You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "rorydonaldson (via GitHub)" <gi...@apache.org> on 2025/08/27 10:50:04 UTC
[I] Add support for Snowflake Workload Identity Federation [airflow]
rorydonaldson opened a new issue, #54983:
URL: https://github.com/apache/airflow/issues/54983
### Description
Snowflake now supports Workload Identity Federation, and we want this to be usable for connections in airflow.
https://docs.snowflake.com/en/user-guide/workload-identity-federation
### Use case/motivation
Current snowflake connections rely on password or private key authentication.
When Airflow is running in a cloud environment e.g. AWS, Azure, we want to utilise WIF connections, removing the need to manage and store long-lived credentials
### Related issues
_No response_
### Are you willing to submit a PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add support for Snowflake Workload Identity Federation [airflow]
Posted by "Arup-Chauhan (via GitHub)" <gi...@apache.org>.
Arup-Chauhan commented on issue #54983:
URL: https://github.com/apache/airflow/issues/54983#issuecomment-3229988540
HI @jroachgolf84 can I work on this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add support for Snowflake Workload Identity Federation [airflow]
Posted by "Arup-Chauhan (via GitHub)" <gi...@apache.org>.
Arup-Chauhan commented on issue #54983:
URL: https://github.com/apache/airflow/issues/54983#issuecomment-3230043271
@jroachgolf84 thanks a lot for assigning! Can I open a draft PR to talk about it?
Since it involves multiple cloud providers as you mentioned, I will need some guidance!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add support for Snowflake Workload Identity Federation [airflow]
Posted by "jroachgolf84 (via GitHub)" <gi...@apache.org>.
jroachgolf84 commented on issue #54983:
URL: https://github.com/apache/airflow/issues/54983#issuecomment-3230048070
Please do! I'd recommend starting with one provider, then going from there.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add support for Snowflake Workload Identity Federation [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #54983:
URL: https://github.com/apache/airflow/issues/54983#issuecomment-3227696202
Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add support for Snowflake Workload Identity Federation [airflow]
Posted by "raphaelauv (via GitHub)" <gi...@apache.org>.
raphaelauv commented on issue #54983:
URL: https://github.com/apache/airflow/issues/54983#issuecomment-5293697715
this is a working example of using snowflake OIDC with SQLExecuteQueryOperator
apache-airflow==3.3.1
apache-airflow-providers-snowflake==6.16.0
snowflake user :
```sql
CREATE USER AIRFLOW_WIF_USER
TYPE = SERVICE
WORKLOAD_IDENTITY = (
TYPE = AWS
ARN = 'arn:aws:iam::XXXXXXXXXXX:role/airflow-snowflake-wif'
)
DEFAULT_ROLE = AAAAAAAAAAA
DEFAULT_WAREHOUSE = YYYYYYYY
COMMENT = 'Airflow WIF Service Account via EKS';
GRANT ROLE AAAAAAAAAAA TO USER AIRFLOW_WIF_USER;
```
airflow connection for snowflake/sql operator:
```json
{
"account": "mbXXXXX",
"warehouse": "YYYYYYYY",
"database": "MMMMMMMMMM",
"role": "AAAAAAAAAAA",
"workload_identity_provider": "AWS",
"schema": "PUBLIC",
"authenticator": "WORKLOAD_IDENTITY",
"region": "eu-west-3.aws"
}
```
```python
from airflow.providers.common.sql.operators.sql import SQLExecuteQueryOperator
from airflow.sdk import DAG, CronDataIntervalTimetable, timezone
with DAG(
dag_id="test_dag",
schedule=CronDataIntervalTimetable("0 0 1 * *", "Europe/Paris"),
start_date=timezone.parse("2026-07-05T00:00:00", "Europe/Paris"),
catchup=False,
):
SQLExecuteQueryOperator(
task_id="test_query",
conn_id="snowflake_wif_conn",
sql="SELECT CURRENT_USER(), CURRENT_ROLE(), CURRENT_WAREHOUSE();",
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add support for Snowflake Workload Identity Federation [airflow]
Posted by "carlpinto25 (via GitHub)" <gi...@apache.org>.
carlpinto25 commented on issue #54983:
URL: https://github.com/apache/airflow/issues/54983#issuecomment-3229499393
Hi, can i work on this
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add support for Snowflake Workload Identity Federation [airflow]
Posted by "kaxil (via GitHub)" <gi...@apache.org>.
kaxil closed issue #54983: Add support for Snowflake Workload Identity Federation
URL: https://github.com/apache/airflow/issues/54983
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add support for Snowflake Workload Identity Federation [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on issue #54983:
URL: https://github.com/apache/airflow/issues/54983#issuecomment-3986439494
@arup-chauhan We are unassigning you from this issue as part of our updated [assignment policy](https://github.com/apache/airflow/blob/main/contributing-docs/04_how_to_contribute.rst#contribute-code-changes).
This is not meant to discourage your contribution — quite the opposite! You are still very welcome to work on this issue and submit a PR for it. Simply comment that you are working on it and open a PR when ready.
We found that formal assignments were not working well, as they often prevented others from contributing when the assignee was not actively working on the issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add support for Snowflake Workload Identity Federation [airflow]
Posted by "arup-chauhan (via GitHub)" <gi...@apache.org>.
arup-chauhan commented on issue #54983:
URL: https://github.com/apache/airflow/issues/54983#issuecomment-3987021762
Hey @potiuk, completely understandable, whatever makes the project flow smoother!
I marked my last PR as ready for review. I would love to get some feedback, so I can get started with the next one.
Have to wrap this one soon
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Add support for Snowflake Workload Identity Federation [airflow]
Posted by "jroachgolf84 (via GitHub)" <gi...@apache.org>.
jroachgolf84 commented on issue #54983:
URL: https://github.com/apache/airflow/issues/54983#issuecomment-3227932640
This is a good first issue! I think that it might make sense to split up a PR/create multiple issues for each Cloud Provider. If you take a peek at the docs, it seems the change is quite manageable. We'd need to add two parameters to the `SnowflakeHook` (if they aren't already there), then add some docs about the connection type that should be used.
```python
import os
import snowflake.connector
conn = snowflake.connector.connect(
account='<snowflake_account>',
authenticator='WORKLOAD_IDENTITY',
workload_identity_provider='AWS'
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org