Configure Snowflake Trust Relationship for Clean Room Identity Boost

Set Up Your Snowflake Environment

1. In your Snowflake worksheet, open the SQL Editor and complete these tasks to set up the data containers, permissions, and service user.
   

   Note These code examples are for guidance only. Test and validate all code in a sandbox before using it in production.
2. Create a dedicated database and schema for this customer so that their data stays isolated from other collaborations.

   CREATE DATABASE CUSTOMER_DB;
   CREATE SCHEMA CUSTOMER_DB.ENRICHED_OUTPUT;

   Note the database and schema names — you enter them in Data 360 when accepting the invitation.

3. Create the output tables.

   These are the tables that your enrichment job writes to. Define all column names in double quotes to preserve case. Without double quotes, Snowflake automatically uppercases column names, which causes errors when Data 360 reads the tables.

   

   Important Define a primary key on each output table. Data 360 reads primary-key metadata when it discovers your tables, and the collaboration can't become active if any output table is missing a primary key. For the email and phone tables, define the primary key on the contact-point value column rather than the party ID, because a party ID can repeat across records.

   -- 1. Bridge Table: links consumer Individual IDs to your internal IDs
   CREATE OR REPLACE TABLE CUSTOMER_DB.ENRICHED_OUTPUT.PartnerIndBridgeTable (
     "SourceId"            VARCHAR(255),  -- Consumer's Individual ID
     "PartnerIndividualId" VARCHAR(255)   -- Your internal unique identifier
   );
   
   -- 2. Individual Table: enriched name and identity attributes
   CREATE OR REPLACE TABLE CUSTOMER_DB.ENRICHED_OUTPUT.PartnerBoostedIndividualTable (
     "IndividualId"        VARCHAR(255),  -- Matches PartnerIndividualId in bridge table
     "ssot__FirstName__c"  VARCHAR(255),
     "ssot__LastName__c"   VARCHAR(255),
     "EnrichmentTimestamp" TIMESTAMP_NTZ
   );
   
   -- 3. Email Table: enriched email addresses
   CREATE OR REPLACE TABLE CUSTOMER_DB.ENRICHED_OUTPUT.PartnerBoostedEmailTable (
     "PartyId"             VARCHAR(255),  -- Links to IndividualId in table 2
     "EnrichedEmail"       VARCHAR(255),
     "EnrichmentTimestamp" TIMESTAMP_NTZ
   );
   
   -- 4. Phone Table: enriched phone numbers
   CREATE OR REPLACE TABLE CUSTOMER_DB.ENRICHED_OUTPUT.PartnerBoostedPhoneTable (
     "PartyId"             VARCHAR(255),  -- Links to IndividualId in table 2
     "EnrichedPhone"       VARCHAR(50),
     "EnrichmentTimestamp" TIMESTAMP_NTZ
   );

   

   Note The table names shown here are examples. Use the actual names declared in the additional metadata JSON you provide when accepting the invitation. Data 360 uses the objectApiName values in that JSON to find the tables in your Snowflake schema.
4. Deploy your enrichment job and configure it to target this customer's schema.

   Set up your job code to read from the Snowflake data share that Data 360 creates in your environment after acceptance, run identity resolution against your identity graph, and write enriched output to the database and schema you created.

   Don't run the job yet — the consumer's data is not available in your Snowflake environment until after you accept the invitation in Data 360.

   

   Note If you use a single Snowflake account for multiple customers, the enrichment job can access all databases in that account. Scope the job's execution role strictly to this customer's database and schema, and regularly audit role grants to confirm no cross-customer access.
5. Create a dedicated role for Data 360.

   A dedicated role is a named set of permissions that you assign to the Snowflake OIDC service user.

   CREATE ROLE IF NOT EXISTS DATACLOUD_SF_ROLE;

6. Grant the role access to a warehouse, database, and schema.

   To see the warehouses available in your account, go to Admin > Warehouses in the Snowflake console and note the name of the warehouse you want to use. These commands give the role permission to use the warehouse and to access this customer's database and schema.

   GRANT USAGE ON WAREHOUSE MY_WH TO ROLE DATACLOUD_SF_ROLE;
   GRANT USAGE ON DATABASE CUSTOMER_DB TO ROLE DATACLOUD_SF_ROLE;
   GRANT USAGE ON SCHEMA CUSTOMER_DB.ENRICHED_OUTPUT TO ROLE DATACLOUD_SF_ROLE;

   Replace MY_WH with the warehouse name, CUSTOMER_DB with the database you created, and ENRICHED_OUTPUT with the schema you created. Note the warehouse name — you enter it in Data 360 when accepting the invitation.

7. Grant the role permission to read the output tables.

   Data 360 reads the enriched output tables after the enrichment job runs to create the enriched DMOs in the consumer's org. These grants give the role SELECT access on all output tables — both your existing tables and any tables that you create later.

   GRANT SELECT ON ALL TABLES IN SCHEMA CUSTOMER_DB.ENRICHED_OUTPUT TO ROLE DATACLOUD_SF_ROLE;
   GRANT SELECT ON FUTURE TABLES IN SCHEMA CUSTOMER_DB.ENRICHED_OUTPUT TO ROLE DATACLOUD_SF_ROLE;

8. Create a service user with Workload Identity Federation (OIDC) trust.

   This is a dedicated Snowflake user that Data 360 uses to connect to your Snowflake account and read the enriched output tables. Unlike a regular user, it has no password — instead, it trusts login tokens issued by the consumer's Salesforce org. Only Data 360, authenticated as that specific consumer's org, can log in as this user.

   Use the External ID and Consumer Salesforce Domain URL that you noted in the Before you begin section.

   CREATE OR REPLACE USER sf_oidc_user
     WORKLOAD_IDENTITY =
     (
       TYPE = OIDC
       ISSUER = 'https://yourcompany.my.salesforce.com/services/connectors'
       SUBJECT = 'your-external-id'
       OIDC_AUDIENCE_LIST = ('https://yourcompany.my.salesforce.com')
     )
     TYPE = SERVICE
     DEFAULT_ROLE = DATACLOUD_SF_ROLE;

   • ISSUER — Enter the Consumer Salesforce Domain URL followed by /services/connectors. This tells Snowflake which Salesforce org can issue login tokens for this user. For example, https://yourcompany.my.salesforce.com/services/connectors.
   • SUBJECT — Enter the External ID. This pins the trust to this specific collaboration — even if the same Salesforce org sends a token, that token can't access a different customer's data.
   • OIDC_AUDIENCE_LIST — Enter the Consumer Salesforce Domain URL without a path suffix. For example, https://yourcompany.my.salesforce.com.

   

   Note Create a service user — don't convert an existing user. Changing an existing Snowflake user to a service user removes that person's ability to log in to Snowflake interactively and mixes their day-to-day permissions with machine access. Doing so makes the account harder to audit and harder to revoke. A dedicated service user keeps Data 360's access fully isolated and easy to remove. If you use a single Snowflake account for multiple customers, include the customer name in the service username to avoid conflicts — for example, Customer1_DC_User.

   Note the service username — you enter it in Data 360 when accepting the invitation.

9. Assign the role to the service user.

   GRANT ROLE DATACLOUD_SF_ROLE TO USER sf_oidc_user;

   The service user has the permissions that you set up.
10. Before moving to Data 360, confirm that you have these values from your Snowflake environment — you enter them in the acceptance wizard.

    Field in Data 360	Value in Snowflake
    Snowflake Account URL	The full URL of your Snowflake account, for example, https://myorg.snowflakecomputing.com
    Service User	The name you gave the service user
    Data Warehouse Name	The warehouse name that you used
    Database Name	The database name that you created
    Schema Name	The schema name that you created

Accept the Collaboration Invite in Data 360

11. Return to the Accept Clean Room Collaboration Invitation wizard in Data 360 and complete these acceptance steps: select a data space, and then create or select a mapped template.
12. In the Snowflake Trust Relationship section, verify that the External ID and Consumer Salesforce Domain URL values shown on the page match what you used in the SUBJECT and ISSUER fields when creating the service user in Snowflake.
    These values are read-only. Data 360 shows them here so that you can confirm that your Snowflake setup is correct before you proceed.
13. In the Snowflake Connection Settings section, enter the values you noted in the setup steps.
    • Snowflake Account URL: the full URL of your Snowflake account, for example, https://myorg.snowflakecomputing.com
    • Service User: the name of the service user you created in Snowflake
    • Data Warehouse Name: the warehouse name associated with the service user
    • Database Name: the database that you created in Snowflake
    • Schema Name: the schema that you created in Snowflake
14. Click Test Connection.

    Data 360 attempts to connect to your Snowflake account using the service user. If the test fails, check that the SUBJECT and ISSUER values in your Snowflake service user exactly match the External ID and Consumer Salesforce Domain URL shown on the page. Also check that your Snowflake account is in a region compatible with the consumer's Data 360 region.

15. Click Next and accept the invitation.