Snowflake Data Shares Extraction

Alation Cloud Service Applies to Alation Cloud Service instances of Alation

Customer Managed Applies to customer-managed instances of Alation

Core Connector Core connectors are included with all Alation platform tiers (subject to each tier’s connector limits) and are fully supported by Alation.

Applies from Alation version 2026.4.0.0 and Snowflake OCF Connector version 2.10.0 onwards.

Snowflake Data Shares enable secure, real-time sharing of data across Snowflake accounts without copying data. A producer publishes schemas, tables, and views, while a consumer accesses these objects in a read-only manner as if they were local.

The Snowflake OCF Connector can discover and catalog shared objects from inbound Data Shares, enabling complete visibility into shared datasets for governance and discovery.

Prerequisites

Before configuring Snowflake Data Shares extraction, ensure that you have completed the following:

  1. Set up the Snowflake account.

  2. Granted the required permissions.

  3. Met the connector requirements.

Snowflake Account Requirements

Ensure that:

  • Your Snowflake account has access to inbound Data Shares from other Snowflake accounts.

  • The shared databases are available (not revoked by the producer).

For more information on Snowflake Data Sharing, see Introduction to Secure Data Sharing.

Service Account Permissions

The Snowflake OCF Connector requires the account-level IMPORT SHARE privilege to execute the SHOW SHARES command. Without this privilege, the connector cannot discover inbound or outbound Data Shares.

Grant the following permissions to the Snowflake service account:

-- Replace <service_account_role> with your Alation service account role

-- Grant the account-level privilege required to discover Data Shares via SHOW SHARES
GRANT IMPORT SHARE ON ACCOUNT TO ROLE <service_account_role>;

-- Replace <shared_database_name> with the actual shared database name
-- Grant usage on each shared database
GRANT USAGE ON DATABASE <shared_database_name> TO ROLE <service_account_role>;

-- Grant imported privileges on each shared database
GRANT IMPORTED PRIVILEGES ON DATABASE <shared_database_name> TO ROLE <service_account_role>;

Important

GRANT IMPORT SHARE ON ACCOUNT is an account-wide privilege that is required for Data Shares discovery. GRANT USAGE and GRANT IMPORTED PRIVILEGES are scoped to each shared database and are required to read the metadata and content of a database once it has been discovered, but they do not enable discovery on their own.

Alternative Permissions (Restricted Accounts)

If your organization’s security policy does not allow granting the account-wide IMPORT SHARE privilege, Snowflake OCF Connector version 2.12.7 and higher can discover inbound shared databases using only the existing database-scoped grants:

-- Replace <shared_database_name> with the actual shared database name
GRANT USAGE ON DATABASE <shared_database_name> TO ROLE <service_account_role>;
GRANT IMPORTED PRIVILEGES ON DATABASE <shared_database_name> TO ROLE <service_account_role>;

When the connector detects that SHOW SHARES returns no inbound results, it automatically falls back to discovering imported databases through SHOW DATABASES, which only requires USAGE.

Warning

This fallback recovers inbound discovery and inbound lineage only. It cannot discover or extract lineage for outbound Data Shares — databases that your account shares out to other Snowflake accounts. Without GRANT IMPORT SHARE ON ACCOUNT, outbound shares are indistinguishable from ordinary databases via SHOW DATABASES, so cross-account lineage to consumers of your outbound shares is not captured.

If your Snowflake account only consumes shared data and does not produce shares for other accounts, this limitation does not apply to you. If your account also acts as a producer, grant IMPORT SHARE ON ACCOUNT to preserve outbound lineage; otherwise, outbound lineage will not be extracted.

Connector Requirements

Ensure that:

  • The Snowflake OCF Connector version is 2.10.0 or higher.

  • The Alation version is 2026.4.0.0 or higher.

For complete prerequisite information, see Prerequisites.

Producer Data Source Configuration

On the producer side, enabling Data Shares extraction tells the connector to extract information about outbound shares and how they map to producer objects. Alation catalogs the databases if they are not already present, or enriches them with metadata if they are. This information is needed to build cross-account lineage to consumers.

Configure your Snowflake data source as follows:

Enable Data Shares Extraction

  1. Go to the Settings page of your Snowflake producer data source.

  2. In the Metadata Extraction tab, go to the Customize extraction scope (optional) section.

  3. Turn on the Extract Data Shares toggle. This enables the connector to extract and publish Data Share metadata during metadata extraction.

Perform Metadata Extraction

  1. Go to the Metadata Extraction tab of your Snowflake producer data source.

  2. Click Run extraction. For detailed information, see Configure Metadata Extraction.

After extraction completes, the shared databases and their objects (schemas, tables, views, columns) will be cataloged in Alation. The Data Share mapping information is also extracted, which enables cross-account lineage resolution with consumer data sources.

Consumer Data Source Configuration

On the consumer side, enabling Data Shares extraction tells the connector to include shared databases in metadata extraction, alongside regular databases in the consumer account. In Alation, shared databases appear as Snowflake databases under the consumer data source, and you can browse their schemas and tables like any other database. When you also configure an upstream connection from the consumer data source to the corresponding producer data source, Alation uses the extracted share mapping to create cross-account lineage edges between producer objects and their shared counterparts in the consumer account.

Complete the following steps in order:

  1. Configure Lineage Extraction — Set up the upstream connection to the producer data source.

  2. Enable Data Shares Extraction — Turn on the Data Shares extraction toggle.

  3. Perform Metadata Extraction — Run metadata extraction.

Configure Lineage Extraction

  1. Go to the Settings page of your Snowflake consumer data source.

  2. In the Lineage Settings tab, go to the Manage Connections section.

  3. Click Add Upstream Connection, then select the Snowflake data source containing the producer database from the dropdown.

  4. Click Save.

Enable Data Shares Extraction

  1. In the Metadata Extraction tab, go to the Customize extraction scope (optional) section.

  2. Turn on the Extract Data Shares toggle. This enables the connector to discover and extract metadata from inbound shared databases.

Note

The upstream connection configuration is required to properly map lineage relationships between the producer’s shared objects and your account’s usage.

Perform Metadata Extraction

  1. Go to the Metadata Extraction tab of your Snowflake consumer data source.

  2. Click Run extraction. For detailed information, see Configure Metadata Extraction.

The extraction process will automatically include both your account’s database and any inbound shared databases.

Limitations

Metadata Extraction

  • Read-Only Access: Shared databases are inherently read-only in Snowflake. No Data Definition Language (DDL) operations can be performed on shared objects.

  • Limited Advanced Metadata: Some advanced metadata, such as stored procedures and user-defined functions, may not be available in shared databases, depending on what the producer has shared.

  • Share Dependency: If the producer revokes share access, shared objects become inaccessible during the next metadata extraction. The connector will log warnings but continue extracting other databases.

Lineage

  • Cross-Account Visibility: Lineage shows relationships within your account’s usage of shared data, but does not provide visibility into the producer’s internal processes.

  • Outbound Lineage Without IMPORT SHARE: If the service account role does not have IMPORT SHARE ON ACCOUNT and relies on the alternative permissions fallback, outbound Data Share lineage is not extracted. See Alternative Permissions (Restricted Accounts) above.

Troubleshooting

For troubleshooting Data Shares extraction issues, see Troubleshooting.