AWS PrivateLink Setup Guide

Provision a RelationalAI Rel app instance that connects to your Snowflake account over AWS PrivateLink, so traffic stays off the public internet and your users reach Rel app privately from your AWS VPC. This guide covers the details you send us, the SQL script a Snowflake admin runs, and the network policy update that completes the connection. You never share credentials or AWS access with us.

Prerequisites

• An AWS account with a VPC.
• A Snowflake user with the ACCOUNTADMIN role.
• A Snowflake user who owns the network policy that applies to the Rel app Snowflake user.

Set up AWS PrivateLink

Complete the following steps:

1. Send us your instance details

   Send us the following:

   • Your 12-digit AWS account ID.
   • Your VPC region, such as us-west-2 or us-east-1. This should be the same region as your Snowflake account.
   • The email addresses of the people who should have admin access to the instance.
   • The people who can log in, as individual email addresses or whole domains such as example.com.

2. Connect your network to Rel app

   After we provision your instance, we send you a service name, a hostname, and an Availability Zone (AZ) ID. Then do the following in your AWS account:

   • Create an interface endpoint in your VPC to the service name we send.
   • Set up internal DNS for the hostname.

3. Run the Snowflake authorization script

   We send you a SQL script. The script contains a short-lived token, so keep it out of tickets and general chat. If the token expires, we send a new one.

   Then do the following:

   • Have a Snowflake ACCOUNTADMIN review and run the script.
   • Send us the complete JSON returned by SYSTEM$GET_PRIVATELINK_CONFIG() as text, not a screenshot.

   The token lets your Snowflake account confirm that we own the AWS account connecting to it. It grants no permissions. We use the JSON to create our private endpoint to your Snowflake account.

4. Allow our endpoint in your Snowflake network policy

   We send you our endpoint ID, which starts with vpce-. Have your Snowflake policy owner identify the network policy that applies to the Rel app Snowflake user.

   Create a network rule for the endpoint and add it to that policy:

   CREATE NETWORK RULE <rule_name>
     TYPE = AWSVPCEID
     VALUE_LIST = ('vpce-...');
   
   ALTER NETWORK POLICY <policy_name>
     ADD ALLOWED_NETWORK_RULE_LIST = <rule_name>;

   Then confirm to us that you added the endpoint, or that no network policy applies.

5. Open Rel app

   From a machine in your VPC, open the hostname we sent you in a browser. Rel app opens, which confirms that your network and DNS are working.

   If Rel app doesn’t open, contact your RelationalAI representative.

6. Configure Rel app

   Have your Rel app administrator open Settings and enter the following:

   • The Snowflake private account name, which ends in .privatelink.
   • The Snowflake user, role, and warehouse.
   • The authentication value.
   • The model-storage settings.

   We recommend creating a dedicated service user with permissions only to the data you want Rel app to access. Apply any Snowflake grants the role needs.

   Enter credentials directly in Rel app. Never send them to us.