Concept: Data Change Task Connections

You can create connections from Workday to external servers and data warehouses to bring data into Prism Analytics. After creating a connection, you can use it as a source in 1 or more data change tasks.

When you run a data change task with a connection, Workday:

Connects to the external server using the access credentials configured in the connection.
Retrieves the data defined in the data change task.

All connections define how to connect to the external server, and most don’t specify what data to retrieve. Instead, when you use the connection in a data change task, you define the data to bring into Prism, such as the object, table, or data defined in a SQL SELECT statement. The exceptions are SFTP connections that also specify the data to retrieve in addition to the external server information.

Connection	Description
Amazon Redshift	You can connect to Amazon Redshift using: BasicAuth. IAM Credentials.
Amazon S3 (Simple Storage Solution)	Amazon S3 connections: Define a specific bucket in an Amazon region. Define the AWS access keys to authenticate against Amazon to access the S3 bucket. You must add a tag to the AWS Identity and Access Management (IAM) user with a key of workday-type and a value of integration with no whitespaces. This tag is case-sensitive.
Azure Synapse	You can connect Prism Analytics to Azure Synapse using: Basic Auth: Provide the user credentials of the specified Azure Synapse account. OAuth 2.0 with client credentials: Provide the client ID, client secret, and Azure tenant that you configured in Azure Active Directory (AD) B2C for the app. OAuth 2.0 with JSON Web Token (JWT): Provide the client ID, Azure tenant, and public-private key pair.
Azure Blob	You can connect Prism Analytics to Azure Blob using: OAuth 2.0 with client credentials: Provide the client ID, client secret, and Azure tenant that you configured in Azure Active Directory (AD) B2C for the app. OAuth 2.0 with JSON Web Token (JWT): Provide the client ID and Azure tenant.
BigQuery	You can connect to BigQuery using the Google Service Account Key authentication. When you create a BigQuery connection, you: Specify a Google Cloud project ID to use for billing all data queries against. Specify a Google Cloud service account key to authenticate as. You must create the service account key using JSON. Can optionally specify an additional service account email to impersonate that account for permissions. When you migrate a BigQuery connection between tenants, Workday doesn’t migrate the service account key to protect your security. As a result, you must copy and paste the JSON of the service account key in the BigQuery connection in the target tenant.
Google Cloud Storage	You can connect to Google cloud Storage using the Google Service Account Key authentication. When you create a Google Cloud Storage connection, you: Specify a Google Cloud project ID to use for billing all data queries against. Specify a Google Cloud service account key to authenticate. You must create the service account key using JSON. Can optionally specify an additional service account email to impersonate that account for permissions. When you migrate a Google Cloud Storage connection between tenants, Workday doesn’t migrate the service account key to protect your security. As a result, you must copy and paste the JSON of the service account key in the Google Cloud Storage connection in the target tenant.
Salesforce	You can connect to Salesforce using: BasicAuth. OAuth 2.0 with JWT. To use OAuth to connect to Salesforce, you must: Connect to a Salesforce Connected App or External Client App. Download or copy the certificate to the Salesforce app to enable authentication. Because you download the certificate to connect to the Salesforce app, you can only have 1 connection per Salesforce app across all tenants. An OAuth connection allows you to determine what objects the connection has access to from the Salesforce app.
SFTP	SFTP connections: Define how to connect to and authenticate against the server. Define the files to get from the server. You can connect to an SFTP server using these authentication methods: User name and password. SSH authentication.
Snowflake	You can connect to Snowflake using: Basic authentication. Key Pair authentication. When you use Key Pair authentication, Workday generates and stores a private key on the Workday tenant and generates a public key for you to copy (2048-bit RSA key pair). You must copy the public key and assign it to the user in Snowflake to enable authentication. Because you assign the tenant-generated public key to the Snowflake user in order to connect to Snowflake, you can only have 1 connection per Snowflake user across all tenants using Key Pair authentication.