Skip to main content

​
Adding secrets

Secrets are stored within a Snowflake schema, and will be available for pipelines to reference. We recommend you use the default secrets schema, but you can specify an alternative if you wish. Both options are described below.
This includes the Snowflake private key used for key-pair authentication. Use the same commands below, with the full content of the private key (including the header and footer lines) as the SECRET_STRING value.
If you uninstall the application from Snowflake, any secrets created within the default secrets schema will be deleted.
Setting up key-pair authentication for an environment? Create the environment before creating the secrets below. The environment’s Private key secret name and Passphrase secret name drop-downs only list secrets that already exist, so they show no results if you create the secrets first.

​
Default secrets schema

The default schema for secrets is defined as <APPLICATION_NAME>.SECRETS, as seen on the configuration screen when creating the application. To create a secret in this schema, execute the following commands, using the same role you used for creating the :
Where:
  • <APPLICATION_NAME> is the name of the application set during installation. By default, this is MATILLION_DATA_PRODUCTIVITY_CLOUD.
  • <SECRET_NAME> is a unique name for the secret.
  • 'some-secret-string' is the secret value.

​
Alternative secrets schema

If you changed the Default Secrets Schema property when you configured the application, some additional configuration is required.
  1. Grant USAGE permission to the application for the following objects:
    Where:
    • <DATABASE_NAME> and <SCHEMA_NAME> identify the schema you want to use for secrets.
    • <APPLICATION_NAME> is the name of the application set during installation. By default, this is MATILLION_DATA_PRODUCTIVITY_CLOUD.
  2. To allow creation of secrets, you must also grant the following:
  3. To create secrets in the target schema, use the following commands:
    Where:
    • <SECRET_NAME> is a unique name for the secret.
    • 'some-secret-string' is the secret value.