AI Service Graph Connector for Snowflake

The AI Service Graph Connector for Snowflake enables you to discover and import AI assets from your Snowflake environment into ServiceNow AI Control Tower.

The connector integrates with your Snowflake account to catalog AI systems, agents, models, and prompts. Usage data is automatically collected and populated into the AI Control Tower value dashboard, providing comprehensive visibility and governance of your AI operations.

Key capabilities:

• Automated discovery of Cortex agents and models
• Fine-tuning job monitoring and metadata capture
• AI asset lineage and dependency tracking
• Usage analytics and session monitoring
• Integration with ServiceNow CMDB for comprehensive asset management
• Support for multi-account Snowflake deployments

Download apps from the Store

Visit the ServiceNow store website to download the AI Service Graph Connector for Snowflake application.

Supported ServiceNow versions

User Roles

You must have one of the following roles assigned.

ServiceNow Prerequisites

Complete the following setup steps once when configuring the connector for the first time.

Note: Updating data source access and clear cache is a prerequisite that needs to be completed only once, when setting up a new instance for the first time.

Update Data Source Access

The connector requires write permissions to the Data Source table to create data sources.

To enable data source creation:

1. Select Global from the application picker.
2. Navigate to Application Access.
3. Select the Can create, Can update, and Can delete check boxes.
4. Select Update.
5. Switch to the connector application scope.

Clear cache

Clear the cached data for the Data Source and Tables.

To clear the cache:

1. Navigate to System Definition > Background Scripts

2. Paste the following script into the Run Script text box:

   GlideTableManager.invalidateTable('sys_data_source');
   GlideCacheManager.flushTable('sys_data_source');
   GlideTableManager.invalidateTable('sys_db_object');
   GlideCacheManager.flushTable('sys_db_object');
   

3. Select Run Script.

   Note: The script may take several minutes to complete.

4. After completion, switch to the connector application scope.

Snowflake Prerequisites

To configure a Snowflake service user for Key-Pair Authentication instead of a Programmatic Access Token (PAT), you must generate an RSA key pair, assign the public key to the Snowflake user profile, and verify the user's Authentication Policy allows key-pair connections.

Complete the following configuration steps in your Snowflake environment before creating a connection.

Network Configuration

Note: The outbound integration IP addresses for your ServiceNow instance must be allowed in your Snowflake network policies. See the How to find IP address and datacenter information for your instance [KB0538621] article in the Now Support Knowledge Base to find the Source address used for integrations into customer network IP address range.

Account Identifier Format

Note: The Snowflake Statements API requires account identifiers in LDF (Lowercase-Digit-Hyphen) format in the connection URL. Account identifiers with uppercase letters or special characters must be converted to lowercase or replaced with the account locator.

We should always use the following format for connection url.

• https://<account_identifier>.snowflakecomputing.com
• If account identifier contains uppercase letters or special characters, use your account locator in connection URL as follows https://<account_locator>.snowflakecomputing.com

If your account identifier contains uppercase letters or special characters, use your account locator (for example, xy12345) instead. Your account locator is always LDF-safe.

Service Account and Role Configuration

Create a dedicated service account in Snowflake with least-privilege access. The connector requires specific permissions to query Cortex agents, models, and observability data.

Create a Role with Required Privileges

create role for the connector and grant the following privileges:

Core Discovery Access:

• GRANT USAGE ON DATABASE <database_name>
• GRANT USAGE ON SCHEMA <schema_name>

Cortex access

• GRANT MANAGE ACCOUNTS
• GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER

Create a Service Account

Create a service account user and assign the connector role:

• CREATE USER <service_account_name> TYPE=SERVICE
• GRANT ROLE <connector_role> TO USER <service_account_name>
• ALTER USER <service_account_name> SET DEFAULT_WAREHOUSE = <warehouse_name>

Configure JWT Key-Pair Authentication

The connector uses JWT key-pair authentication to securely connect to Snowflake.

For detailed steps on generating RSA key pairs and configuring key-pair authentication in Snowflake, see the Configuring Keystore for Snowflake Keypair authentication [KB2834688] article in the Now Support Knowledge Base.

Data Mapping

The connector maps Snowflake AI assets to ServiceNow CMDB tables and custom tables for comprehensive asset management.

Snowflake Service Account Role with Least Privileges

Create a role and set the privileges.

Set Privileges:

• Core discovery access
  • Grant usage on database
  • Grant usage on schema
• Cortex access
• Grant manage accounts
• Grant database role (SNOWFLAKE.CORTEX_USER)

Create a service account user and assign the role to the user.

• Applies to the user
• Grant role to the user
• Set a default warehouse for the user
• Alter user is to SET DEFAULT_WAREHOUSE

Data Mapping

The following table lists the data sources, the staging tables, and the target tables CMDB CI classes and non-CMDB classes where data is stored for Snowflake connector.