Repository navigation
Snowflake: forward workload_identity_impersonation_path to the connector #74590
Description
Description
SnowflakeHook supports Workload Identity Federation (#68107) but only forwards workload_identity_provider, token and token_file_path. snowflake-connector-python>=4.0.0 also accepts workload_identity_impersonation_path: roles (AWS) or service accounts (GCP) to impersonate before authenticating, so Snowflake trusts the last identity instead of the workload's own.
Proposal: read workload_identity_impersonation_path from the connection extras (list or comma-separated string) and pass it to the connector.
Use case
Local Airflow runs with developer SSO credentials for AWS. Snowflake should trust one dedicated role per deployment, not every developer's SSO role. With an impersonation path, the connection assumes that role for Snowflake only, and everything else keeps using the SSO credentials. Today this needs a custom hook.
Are you willing to submit a PR?
Yes
Activity
boring-cyborg commentedon Oct 12, 2026
Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.
spcvalente commentedon Oct 12, 2026
PR: #74591
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook
Forward workload_identity_impersonation_path in SnowflakeHook