Contact Us 1-800-596-4880
  1. Homepage
  2. Exchange
  3. Administrator Tasks
  4. Discovering and Cataloging External Services with Scanners
  5. Agent Scanners

  6. Adding a Scanner for Snowflake Cortex AI

Adding a Scanner for Snowflake Cortex AI

Add a scanner to discover, import, and sync agents from Snowflake Cortex AI into Exchange. Then you can govern the agents and consume them in other applications.

Before You Begin

Before adding the scanner, verify that you have these prerequisites:

  • Exchange Administrator permission

  • Snowflake Enterprise edition account with Cortex agents enabled

  • Snowflake user with the ACCOUNTADMIN role for one-time setup

  • Snowflake account URL

  • Snowflake programmatic access token (PAT) generated during one-time setup

Set Up Snowflake for the Scanner

Complete these steps once in Snowflake before adding the scanner.

After setup, the scanner authenticates as a service user with a least-privilege custom role. Use the ACCOUNTADMIN role only for the initial grants in this section.

  1. Create a custom scanner role and grant it access to Cortex agents.

    Sign in to Snowflake as a user with the ACCOUNTADMIN role and run:

    USE ROLE ACCOUNTADMIN;

CREATE ROLE ANYPOINT_SCANNER_ROLE;
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_AGENT_USER TO ROLE ANYPOINT_SCANNER_ROLE;

  2. Create or reuse a warehouse for the scanner.

    • To create a new warehouse:

      CREATE WAREHOUSE COMPUTE_WH WITH WAREHOUSE_SIZE = 'XSMALL' AUTO_SUSPEND = 60 INITIALLY_SUSPENDED = TRUE;
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE ANYPOINT_SCANNER_ROLE;

    • To reuse an existing warehouse, grant usage on it:

      GRANT USAGE ON WAREHOUSE <WAREHOUSE_NAME> TO ROLE ANYPOINT_SCANNER_ROLE;

  3. Create a service user for the scanner and assign the scanner role.

    CREATE USER ANYPOINT_SCANNER
  TYPE = SERVICE
  DEFAULT_ROLE = ANYPOINT_SCANNER_ROLE
  DEFAULT_WAREHOUSE = COMPUTE_WH;

GRANT ROLE ANYPOINT_SCANNER_ROLE TO USER ANYPOINT_SCANNER;

  4. Grant the scanner role read access to the databases and schemas that contain Cortex agents you want to scan.

    Run this block for each database and schema you want to scan, replacing <DATABASE> and <SCHEMA>:

    GRANT USAGE ON DATABASE <DATABASE> TO ROLE ANYPOINT_SCANNER_ROLE;
GRANT USAGE ON SCHEMA <DATABASE>.<SCHEMA> TO ROLE ANYPOINT_SCANNER_ROLE;
GRANT USAGE ON ALL AGENTS IN SCHEMA <DATABASE>.<SCHEMA> TO ROLE ANYPOINT_SCANNER_ROLE;
GRANT USAGE ON FUTURE AGENTS IN SCHEMA <DATABASE>.<SCHEMA> TO ROLE ANYPOINT_SCANNER_ROLE;

  5. Restrict the service user to the scanner’s egress IP ranges.

    This step reduces the service user’s attack surface. Replace <SCANNER_EGRESS_CIDRS> with the CIDR blocks that MuleSoft provides:

    CREATE NETWORK RULE ANYPOINT_SCANNER_NR
  MODE = INGRESS
  TYPE = IPV4
  VALUE_LIST = ('<SCANNER_EGRESS_CIDRS>');

CREATE NETWORK POLICY ANYPOINT_SCANNER_NP
  ALLOWED_NETWORK_RULE_LIST = (ANYPOINT_SCANNER_NR);

ALTER USER ANYPOINT_SCANNER SET NETWORK_POLICY = ANYPOINT_SCANNER_NP;

  6. Generate a programmatic access token (PAT) for the service user.

    1. In Snowsight, click Governance & security

    2. Click Users & roles.

    3. Open the ANYPOINT_SCANNER user.

    4. Click Programmatic access tokens

    5. Click Generate new token.

    6. In Name, enter anypoint_scanner.

    7. In Expires in, set an expiry that follows your secret-rotation policy.

      The Snowflake maximum is 365 days.

    8. For Role, select One specific role, and then select ANYPOINT_SCANNER_ROLE.

    9. Click Generate, and copy the token immediately.

      Snowflake displays the token only once. Use this token in the Programmatic Access Token field when you add the scanner.

Add a Scanner for Snowflake Cortex AI

  1. Verify that you are in the business group where you want to add the scanner.

  2. From the sidebar in Exchange, click Scanners.

  3. Enter a name for the scanner.

  4. From Scanner Run Configuration, complete these fields or options:

    Field/Option Value

    Run Schedule

    Select a frequency and time.

    Sync Review

    Select an option: Auto-resolve or Ask to review.

  5. From Connection Configuration, complete these fields:

    Field Value

    Provider

    Select Snowflake.

    Platform

    Select Cortex AI.

    Service Type

    Agents is selected by default.

    Authentication Method

    Service Account selected by default.

    Account URL

    Enter the account URL.

    Programmatic Access Token

    Enter the programmatic access token.

    Database Filter

    To filter by database, enter the database name, or a comma-separated list of database names.

    Schema Filter

    To filter by schema, enter the schema name, or a comma-separated list of schema names.

  6. Click Test Connection.

    If the connection fails, review the Connection Configuration settings. Update the settings, and then test the connection again.

  7. To send email notifications:

    1. Select Advanced Settings and turn on Send Email Notifications.

    2. Enter an email address.

  8. Click Add Scanner.

See Also