Snowflake for Workflows - Best practices for Grail

Latest Dynatrace
Troubleshooting
1-min read

Business events (bizevents)

By default, business events stored via the Store statement result Action of Snowflake for Workflows are stored in Grail bucket default_bizevents with a retention period of 35 days. For more details, see Built-in Grail buckets.

To manage retention and costs, and protect data, we recommend creating a dedicated bucket and setting up policies that allow data access from that bucket.

Store data in a separate bucket

Create a dedicated bucket for business events with a custom retention period. We will refer to this bucket as <bucket-name>.
Configure a business event bucket assignment with a matcher-specific DQL query, as shown in the example below.

matchesPhrase(event.type, "snowflake_connector") and matchesValue(event.provider, "data_connector")

Policies

To allow access to this bucket, create the following policies via Account Management:

Read Snowflake data policy (needed for any user that wants to read data from this bucket):

ALLOW storage:buckets:read
  WHERE storage:bucket-name = "<bucket-name>";
ALLOW storage:bizevents:read;

Write Snowflake data policy (needed for the actor of the workflow action):

ALLOW storage:buckets:read
  WHERE storage:bucket-name = "<bucket-name>";
ALLOW storage:events:write;

For more details, see Permissions in Grail.

To roll out policies on a large scale, we recommend using Dynatrace Configuration as Code (Monaco).

Lookup tables

Policies

To allow access to the lookup tables, create the following policies via Account Management:

Read Snowflake data policy (needed for any user that wants to read data from the lookup table created by the action):
```
ALLOW storage:files:read
  WHERE storage:file-path startsWith '/lookups/some-prefix-for-tables';
```

Write Snowflake data policy (needed for the actor of the workflow action):

ALLOW storage:files:write
  WHERE storage:file-path startsWith '/lookups/some-prefix-for-tables';

For more details, see Lookup data in Grail

To roll out policies on a large scale, we recommend using Dynatrace Configuration as Code (Monaco).