snowflakedb / snowflakedb/snowflake-connector-python
SNOW-2436496: Workload Identity Federation using Managed Identities in AKS
@sfc-gh-snow-drivers-warsaw-dl is already working on this.
Since Oct 20, 2025.
- Dominant language
- Python
- Stars
- 730
- Forks
- 574
- Avg merge
- 5h 45m
- Merged PRs (30d)
- 16
Description
What is the current behavior?
Right now, it seems like the Snowflake connector and client libraries will try to fetch the token for us, which fails to discover the user-assigned managed identity for workloads in AKS. That is probably the reason you suggest a different flow for AKS that uses service accounts instead instead of Entra ID and managed identites.
What is the desired behavior?
We can discover this user-assigned managed identity and fetch a token for it from our AKS by using the Azure identity libraries. Is it possible to provide the token manually? Does the Snowflake connector have to do it for us?
How would this improve snowflake-connector-python?
It will allow us to use managed identities to authenticate to Snowflake without needing to use service accounts in AKS directly. Since we already use managed identities for everything else, this will allow us to use the same pattern.
References and other background
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.