Set Up Zero-Copy Data In with Snowflake

Prerequisites

Configure Snowflake.
Take note of your
Account Locator
value from your account details.
Set Up Workday Security Policies for Zero-Copy Data In

Summary

Task 1: Create a Zero-Copy Connection to Snowflake
Task 2: Create an External Catalog
Task 3: Explore and Validate External Tables

Task 1: Create a Zero-Copy Connection to Snowflake

In Workday, access the Prism Data Catalog report.
Select
+ Create
>
Connection
.
In the
Create Connection
wizard, under
Zero Copy Connectors
, select the
Snowflake
tile.
Enter the connection details:
Field	Description
Name	The connection name must be unique in the Data Catalog. Example: Snowflake_ZeroCopy_<first name><last initial> .
Description	(Optional) A brief description of the connection's purpose.
Catalog URL	The URL of the Snowflake data catalog. The URL must use only lowercase characters. Format: https://<account_locator>.snowflakecomputing.com/polaris/api/catalog
Catalog Name	The name of the Snowflake catalog that contains your Iceberg tables.
Authentication Type	Select Oauth 2.0 with Key Pair .
Issuer	Enter initial values. You'll retrieve the PUBLIC_KEY_FP value later in this procedure. Format: ACCOUNT_LOCATOR . SERVICE_USER . PUBLIC_KEY_FP Example: XTQ04827.ICEFLOW_PRISM_USER.<PUBLIC_KEY_FP>
Principal	The Service Principal from Snowflake. This user will be used to authenticate the Snowflake connection. Format: ACCOUNT_LOCATOR . SERVICE_USER Example: XTQ04827.ICEFLOW_PRISM_USER
Token Endpoint	The OAuth2 token endpoint from Snowflake. Format: Catalog_URL /v1/oauth/tokens Example: https://<account_locator>.snowflakecomputing.com/polaris/api/catalog/v1/oauth/tokens
Scopes	The OAuth2 scopes from Snowflake. The scopes define what the Principal has access to when connected to Snowflake.
Save the connection but do
not
test it yet. Before you test the connection, you must complete the certificate/key setup in the subsequent steps.
After the save is complete, the
Authentication Certificate
window displays.
From the
Authentication Certificate
window, download the certificate in
PKCS#8
format.
If you skipped downloading the certificate from the
Authentication Certificate
window, follow these steps:
Access the
Data Catalog
report.
From the
Connections
list, open the connection you just created. Example:
Snowflake_ZeroCopy_<first name><last initial>
On the
View Connection Details
page, locate the
Authentication Certificate
section.
Click
Certificate
>
Download
.
Select
PKCS#8
.
This file contains the RSA public key that you'll register with the Snowflake service user.
Set the RSA public key on the Snowflake service user.
Sign in to your Snowflake account.
Create a
SQL Worksheet
with sufficient privileges to alter the service user.
Type and run an ALTER USER command to set the RSA public key for your service user.
Example:
ALTER USER ICEFLOW_PRISM_USER SET RSA_PUBLIC_KEY = '<Content of Downloaded PKCS#8>';
If your environment uses a
second RSA key
, use RSA_PUBLIC_KEY_2 instead. Example:
ALTER USER ICEFLOW_PRISM_USER   SET RSA_PUBLIC_KEY_2 = '<Content of Downloaded PKCS#8>';
Run the following command to inspect the user and retrieve the public key fingerprint:
DESCRIBE USER ICEFLOW_PRISM_USER;
In the result set, locate the value of either:
RSA_PUBLIC_KEY_FP
RSA_PUBLIC_KEY_2_FP (if you used the second key)
Copy this fingerprint value.
Update the Workday connection Issuer with the fingerprint value.
In Workday, open your Snowflake zero-copy connection.
From the related actions menu of the connection, select
Prism Connection
>
Edit Connection
.
Update the
Issuer
field to append the RSA public key fingerprint.
Use this final Issuer format:
<ACCOUNT_LOCATOR>.<SERVICE_USER>.<PUBLIC_KEY_FP>
Where:
ACCOUNT_LOCATOR
is your Snowflake account locator.
SERVICE_USER
is the service user you altered above.
PUBLIC_KEY_FP
is the value copied from RSA_PUBLIC_KEY_FP (or RSA_PUBLIC_KEY_2_FP).
Save the updated connection.
Test the connection.
On the
Connection Details
page, select
Test Connection
.
If the test fails, verify:
Catalog URL format.
Token endpoint URL.
Service user and account locator values.
RSA public key is correctly set on the user.
Issuer format, including the public key fingerprint.

Task 2: Create an External Catalog

Access the
Data Catalog
report.
Select
+ Create
>
External Catalog
.
Enter the external catalog details:
Field	Description
External Catalog Name	Enter a name for your external catalog.
Connection	Select the external partner zero-copy connection you just created.
Namespace	The exact namespace where the Iceberg connector tables reside. This information is provided by Snowflake. Example: enterprise.finance.procurement .
Description	(Optional) The description of the external catalog.
Click
Save
.
Wait for the
Success
notification that the External Catalog was created.
Select
Back to Data Catalog
.
Select
External Catalog
, and validate that schema sync is successful on your External Catalog.

Read the metadata of Iceberg tables in the specified Snowflake namespace.
Register those tables as
External Tables
in Workday.
Make table structures visible in the Data Catalog
without moving or copying data
.

Task 3: Explore and Validate External Tables

Locate the external partner's external tables.
Access the
Data Catalog
report.
In the left-hand menu, select
External Tables
.
Click on the
Refresh
button.
In the
External Tables
view, confirm that all Iceberg tables from the external partner are listed under the schema/namespace you selected during external catalog creation.
Inspect an external table.
Right-click or double-click the table name to open
View External Table Details
.
On the details page, review:
Column names
Data types
Any available column statistics
Sample data preview (if present)
Verify that:
Data types (Example: Numeric vs. string) align with the definitions in the external system.
Values appear as expected.

Next Steps

Enable External Data for Analysis
Blend External Data with Workday Data
Create Visualizations