedure can call the external API.

Trace how the network rule points to an external location, joins a credential secret, and becomes part of an external access integration. section 7.1

How Snowflake Data Engineering covers it

How deep it goes

Defines location, mode, and type, then stops at integration assembly rather than API response processing.

Examples

Uses a Yelp API host with an EGRESS, HOST_PORT rule named YELP_API_NETWORK_RULE.

What it assumes

Assumes a known API endpoint and sufficient privileges to create a network rule or receive delegated access.

What you can do after

Operate/configure controlled external API access by allowing a specified host through an external access integration.

How it connects

Connects external access integrations, secrets, stored procedures, UDFs, and API endpoints.

liveBookmanning.com

Read Snowflake Data Engineering on liveBook Get the book at manning.com

Related concepts

• external access integrationused by · An external access integration is a Snowflake object that governs outbound access from Snowflake code to external network locations using specified network rules and secrets.
• external network locationconfigures · An external network location is a host or URL outside Snowflake to which network traffic may be directed.
• virtual networkconfigured by · A virtual network is a logically isolated, software-defined network that connects virtualized resources and controls communication among them and with external networks.
• Azure Key Vault firewallconfigures · The Azure Key Vault firewall is a network access control feature that restricts requests to a key vault by IP address, subnet, or trusted Azure service.
• Azure Firewall Standardconfigures · Azure Firewall Standard is a managed Azure network firewall tier that filters and controls traffic across network layers and can block destinations identified as malicious.
• public ip addressuses · A public IPv4 address is a globally unique IPv4 network address routable on the public Internet and assigned to an internet-facing resource.

This explainer was generated by Manning's knowledge graph from the text of Snowflake Data Engineering. The section links point to the parts of the book it draws on.