Hi @Brett
I have been able to create the Security Integration in our Snowflake account.
I am able to use the client_id and client_secret from this integration.
So, with this command SYSTEM$SHOW_OAUTH_CLIENT_SECRETS(‘QUICKSIGHT_OAUTH’) I am able to get the values of the following variables:
- OAUTH_CLIENT_ID -
- OAUTH_REDIRECT_URI - https://signin.aws.amazon.com/oauth
- OAUTH_AUTHORIZATION_ENDPOINT - https://account-name.snowflakecomputing.com/oauth/authorize
- OAUTH_TOKEN_ENDPOINT - https://account-name.snowflakecomputing.com/oauth/token-request
I URL encoded OAUTH_CLIENT_ID and OAUTH_REDIRECT_URI
prepared the Authorization URL -
https://account-name.snowflakecomputing.com/oauth/authorize?response_type=code&client_id=<url_encoded_ OAUTH_CLIENT_ID>&redirect_uri=https%3A%2F%2Fsignin.aws.amazon.com%2Foauth
POST request to the above URL with the username and pwd of the Quicksight User created in Snowflake.
After successful authentication, the redirect_uri showed up with a code
like this
used that code to generate an access token using
curl -X POST -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8" \
--user "<OAUTH_CLIENT_ID not encoded>:<OAUTH_CLIENT_SECRET>" \
--data-urlencode "grant_type=authorization_code" \
--data-urlencode "code=<code>" \
--data-urlencode "redirect_uri=<OAUTH_REDIRECT_URI not encoded>" \
<OAUTH_TOKEN_ENDPOINT>
I can confirm I am able to use the refresh token in the response to generate new access_tokens and use it in snowsql like -
snowsql -a account name -u quicksightuser --rolename role-name --authenticator oauth --token "access_token"
I guess the next step is to be able to pass these values in the CreateDataSource API payload, right ? The documentation I am following is this -
Here are my input parameters -
- DataSourceParameters -
{
"SnowflakeParameters": {
"Host": "accountname.snowflakecomputing.com",
"Database": "db_name",
"Warehouse": "wh_name",
"AuthenticationType": "TOKEN",
"OAuthParameters": {
"TokenProviderUrl": "https://account-name.snowflakecomputing.com/oauth/token-request"
}
}
}
- Credentials - This is the secret ARN, the QuickSight service role has been granted access to read this Secret. (The Secret contains the username of the Quicksight user, client_id and client_secret as advised here
{
"SecretArn": "arn:aws:secretsmanager:region:account-id:secret:Snowflake-NonProd-C9sZBF"
}
- API call
aws quicksight create-data-source --aws-account-id account-id --data-source-id "snowflake-oauth" --name "Snowflake-Oauth-test" --type "SNOWFLAKE" --data-source-parameters file://data-source-parameters.json --credentials file://credentials.json
- I see this error when I try to describe the data-source
{
"Status": 200,
"DataSource": {
"Arn": "arn:aws:quicksight:region:id:datasource/snowflake-oauth",
"DataSourceId": "snowflake-oauth",
"Name": "Snowflake-Oauth-test",
"Type": "SNOWFLAKE",
"Status": "CREATION_FAILED",
"CreatedTime": "2025-04-04T16:15:00.258000+05:30",
"LastUpdatedTime": "2025-04-04T16:15:01.767000+05:30",
"DataSourceParameters": {
"SnowflakeParameters": {
"Host": "redacted",
"Database": "redacted",
"Warehouse": "redacted",
"AuthenticationType": "TOKEN",
"DatabaseAccessControlRole": "redacted",
"OAuthParameters": {
"TokenProviderUrl": "https://accountname.snowflakecomputing.com/oauth/token"
}
}
},
"SslProperties": {
"DisableSsl": false
},
"ErrorInfo": {
"Type": "GENERIC_SQL_FAILURE",
"Message": "A JSONObject text must begin with '{' at 1 [character 2 line 1]"
},
"SecretArn": "arn:aws:secretsmanager:region:id:secret:Snowflake-NonProd"
},
"RequestId": ""
}
I must be missing to provide some values in the CreateDataSource API call. Like the OAuthParameters etc.
Please advise!
