External Volumes: S3, ADLS y GCS

¿Qué es un External Volume?

Un External Volume es la configuración que le dice a Snowflake dónde y cómo escribir los archivos Iceberg en tu almacenamiento cloud. Contiene:

• URL del bucket/container
• Credenciales de acceso (role ARN, Service Principal, etc.)

AWS S3

Paso 1: Crear el External Volume

CREATE EXTERNAL VOLUME vol_s3_iceberg
  STORAGE_LOCATIONS = (
    (
      NAME = 'prod-us-east'
      STORAGE_PROVIDER = 'S3'
      STORAGE_BASE_URL = 's3://mi-empresa-datalake/iceberg/'
      STORAGE_AWS_ROLE_ARN = 'arn:aws:iam::123456789012:role/SnowflakeIcebergRole'
    )
  );

Paso 2: Obtener el External ID

DESC EXTERNAL VOLUME vol_s3_iceberg;
-- Anota: STORAGE_AWS_IAM_USER_ARN y STORAGE_AWS_EXTERNAL_ID

Paso 3: Configurar el IAM Role en AWS

En la AWS Console, edita el Trust Policy del role SnowflakeIcebergRole:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::SNOWFLAKE_ACCOUNT:root"
    },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": {
        "sts:ExternalId": "EL_EXTERNAL_ID_DE_DESC"
      }
    }
  }]
}

Y agrega esta policy al role:

{
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "s3:GetObject", "s3:PutObject", "s3:DeleteObject",
      "s3:GetObjectVersion", "s3:GetBucketLocation",
      "s3:ListBucket"
    ],
    "Resource": [
      "arn:aws:s3:::mi-empresa-datalake",
      "arn:aws:s3:::mi-empresa-datalake/*"
    ]
  }]
}

Paso 4: Verificar

SELECT SYSTEM$VERIFY_EXTERNAL_STAGE(
    'vol_s3_iceberg', 'prod-us-east'
);

Azure Data Lake Storage (ADLS)

CREATE EXTERNAL VOLUME vol_adls_iceberg
  STORAGE_LOCATIONS = (
    (
      NAME = 'prod-westeurope'
      STORAGE_PROVIDER = 'AZURE'
      STORAGE_BASE_URL = 'azure://mi-storage-account.blob.core.windows.net/iceberg-container/'
      AZURE_TENANT_ID = 'tu-tenant-id'
    )
  );

-- Snowflake genera un App ID que debes autorizar en Azure AD
DESC EXTERNAL VOLUME vol_adls_iceberg;
-- Usa el AZURE_CONSENT_URL para autorizar el acceso

Google Cloud Storage (GCS)

CREATE EXTERNAL VOLUME vol_gcs_iceberg
  STORAGE_LOCATIONS = (
    (
      NAME = 'prod-us-central1'
      STORAGE_PROVIDER = 'GCS'
      STORAGE_BASE_URL = 'gcs://mi-bucket-iceberg/data/'
    )
  );

-- Snowflake genera una Service Account que debes agregar al bucket
DESC EXTERNAL VOLUME vol_gcs_iceberg;
-- Agrega la cuenta de servicio como Storage Object Admin en el bucket

Múltiples regiones en un External Volume

-- Replicación multi-región para alta disponibilidad
CREATE EXTERNAL VOLUME vol_multi_region
  STORAGE_LOCATIONS = (
    (
      NAME = 'us-east-1'
      STORAGE_PROVIDER = 'S3'
      STORAGE_BASE_URL = 's3://mi-bucket-us/iceberg/'
      STORAGE_AWS_ROLE_ARN = 'arn:aws:iam::123:role/SnowflakeRole'
    ),
    (
      NAME = 'eu-west-1'
      STORAGE_PROVIDER = 'S3'
      STORAGE_BASE_URL = 's3://mi-bucket-eu/iceberg/'
      STORAGE_AWS_ROLE_ARN = 'arn:aws:iam::123:role/SnowflakeRole'
    )
  )
  ALLOW_WRITES = TRUE;

Próximos pasos

La siguiente lección configura Catalog Integrations para conectar con catálogos externos como AWS Glue y Unity Catalog.