SNOWFLAKE DOCS DIFF
本日は全8,474ページ中93件が更新対象となり、改訂92件・削除1件でした。更新の中心は、Native Apps Framework／Application Services のリリース管理・権限設定と、Cortex Agents／Snowflake ML の運用機能です。特に、破壊的変更1件としてCortex Agentスキルの相対パス方式に関するページ削除がありましたが、提示されたdiffが空のため詳細や実務影響は不明です。
orchestration.tool_not_accessibleが追加されました。提示された unified diff は空 のため、追加・削除された機能や構文などの変更内容は diff からは詳細不明 です。 影響: 実務への影響は diff からは詳細不明 です。
判定根拠: ページ削除
diff は保存されていません（削除ページなど）。
リリースチャネル対応のアプリケーションパッケージ向けに、REGISTER VERSION／DEREGISTER VERSION 構文と、バージョンの追加・削除（ADD VERSION／DROP VERSION）、アカウント管理（ADD ACCOUNTS／REMOVE ACCOUNTS／SET ACCOUNTS）の構文・説明が追加されました。MODIFY RELEASE DIRECTIVE の構文はインデントが整えられただけで、機能変更はありません。
影響: リリースチャネル対応パッケージでは、未割り当てバージョンの登録・解除やチャネルへのバージョン割り当て、対象アカウントの管理を専用構文で実行できるようになります。
判定根拠: SQL 構文/コードブロックの増減 (+12/-0)
--- ahttps://docs.snowflake.com/en/sql-reference/sql/alter-application-package-release-channel+++ bhttps://docs.snowflake.com/en/sql-reference/sql/alter-application-package-release-channel@@ -31,4 +31,32 @@ ```sqlsyntax+ALTER APPLICATION PACKAGE <name>+ REGISTER VERSION [ <version_identifier> ]+ USING <path_to_version_directory>+ [ LABEL = '<display_label>' ]++ALTER APPLICATION PACKAGE <name>+ DEREGISTER VERSION <version_identifier>++ALTER APPLICATION PACKAGE <name>+ MODIFY RELEASE CHANNEL <release_channel>+ ADD VERSION <version_identifier>++ALTER APPLICATION PACKAGE <name>+ MODIFY RELEASE CHANNEL <release_channel>+ DROP VERSION <version_identifier>++ALTER APPLICATION PACKAGE <name>+ MODIFY RELEASE CHANNEL <release_channel>+ ADD ACCOUNTS = ( <organization_name>.<account_name> [ , <organization_name>.<account_name> , ... ] )++ALTER APPLICATION PACKAGE <name>+ MODIFY RELEASE CHANNEL <release_channel>+ REMOVE ACCOUNTS = ( <organization_name>.<account_name> [ , <organization_name>.<account_name> , ... ] )++ALTER APPLICATION PACKAGE <name>+ MODIFY RELEASE CHANNEL <release_channel>+ SET ACCOUNTS = ( <organization_name>.<account_name> [ , <organization_name>.<account_name> , ... ] )+ ALTER APPLICATION PACKAGE <name> MODIFY RELEASE CHANNEL <release_channel>@@ -51,11 +79,11 @@ ALTER APPLICATION PACKAGE <name>- MODIFY RELEASE CHANNEL <release_channel>- MODIFY RELEASE DIRECTIVE <release_directive>- VERSION = <version_identifier>- PATCH = <patch_num>- [ UPGRADE_AFTER = '<timestamp>' ]- [ UPGRADE_IN_MAINTENANCE_WINDOW = { TRUE | FALSE } ]- [ UPGRADE_DEADLINE = '<timestamp>' ]+ MODIFY RELEASE CHANNEL <release_channel>+ MODIFY RELEASE DIRECTIVE <release_directive>+ VERSION = <version_identifier>+ PATCH = <patch_num>+ [ UPGRADE_AFTER = '<timestamp>' ]+ [ UPGRADE_IN_MAINTENANCE_WINDOW = { TRUE | FALSE } ]+ [ UPGRADE_DEADLINE = '<timestamp>' ] ALTER APPLICATION PACKAGE <name>@@ -73,16 +101,66 @@ </dd>+<dt><code className="samp">REGISTER VERSION [ <em>version_identifier</em> ] USING <em>path_to_version_directory</em> [ LABEL = '<em>display_label</em>' ]</code></dt>+<dd>++Registers a new version in the application package using the files in the stage path specified by <code className="samp"><em>path_to_version_directory</em></code>. The registered version is not assigned to any release channel until you use `ADD VERSION` to assign it.++Use <code className="samp"><em>version_identifier</em></code> to specify a name for the version. If you do not specify a <code className="samp"><em>version_identifier</em></code> in the `manifest.yml` file, you must specify one in this command. If you define a version identifier in the `manifest.yml` file and also specify one in this command, the command value takes precedence. If neither the command nor the `manifest.yml` file specifies a version identifier, the command fails with an error.++Use the optional `LABEL` clause to specify a display label for the version. This label is shown to consumers. If omitted, the label from the `manifest.yml` file is used.++`REGISTER VERSION` applies only to application packages that have release channels enabled. For application packages without release channels, use [ALTER APPLICATION PACKAGE ... VERSION](/sql-reference/sql/alter-application-package-version) instead.++</dd>+<dt><code className="samp">DEREGISTER VERSION <em>version_identifier</em></code></dt>+<dd>++Removes the specified version and its associated patches from the application package. An application package can have at most two registered versions at a time. Use this command to free up a version slot before registering a new version when the application package already has two versions.++A version can only be deregistered when it is not assigned to any release channel and no installed application instances are running on it.++</dd> <dt><code className="samp">MODIFY RELEASE CHANNEL <em>release_channel</em></code></dt> <dd> -Specifies the release channel that this release directive applies to. If not specified, the release directive applies to all release channels.--The supported values are:--- ALPHA-- QA-- DEFAULT+Specifies the release channel to modify. The supported values are:++- `ALPHA`+- `QA`+- `DEFAULT` For more information about release channels, see [](/developer-guide/native-apps/release-channels).++</dd>+<dt><code className="samp">MODIFY RELEASE CHANNEL <em>release_channel</em> ADD VERSION <em>version_identifier</em></code></dt>+<dd>++Adds a previously registered version to the specified release channel, making it available for release directives in that channel. A release channel can contain at most two versions at a time.++Adding a version to the QA release channel does not trigger the automated security scan. To trigger the scan, add the version to the ALPHA or DEFAULT release channel.++</dd>+<dt><code className="samp">MODIFY RELEASE CHANNEL <em>release_channel</em> DROP VERSION <em>version_identifier</em></code></dt>+<dd>++Removes the specified version from the release channel. This operation is asynchronous: the version is fully removed only after all consumer installations on that version have been upgraded to another version.++</dd>+<dt><code className="samp">MODIFY RELEASE CHANNEL <em>release_channel</em> ADD ACCOUNTS = ( <em>organization_name</em>.<em>account_name</em> [ , ... ] )</code></dt>+<dd>++Adds the specified consumer accounts to the release channel, allowing them to access versions and patches assigned to it.++</dd>+<dt><code className="samp">MODIFY RELEASE CHANNEL <em>release_channel</em> REMOVE ACCOUNTS = ( <em>organization_name</em>.<em>account_name</em> [ , ... ] )</code></dt>+<dd>++Removes the specified consumer accounts from the release channel.++</dd>+<dt><code className="samp">MODIFY RELEASE CHANNEL <em>release_channel</em> SET ACCOUNTS = ( <em>organization_name</em>.<em>account_name</em> [ , ... ] )</code></dt>+<dd>++Replaces the entire list of consumer accounts for the release channel with the specified accounts. All accounts previously in the channel that are not in the new list are removed. </dd>@@ -173,4 +251,23 @@ </dd> </dl>++## Access control requirements++A [role](#label-access-control-overview-roles) used to execute this operation must have the following+[privileges](#label-access-control-overview-privileges) at a minimum:++<div className="colwidths-auto">++| Privilege | Object | Notes |+| --------------- | ------------------- | ---------------------------------------------------------------------------------------------------------- |+| OWNERSHIP | Application package | Required to modify release channels or register versions for the application package. |+| MANAGE VERSIONS | Account | Global privilege that allows modifying release channels and release directives on any application package. |++</div>++For instructions on creating a custom role with a specified set of privileges, see [](#label-security-custom-role).++For general information about roles and privilege grants for performing SQL actions on+[securable objects](#label-access-control-securable-objects), see [Overview of Access Control](/user-guide/security-access-control-overview). ## Usage notes@@ -219,15 +316,33 @@ ``` +The following example registers version `V2` in the application package:++```sql+ALTER APPLICATION PACKAGE my_app_package+ REGISTER VERSION V2+ USING '@my_app_package.core.app_stage/v2';+```++```text++---------------------------------------------------------------------------------------------------------++| status |+|-------------------------------------------------... (truncated)
差分が長いため、途中まで表示しています。
エージェントスキルの配布方法が、アプリケーションパッケージ内の相対 STAGE パス参照から、セットアップスクリプトで内部ステージへ COPY INTO する方式に変更されました。TYPE = CSV、COMPRESSION = NONE、RECORD_DELIMITER = NONE、FIELD_DELIMITER = NONE、SINGLE = TRUE を指定し、GRANT READ 後に @core.skills_stage/app_skill のようにフォルダーを参照します。SKILL.md は name と description の YAML frontmatter を使用し、frontmatter の instructions は無視されます。
影響: コンシューマーアカウントで実行されるセットアップスクリプトではローカルファイルを PUT できないため、スキルをステージへ書き込む SQL とアプリケーションロールへの READ 権限付与が必要になります。
判定根拠: SQL 構文/コードブロックの増減 (+5/-3)
--- ahttps://docs.snowflake.com/en/developer-guide/native-apps/agents-mcp-servers+++ bhttps://docs.snowflake.com/en/developer-guide/native-apps/agents-mcp-servers@@ -177,37 +177,55 @@ [](/sql-reference/commands-cortex-agent). -<a id="label-native-apps-agent-relative-skills"></a>+<a id="label-native-apps-agent-skills"></a> ### Provider: Ship skills with the app -You can package [agent skills](/user-guide/snowflake-cortex/cortex-agents-skills)-inside the application package and reference them from an app-created agent by-using a relative `STAGE` path. On version creation, Snowflake copies the skill-files into the app's versioned (snapshot) stage. The relative path resolves-against that stage at run time, similar to how stored procedures and Streamlit-apps reference files with paths that start with `/`.--Relative skill paths:--- Must start with `/` and point at the skill subdirectory that contains- `SKILL.md` (for example, `/my_skill`).-- Are supported only in the setup script or in owner's-rights procedures in the- app.--Absolute `@database.schema.stage/...` skill paths continue to work and aren't-affected by this pattern.--Include the skill files in the application package next to the manifest, then-create the agent in the setup script:--```-@my_package.stage/v1:-└── /- ├── manifest.yml- ├── scripts/setup_script.sql- └── my_skill/- ├── SKILL.md- └── helper.py-```+You can ship [agent skills](/user-guide/snowflake-cortex/cortex-agents-skills)+with a %native-app% by writing `SKILL.md` files to an app-owned internal stage+in the setup script, then referencing that stage from the agent specification.++Because the setup script runs in the consumer account, you can't use `PUT` to+upload files from a local machine. Create an internal stage, unload the skill+content with [](/sql-reference/sql/copy-into-location), and grant `READ` on+the stage to the application roles that should use the agent.++Each `SKILL.md` file uses YAML frontmatter for `name` and `description`. Put+the skill's execution instructions in the Markdown body after the closing+`---`. Cortex Agents ignore an `instructions` key in the frontmatter.++The file format options in the following example write the skill content as+plain, uncompressed text. `TYPE = CSV` is the text-based unload format, and+setting `COMPRESSION`, `RECORD_DELIMITER`, and `FIELD_DELIMITER` to `NONE`+prevents Snowflake from compressing the output or inserting CSV delimiters into+the Markdown. `SINGLE = TRUE` writes one file instead of multiple files, and+the `SKILL.md` filename in the target path gives that file its name.++```sql+CREATE STAGE IF NOT EXISTS core.skills_stage;++COPY INTO @core.skills_stage/app_skill/SKILL.md+ FROM (+ SELECT $$---+name: app_skill+description: Answers questions that match this skill's description.+---+Follow the app-specific workflow in this skill.+$$+ )+ FILE_FORMAT = (+ TYPE = CSV+ COMPRESSION = NONE+ RECORD_DELIMITER = NONE+ FIELD_DELIMITER = NONE+ )+ OVERWRITE = TRUE+ SINGLE = TRUE;++GRANT READ ON STAGE core.skills_stage TO APPLICATION ROLE my_app_role;+```++Then reference the skill folder (not the `SKILL.md` file) in the agent+specification. Use a partially qualified stage path so the path doesn't depend+on the installed application database name: ```sqlexample-yaml@@ -222,12 +240,15 @@ source: type: STAGE- path: /my_skill+ path: @core.skills_stage/app_skill $$; ``` -For general skill authoring, stage layout, and absolute stage or Git sources,-see [](/user-guide/snowflake-cortex/cortex-agents-skills). For how relative-paths work for other app artifacts, see-[](/developer-guide/native-apps/adding-application-logic#label-native-apps-reference-app-files).+Repeat the `COPY INTO` statement for each skill, using a distinct folder under+the stage (for example `@core.skills_stage/another_skill/SKILL.md`). If a skill+includes supporting files, unload each file into the same folder with a+separate `COPY INTO` statement.++For general skill authoring and stage layout, see+[](/user-guide/snowflake-cortex/cortex-agents-skills). ### Provider: Create the tools and grant access
Application Services に対し、スキーマ内の複数サービスへ一括で USAGE、MONITOR、OPERATE を付与できる構文が追加されました。ON ALL は既存サービス、ON FUTURE は今後作成されるサービスに適用され、継続的なアクセスには GRANT INHERITED ... ON ALL で両方を対象にできます。
影響: サービス単位での個別付与が不要になり、既存・将来サービスへの権限管理を効率化できますが、対象は標準データベース内に限られ、所有権移転はサポートされません。
判定根拠: SQL 構文/コードブロックの増減 (+12/-0)
--- ahttps://docs.snowflake.com/en/developer-guide/snowflake-app-runtime/access-control+++ bhttps://docs.snowflake.com/en/developer-guide/snowflake-app-runtime/access-control@@ -123,4 +123,55 @@ ``` +<a id="label-snowflake-app-runtime-access-control-bulk-grants"></a>++## Grant access to multiple Application Services++You can grant `USAGE`, `MONITOR`, or `OPERATE` across the Application Services in a schema+instead of one service at a time. The services must be in a standard database, and the+grantee role still needs `USAGE` on the database and schema to resolve their names. Ownership+transfer isn't supported for Application Services.++<a id="label-snowflake-app-runtime-access-control-bulk-grants-existing"></a>++### Grant on the services that exist now++```sql+GRANT USAGE ON ALL APPLICATION SERVICES IN SCHEMA my_db.my_schema TO ROLE app_viewer;+```++This is a one-time operation. Services created afterward aren't included.++<a id="label-snowflake-app-runtime-access-control-bulk-grants-future"></a>++### Grant on services created later++A future grant applies to Application Services created in the schema after you issue it:++```sql+GRANT MONITOR ON FUTURE APPLICATION SERVICES IN SCHEMA my_db.my_schema TO ROLE app_monitor;+```++To list the future grants on a schema, use [](/sql-reference/sql/show-grants). Application+Service rows report `APPLICATION_SERVICE` in the `grant_on` column.++Revoking a future grant stops Snowflake from applying the privilege to services created+later. Grants that already materialized remain in place and must be revoked separately.++```sql+REVOKE MONITOR ON FUTURE APPLICATION SERVICES IN SCHEMA my_db.my_schema FROM ROLE app_monitor;+```++<a id="label-snowflake-app-runtime-access-control-bulk-grants-inherited"></a>++### Cover existing and future services with one grant++`ON ALL` covers only current services and `ON FUTURE` only later ones, so keeping a role's+access complete means maintaining both. If your account has+[inherited grants](/user-guide/inherited-grants-intro) enabled, one grant covers both:++```sql+GRANT INHERITED USAGE ON ALL APPLICATION SERVICES IN SCHEMA my_db.my_schema TO ROLE app_viewer;+```+ <a id="label-snowflake-app-runtime-access-control-revoke"></a>
APPLICATION PACKAGE と APPLICATION を対象オブジェクトとして追加し、アカウント権限に PREVIEW APPLICATION、MANAGE 権限に APPLICATION SPECIFICATIONS を追加しました。また、Application Services で USAGE・OPERATE・MONITOR を全体または将来のサービスに付与できる構文が追加され、OWNERSHIP の移転不可や personal database での権限付与不可も明記されました。 影響: Application Services の将来オブジェクトへ権限を事前付与できるようになりましたが、OWNERSHIP は移転不可で、personal database 上の Application Service には権限を付与できません。
判定根拠: SQL 構文/コードブロックの増減 (+3/-0)
--- ahttps://docs.snowflake.com/en/sql-reference/sql/grant-privilege+++ bhttps://docs.snowflake.com/en/sql-reference/sql/grant-privilege@@ -53,5 +53,5 @@ ```sqlsyntax GRANT { { globalPrivileges | ALL [ PRIVILEGES ] } ON ACCOUNT- | { accountObjectPrivileges | ALL [ PRIVILEGES ] } ON { USER | RESOURCE MONITOR | WAREHOUSE | COMPUTE POOL | DATABASE | INTEGRATION | CONNECTION | FAILOVER GROUP | REPLICATION GROUP | EXTERNAL VOLUME } <object_name>+ | { accountObjectPrivileges | ALL [ PRIVILEGES ] } ON { USER | RESOURCE MONITOR | WAREHOUSE | COMPUTE POOL | DATABASE | INTEGRATION | CONNECTION | FAILOVER GROUP | REPLICATION GROUP | EXTERNAL VOLUME | APPLICATION PACKAGE | APPLICATION } <object_name> | { schemaPrivileges | ALL [ PRIVILEGES ] } ON { SCHEMA <schema_name> | ALL SCHEMAS IN DATABASE <db_name> } | { schemaPrivileges | ALL [ PRIVILEGES ] } ON { FUTURE SCHEMAS IN DATABASE <db_name> }@@ -82,7 +82,7 @@ ACCOUNT | APPLICATION | APPLICATION PACKAGE | COMPUTE POOL | LISTING | DATABASE | EXTERNAL VOLUME | FAILOVER GROUP | INTEGRATION | NETWORK POLICY- | ORGANIZATION LISTING | ORGANIZATION PROFILE | REPLICATION GROUP | ROLE | SHARE- | USER | WAREHOUSE- }+ | ORGANIZATION LISTING | ORGANIZATION PROFILE | PREVIEW APPLICATION+ | REPLICATION GROUP | ROLE | SHARE | USER | WAREHOUSE+ } | ATTACH POLICY | AUDIT | BIND SERVICE ENDPOINT | APPLY {@@ -93,5 +93,5 @@ | EXECUTE { ALERT | DATA METRIC FUNCTION | MANAGED ALERT | MANAGED TASK | TASK } | IMPORT { SHARE | ORGANIZATION LISTING }- | MANAGE { ACCOUNT SUPPORT CASES | EVENT SHARING | GRANTS | LISTING AUTO FULFILLMENT | ORGANIZATION SUPPORT CASES | SHARE TARGET | USER SUPPORT CASES | VISIBILITY | WAREHOUSES }+ | MANAGE { ACCOUNT SUPPORT CASES | APPLICATION SPECIFICATIONS | EVENT SHARING | GRANTS | LISTING AUTO FULFILLMENT | ORGANIZATION SUPPORT CASES | SHARE TARGET | USER SUPPORT CASES | VISIBILITY | WAREHOUSES } | MODIFY { LOG LEVEL | TRACE LEVEL | SESSION LOG LEVEL | SESSION TRACE LEVEL } | MONITOR { EXECUTION | SECURITY | USAGE }@@ -431,5 +431,15 @@ There is no separately grantable `WRITE` privilege on artifact repositories. Publishing new package versions requires `OWNERSHIP`. For a full list of privileges, see [](/user-guide/security-access-control-privileges#label-artifact-repository-privileges). -- For Application Services, any privilege on the object (`USAGE`, `OPERATE`, `MONITOR`, or `OWNERSHIP`) allows `DESCRIBE`. Future grants are not supported for Application Services. For a full list of privileges, see [](/user-guide/security-access-control-privileges#label-application-service-privileges).+- For Application Services, any privilege on the object (`USAGE`, `OPERATE`, `MONITOR`, or `OWNERSHIP`) allows `DESCRIBE`. The+ `USAGE`, `OPERATE`, and `MONITOR` privileges can be granted on all or future Application Services in a schema. For example:++ ```sql+ GRANT USAGE ON FUTURE APPLICATION SERVICES IN SCHEMA mydb.myschema TO ROLE myrole;+ ```++ `OWNERSHIP` cannot be transferred on an Application Service, and privileges cannot be granted on an Application Service in a+ [personal database](/user-guide/personal-databases). For a full list of privileges, see+ [](/user-guide/security-access-control-privileges#label-application-service-privileges). For grant patterns, see+ [](/developer-guide/snowflake-app-runtime/access-control). <a id="label-grant-privilege-access-control-requirements"></a>
orchestration.tool_not_accessible パラメータが追加され、ツール権限がない場合に実行を中止するか、アクセス可能なツールで継続するかを制御できるようになりました。Snowsight 用設定例、REST API の curl 例、SQL 構文例に tool_not_accessible: accept が追加されています。
影響: ツール権限の不足時にエージェントを継続実行させる設定を、REST API や SQL で明示できるようになります。
判定根拠: SQL 構文/コードブロックの増減 (+2/-0)
--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-manage+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-manage@@ -78,4 +78,5 @@ $$ orchestration:+ tool_not_accessible: accept budget: seconds: 30@@ -477,4 +478,5 @@ orchestration:+ tool_not_accessible: accept budget: seconds: 30@@ -543,4 +545,6 @@ Cortex Agents orchestrate the task by breaking it into a sequence of sub-tasks and identifying the right tool for each sub-task. You specify the LLM that the agent should use to conduct this orchestration. You can also influence the orchestration by providing instructions. For example, consider an agent built to respond to retail product questions. You can use the orchestration instruction `"Use the search tool for all requests related to refunds"` to ensure the agent only provides refund policy details (using Cortex Search) and does not actually calculate the refund amounts (using Cortex Analyst). You can also specify instructions to align the response to a brand or a tone, such as `"Always provide a concise response; maintain a friendly tone"`. +Use `orchestration.tool_not_accessible` to control whether a missing tool privilege aborts the run or lets the agent continue with the tools it can access. For details, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling).+ **Method 1: Snowsight UI:** @@ -587,4 +591,17 @@ ``` +3. Specify what happens when a tool isn't accessible. For values and default behavior, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling).+ ```bash+ curl -X PUT "$SNOWFLAKE_ACCOUNT_BASE_URL/api/v2/databases/<database-name>/schemas/<schema-name>/agents/<agent-name>" \+ --header 'Content-Type: application/json' \+ --header 'Accept: application/json' \+ --header "Authorization: Bearer $PAT" \+ --data '{+ "orchestration": {+ "tool_not_accessible": "accept"+ }+ }'+ ```+ **Method 3: SQL:** @@ -598,4 +615,5 @@ orchestration:+ tool_not_accessible: accept budget: seconds: 30
モデル提供コストの監視に関するセクションが追加され、Warehouse または Snowpark Container Services で実行した推論ワークロードの推定クレジット消費量を確認できるようになりました。SNOWFLAKE.ACCOUNT_USAGE.MODEL_SERVING_USAGE_HISTORY を参照する SQL 例も追加されています。
影響: モデル提供の推定クレジット消費量を確認し、推論コストを監視できるようになります。
判定根拠: SQL 構文/コードブロックの増減 (+3/-0)
--- ahttps://docs.snowflake.com/en/developer-guide/snowflake-ml/model-registry/overview+++ bhttps://docs.snowflake.com/en/developer-guide/snowflake-ml/model-registry/overview@@ -1082,2 +1082,12 @@ - Model and version creation operations - Invoking a model's methods++### Monitoring model serving costs++To view estimated credit consumption for model serving (inference) workloads, whether run through a warehouse or through+Snowpark Container Services, use the [](/sql-reference/account-usage/model_serving_usage_history). For example:++```sql+SELECT *+ FROM SNOWFLAKE.ACCOUNT_USAGE.MODEL_SERVING_USAGE_HISTORY;+```
各 API のセクション別アンカー（Syntax、Arguments、Returns、Examples、Access requirements など）が追加され、該当箇所へ直接リンクできるようになりました。また、テンプレート定義とテンプレート追加フローへのリンクが絶対パスに修正されています。機能・パラメータ・構文自体の変更はありません。 影響: 既存機能への影響はなく、ドキュメント内リンクや外部からの直接参照性が改善されます。
変更内容: 本文を更新（467行追加・39行削除）
--- ahttps://docs.snowflake.com/en/user-guide/cleanrooms/collaboration-api-reference+++ bhttps://docs.snowflake.com/en/user-guide/cleanrooms/collaboration-api-reference@@ -126,4 +126,6 @@ name-version combination for all templates in all registries in your account. To remove a template that you registered, call [REGISTRY.UNREGISTER_TEMPLATE](#label-dcr-collaboration-unregister-template-reference). +<a id="register_template-syntax"></a>+ #### Syntax @@ -131,4 +133,6 @@ REGISTER_TEMPLATE( ['<registry_name>' ,] <template_spec> ) ```++<a id="register_template-arguments"></a> #### Arguments@@ -144,12 +148,16 @@ <dd> -[Template definition](#label-dcr-collaboration-template-yaml) in YAML format, as a string.--</dd>-</dl>+[Template definition](/user-guide/cleanrooms/spec-template#label-dcr-collaboration-template-yaml) in YAML format, as a string.++</dd>+</dl>++<a id="register_template-returns"></a> #### Returns A template ID to use in the collaboration specification.++<a id="register_template-examples"></a> #### Examples@@ -188,4 +196,6 @@ ``` +<a id="register_template-access-requirements"></a>+ #### Access requirements @@ -218,4 +228,6 @@ Lists all templates that you have registered. To register a template, call REGISTRY.REGISTER_TEMPLATE. +<a id="view_registered_templates-syntax"></a>+ #### Syntax @@ -225,4 +237,6 @@ ``` +<a id="view_registered_templates-arguments"></a>+ #### Arguments @@ -237,4 +251,6 @@ </dd> </dl>++<a id="view_registered_templates-returns"></a> #### Returns@@ -249,4 +265,6 @@ - `CREATED_ON`: Timestamp when the template was created. +<a id="view_registered_templates-examples"></a>+ #### Examples @@ -271,4 +289,6 @@ ``` +<a id="view_registered_templates-access-requirements"></a>+ #### Access requirements @@ -305,4 +325,6 @@ You can't unregister a template that is currently used in a collaboration. If the template is linked to one or more collaborations, the procedure fails and returns an error that lists those collaborations; remove the template from each of them before you unregister it. +<a id="unregister_template-syntax"></a>+ #### Syntax @@ -310,4 +332,6 @@ UNREGISTER_TEMPLATE( '<template_id>' ) ```++<a id="unregister_template-arguments"></a> #### Arguments@@ -322,8 +346,12 @@ </dl> +<a id="unregister_template-returns"></a>+ #### Returns A table with a status message confirming that the template was unregistered. +<a id="unregister_template-example"></a>+ #### Example @@ -331,4 +359,6 @@ CALL SAMOOHA_BY_SNOWFLAKE_LOCAL_DB.REGISTRY.UNREGISTER_TEMPLATE('my_test_template_2026_01_12_V1'); ```++<a id="unregister_template-access-requirements"></a> #### Access requirements@@ -366,5 +396,7 @@ To see the status of the request, call VIEW_UPDATE_REQUESTS. -[See the link template flow.](#label-dcr-collaboration-add-template-post-creation)+[See the link template flow.](/user-guide/cleanrooms/resources-templates#label-dcr-collaboration-add-template-post-creation)++<a id="add_template_request-syntax"></a> #### Syntax@@ -373,4 +405,6 @@ ADD_TEMPLATE_REQUEST( <collaboration_name>, <template_id>, <share_with> ) ```++<a id="add_template_request-arguments"></a> #### Arguments@@ -397,7 +431,11 @@ </dl> +<a id="add_template_request-returns"></a>+ #### Returns A string success message.++<a id="add_template_request-example"></a> #### Example@@ -412,4 +450,6 @@ ``` +<a id="add_template_request-access-requirements"></a>+ #### Access requirements @@ -442,4 +482,6 @@ removed for a collaborator, that collaborator can't see or use the template. +<a id="remove_template-syntax"></a>+ #### Syntax @@ -447,4 +489,6 @@ REMOVE_TEMPLATE( <collaboration_name>, <template_id>, <remove_for> ) ```++<a id="remove_template-arguments"></a> #### Arguments@@ -471,7 +515,11 @@ </dl> +<a id="remove_template-returns"></a>+ #### Returns A string success message. To see if a template has been removed for a collaborator, view the collaboration specification.++<a id="remove_template-example"></a> #### Example@@ -486,4 +534,6 @@ ``` +<a id="remove_template-access-requirements"></a>+ #### Access requirements @@ -514,4 +564,6 @@ Shows all templates that you can run, or that you have submitted, to the specified collaboration. +<a id="view_templates-syntax"></a>+ #### Syntax @@ -519,4 +571,6 @@ VIEW_TEMPLATES( <collaboration_name> ) ```++<a id="view_templates-arguments"></a> #### Arguments@@ -531,4 +585,6 @@ </dl> +<a id="view_templates-returns"></a>+ #### Returns @@ -537,5 +593,5 @@ - `template_id`: The template ID. Pass this into the `template` field or `template_id` parameter of your RUN command.-- `template_spec`: The [template specification](#label-dcr-collaboration-add-templates-to-collaboration) for this template, which+- `template_spec`: The [template specification](/user-guide/cleanrooms/resources-templates#label-dcr-collaboration-add-templates-to-collaboration) for this template, which includes the full [JinjaSQL](/user-guide/cleanrooms/custom-templates) for this template. - `parameters`: A description of all the arguments accepted by this template, in JSON format. The information about each parameter@@ -545,4 +601,6 @@ - `shared_with`: The collaborators that this template is shared with. +<a id="view_templates-example"></a>+ #### Example @@ -552,4 +610,6 @@ ); ```++<a id="view_templates-access-requirements"></a> #### Access requirements@@ -582,4 +642,6 @@ This affects only requests sent after auto-approval was enabled. +<a id="enable_template_auto_approval-syntax"></a>+ #### Syntax @@ -587,4 +649,6 @@ ENABLE_TEMPLATE_AUTO_APPROVAL( <collaboration_name> ) ```++<a id="enable_template_auto_approval-arguments"></a> #### Arguments@@ -599,7 +663,11 @@ </dl> +<a id="enable_template_auto_approval-returns"></a>+ #### Returns A string success message.++<a id="enable_template_auto_approval-example"></a> #### Example@@ -610,4 +678,6 @@ ); ```++<a id="enable_template_auto_approval-access-requirements"></a> #### Access requirements@@ -639,4 +709,6 @@ Disables automatic approval for template requests raised by other collaborators. All future requests must be approved manually by calling APPROVE_UPDATE_REQUEST. +<a id="disable_template_auto_approval-syntax"></a>+ #### Syntax @@ -644,4 +716,6 @@ DISABLE_TEMPLATE_AUTO_APPROVAL( <collaboration_name> ) ```++<a id="disable_template_auto_approval-arguments"></a> #### Arguments@@ -656,7 +730,11 @@ </dl> +<a id="disable_template_auto_approval-returns"></a>+ #### Returns A string success message.++<a id="disable_template_auto_approval-example"></a> #### Example@@ -667,4 +745,6 @@ ); ```++<a id="disable_template_auto_approval-access-requirements"></a> #### Access requirements@@ -698,5 +778,7 @@ If you want to share this table with others in the collaboration, include the table in the collaboration specification before the collaboration is created. -You must have the REFERENCE_USAGE privilege with GRANT OPTION on any data that you share in a collaboration. If you do not, you will get a "missing reference usage grant" error when you try to join the collaboration or register the object. [Learn how to handle this issue.](#label-dcr-database-missing-reference-usage-error)+You must have the REFERENCE_USAGE privilege with GRANT OPTION on any data that you share in a collaboration. If you do not, you will get a "missing reference usage grant" error when you try to join the collaboration or register the object. [Learn how to handle this issue.](/user-guide/cleanrooms/v2/troubleshooting#label-dcr-database-missing-reference-usage-error)++<a id="register_data_offering-syntax"></a> #### Syntax@@ -705,4 +787,6 @@ REGISTER_DATA_OFFERING( ['<registry_name>' ,] <data_offering_spec> ) ```++<a id="register_data_offering-arguments"></a> #### Argume... (truncated)
差分が長いため、途中まで表示しています。
ファイル操作ツールについて、CoCoがコード・設定・文書の理解や変更時に利用する場面を追記し、Read／Write／Edit／Glob／Grepの説明を具体化しました。特にEditは既存ファイルの部分変更に優先され、replace_allによる一括置換にも対応すること、Readの画像・PDF・ノートブック対応や@file.py$10-20構文が明記されました。Shell toolsでは、Bashが永続セッションで動作し、run_in_backgroundやタイムアウト（既定2分、最大10分）をサポートする説明が追加されています。
影響: CoCoにファイル編集やテスト・ビルドを依頼する際、既存ファイルにはEdit、新規作成にはWrite、長時間処理にはrun_in_backgroundを使うという使い分けが明確になります。
変更内容: 本文を更新（203行追加・117行削除）
--- ahttps://docs.snowflake.com/en/user-guide/cortex-code/tools+++ bhttps://docs.snowflake.com/en/user-guide/cortex-code/tools@@ -26,33 +26,50 @@ ## File tools +These tools let CoCo read, write, search, and navigate files in your local filesystem. CoCo uses them+whenever your request involves understanding or modifying code, configuration, or documentation files.+ ### Read -Read file contents from the local filesystem. Supports:+Read file contents from the local filesystem. CoCo uses this tool whenever it needs to understand existing+code before making changes, inspect configuration files, or view the contents of documents you reference.++Supports: - Text files with line numbers-- Images (PNG, JPG, etc.) - displayed visually-- PDFs - page-by-page extraction-- Jupyter notebooks - cells with outputs-- Line ranges: @file.py$10-20+- Images (PNG, JPG, etc.) displayed visually through the multimodal model+- PDFs with page-by-page text and visual extraction+- Jupyter notebooks with cells and their outputs+- Line ranges using the `@file.py$10-20` syntax for targeted reads ### Write -Create or overwrite files. Supports:--- Creates parent directories automatically-- Tracks line changes for session statistics-- Overwrites existing files+Create new files or overwrite existing ones. CoCo uses this tool when generating new files from scratch,+such as scaffolding a new module, creating configuration files, or writing scripts.++Supports:++- Automatic parent directory creation+- Line change tracking for session statistics+- Full file overwrite (for partial changes, CoCo uses Edit instead) ### Edit -Search and replace in files. Supports:--- Exact string replacement-- Diff preview before changes-- Supports replace_all for global replacement+Perform targeted search-and-replace edits within existing files. CoCo prefers this tool over Write when+modifying existing code, because it changes only the specific lines that need updating while preserving+the rest of the file.++Supports:++- Exact string matching and replacement+- Diff preview before applying changes+- `replace_all` mode for renaming variables or updating repeated patterns across a file ### Glob -Find files by pattern matching. Examples:+Find files by name or path pattern. CoCo uses this tool to locate files before reading or editing them,+especially when you reference a file by partial name or when CoCo needs to discover related files in a+project.++Example patterns: | Pattern | Description |@@ -65,44 +82,65 @@ ### Grep -Search file contents using a regular expression. Supports:--- Recursive search-- Regex patterns-- Binary file detection-- Output modes: content, files, count+Search file contents using regular expressions. CoCo uses this tool to find specific code patterns,+function definitions, error messages, or configuration values across your project.++Supports:++- Recursive directory search+- Full regex pattern syntax+- Binary file detection and skipping+- Output modes: matching content lines, file paths only, or match counts ## Shell tools +These tools give CoCo access to your terminal environment for running commands, installing packages,+running tests, and interacting with developer tools like `git`, `npm`, or `docker`.+ ### Bash -Execute shell commands. Supports:--- Streaming output-- Background execution (run_in_background)-- Timeout control (default 2 min, max 10 min)-- Sandbox runtime support+Execute shell commands in a persistent session. CoCo uses this tool for operations that require system+access: running tests, installing dependencies, executing builds, interacting with version control,+or any task that goes beyond file manipulation.++Supports:++- Streaming output for long-running commands+- Background execution with `run_in_background` for servers and watchers+- Configurable timeout (default 2 minutes, maximum 10 minutes)+- Sandbox mode for restricted environments ### BashOutput -Retrieve output from a background shell process.--- Filter output by regex-- Status checking-- Use with run_in_background+Retrieve output from a command that was previously launched in the background. CoCo uses this tool to+check on the status of long-running processes like development servers or test suites.++Supports:++- Regex filtering to show only relevant output lines+- Process status checking (running, completed, or failed)+- Incremental output retrieval (only new lines since last check) ### KillShell -Terminate running background shells.+Terminate a running background shell process. CoCo uses this tool to stop servers, cancel stuck+commands, or clean up processes that are no longer needed. ## Agent tools +These tools let CoCo delegate work to specialized subagents, ask you questions during execution,+and coordinate complex multi-step workflows.+ ### RunSubagent -Launch subagents for specialized tasks. Types:--- general-purpose: All tools, research tasks-- Explore: Fast codebase exploration-- Plan: Architecture and planning-- Custom agents from .cortex/agents/+Launch an autonomous subagent to handle a specific subtask. CoCo uses this tool when a task benefits+from parallel execution or when a specialized agent type is better suited to the work. Each subagent+runs independently and returns its results when finished.++Available subagent types:++- **general-purpose**: Full tool access, used for research and multi-step tasks+- **Explore**: Optimized for fast codebase navigation and search+- **Plan**: Focused on architecture decisions and implementation planning+- **Custom agents**: Defined in your project's `.cortex/agents/` directory See [](#extensibility-subagents) for details.@@ -110,58 +148,83 @@ ### AskUserQuestion -Prompt user for input during execution. Supports:--- Multiple choice questions-- Free-form input-- Multi-select options+Prompt you for input when CoCo needs clarification or a decision. CoCo uses this tool instead of+guessing when your intent is ambiguous, when multiple valid approaches exist, or when a decision+requires your judgment.++Supports:++- Multiple choice questions with descriptions+- Free-form text input with suggested defaults+- Multi-select options for non-exclusive choices ### Review -Launch a review subagent for quality assurance.+Launch a specialized review subagent to check work for quality issues. CoCo may use this tool+after completing implementation work to verify correctness. ## Web tools +These tools let CoCo search the internet and fetch web page content, providing access to current+documentation, API references, and other online resources.+ ### WebSearch -Search the Web using multiple engines. Supports:--- Fallback search engines-- Snippet extraction-- Result caching+Search the web for current information. CoCo uses this tool when your question involves recent+events, external documentation, or information beyond its training data.++Supports:++- Multiple search engine fallbacks for reliability+- Snippet extraction from search results+- Result caching to avoid redundant searches+- 30-second timeout per search++WebSearch requires enabling web search in the CoCo settings in %sf-web-interface%. See [](#label-cortex-code-web-search).++### WebFetch++Retrieve and extract text content from a specific URL. CoCo uses this tool when you share a link,+when it needs to read documentation at a known URL, or when search results point to a relevant page.++Supports:++- Automatic HTML-to-text conversion+- Content extraction and cleaning+- Maximum 10,000 characters per fetch - 30-second timeout -WebSearch requires enabling web search in the CoCo settings in %sf-web-interface%. See [](#label-cortex-code-web-search).--### WebFetch--Retrieve content from web URLs. Supports:--- HTML to text conversion-- Content extraction-- Max 10,... (truncated)
差分が長いため、途中まで表示しています。
Snowflake Terraform providerが追加され、DCM ProjectsとTerraformを対象レイヤー別に使い分ける方針へ変更されました。DCM Projectsはデータベース内オブジェクト向けの推奨ツール、Terraform providerはアカウントレベルのオブジェクトやSnowflake外のインフラ向けと明確化され、両者は補完的に併用できると説明されています。 影響: Snowflake内のデータベースオブジェクトにはDCM Projects、アカウント設定や外部インフラにはTerraform providerを選ぶ運用設計が必要になります。
変更内容: 本文を更新（125行追加・12行削除）
--- ahttps://docs.snowflake.com/en/developer-guide/builders/devops-with-snowflake+++ bhttps://docs.snowflake.com/en/developer-guide/builders/devops-with-snowflake@@ -5,4 +5,5 @@ - [](/sql-reference/sql/execute-dcm-project) - [Snowflake CLI](/developer-guide/snowflake-cli/index)+- [](/user-guide/terraform) - [Python APIs](/developer-guide/snowflake-python-api/snowflake-python-overview) - [Git in Snowflake](/developer-guide/git/git-overview)@@ -19,6 +20,6 @@ DevOps with Snowflake brings software engineering best practices to data infrastructure management. The core principles are: -- **Define as code.** Declare the desired state of your Snowflake objects in version-controlled files. Snowflake determines and applies- the necessary changes (create, alter, or drop) to reach that state.+- **Define as code.** Declare the desired state of your Snowflake objects in version-controlled files. The tool you choose compares+ those definitions against the current state and applies the necessary changes (create, alter, or drop) to reach it. - **Validate before you deploy.** Preview proposed changes in a plan step before applying them to your account. Review creates, alters, and drops, then deploy when you're confident the changes are correct.@@ -26,7 +27,14 @@ merges, or scheduled runs rather than manual steps. -The recommended approach is to use [DCM Projects](/user-guide/dcm-projects/dcm-projects-overview) (Database Change Management-Projects), which unify declarative object management, plan-then-deploy validation, multi-environment targeting, and CI/CD automation-into a single workflow.+Snowflake supports two declarative tools for managing objects as code, and they cover different layers:++- [DCM Projects](/user-guide/dcm-projects/dcm-projects-overview) (Database Change Management Projects) are the Snowflake-native+ option for the objects inside your databases. They unify declarative object management, plan-then-deploy validation,+ multi-environment targeting, and CI/CD automation into a single workflow.+- The [Snowflake Terraform provider](/user-guide/terraform) covers account-level objects and any infrastructure you manage outside+ Snowflake, alongside your other Terraform providers.++The two are complementary, and many organizations use both. For guidance on which to use where, see+[](#label-builder-devops-dcm-vs-terraform). <a id="label-builder-devops-devops-building-blocks"></a>@@ -40,10 +48,10 @@ ## Define your Snowflake objects as code -### DCM Projects (recommended)+### DCM Projects [DCM Projects](/user-guide/dcm-projects/dcm-projects-overview) (Database Change Management Projects) provide a declarative,-infrastructure-as-code approach to managing your Snowflake environment. Instead of writing imperative scripts that specify each step, you-define the desired target state of your objects. Snowflake compares those definitions against the current state and determines the-necessary changes.+infrastructure-as-code approach to managing your Snowflake environment, and are the recommended option for the objects inside your+databases. Instead of writing imperative scripts that specify each step, you define the desired target state of your objects.+Snowflake compares those definitions against the current state and determines the necessary changes. A DCM project consists of:@@ -77,5 +85,85 @@ deployments, see [](/user-guide/dcm-projects/dcm-projects-overview). +<a id="label-builder-devops-terraform"></a>++### Snowflake Terraform provider++The [Snowflake Terraform provider](/user-guide/terraform) lets you manage Snowflake objects with+[HashiCorp Terraform](https://www.terraform.io/), the tool many teams already use for their cloud infrastructure. You declare+resources in Terraform configuration files, run a plan to preview the changes, and then apply them to converge your account to+the declared state.++The provider runs outside Snowflake and manages objects by issuing SQL statements, so the changes it makes appear in your+account's [query history](/user-guide/ui-snowsight-activity). Because it's one of many Terraform providers, you can manage+Snowflake objects and non-Snowflake resources in the same configuration: for example, a cloud storage bucket and the Snowflake+storage integration that reads from it.++For installation, versioning, preview features, and support boundaries, see [](/user-guide/terraform).++<a id="label-builder-devops-dcm-vs-terraform"></a>++### Choosing between DCM Projects and Terraform++DCM Projects and Terraform solve the same problem at different layers, and many organizations use both: Terraform for the+account-level layer that platform teams own, and DCM Projects for the objects inside databases that data engineers own. Both+manage roles and grants, so at that layer the choice depends on which team owns them.++The following table compares the two tools:++<div className="colwidths-given">++ <colgroup>+ <col style={{width: "20.0%"}} />+ <col style={{width: "40.0%"}} />+ <col style={{width: "40.0%"}} />+ </colgroup>+ <thead>+ <tr>+ <th>Consideration</th>+ <th>DCM Projects</th>+ <th>Snowflake Terraform provider</th>+ </tr>+ </thead>+ <tbody>+ <tr>+ <td>Typical scope</td>+ <td>Objects inside a database, such as schemas, tables, views, dynamic tables, and tasks, plus databases, warehouses, and roles</td>+ <td>Account-level objects, such as users, integrations, and policies</td>+ </tr>+ <tr>+ <td>Resources outside Snowflake</td>+ <td>Not supported; Snowflake objects only</td>+ <td>Supported through other Terraform providers in the same configuration</td>+ </tr>+ <tr>+ <td>Authoring language</td>+ <td>SQL `DEFINE` statements, with Jinja2 templating built in</td>+ <td>Terraform configuration language (HCL), with modules for reuse</td>+ </tr>+ <tr>+ <td>Where it runs</td>+ <td>Inside Snowflake, executed by your account</td>+ <td>Outside Snowflake, wherever you run Terraform</td>+ </tr>+ <tr>+ <td>Multiple environments</td>+ <td>Deployment targets and configuration profiles in `manifest.yml`</td>+ <td>Terraform modules and per-environment pipelines</td>+ </tr>+ </tbody>++</div>++Whichever tool you choose, confirm that it covers the object types you need. See+[](/user-guide/dcm-projects/dcm-projects-supported-entities) for DCM Projects and the+[provider documentation](https://registry.terraform.io/providers/snowflakedb/snowflake/latest/docs) for Terraform.++If you already have a Terraform setup that works, you don't need to replace it. You can adopt DCM Projects alongside it for+schema-level objects. Manage each object with only one tool, so that the two don't compete to reconcile the same state.+ ### dbt Projects on Snowflake++dbt Projects do a different job from DCM Projects and Terraform: they manage SQL transformations rather than the declared state of+your objects, so you typically use them alongside one of the tools above. [dbt Projects on Snowflake](/user-guide/data-engineering/dbt-projects-on-snowflake) let you deploy and run@@ -88,7 +176,8 @@ ### Alternative: CREATE OR ALTER with versioned scripts -For individual object changes outside of a DCM project, you can use the [](/sql-reference/sql/create-or-alter) command, which creates-the object or alters it to match the definition specified by the command. By using this command from a versioned file in a remote-repository, you can roll back changes to a previous version by executing a previous version of the file.+For individual object changes outside of a DCM project or a Terraform configuration, you can use the+[](/sql-reference/sql/create-or-alter) command, which creates the object or alters it to match the definition specified by the+command. By using this command from a versioned file in a remote r... (truncated)
差分が長いため、途中まで表示しています。
ページ内容が create から drop コマンドの説明に改訂され、指定したコンピュートプールを削除する構文と例になった。作成用パラメータ群を削除し、削除時の --if-exists（既定値: False）を追加した。
影響: 既存の作成コマンド向け説明を参照している利用者は、コンピュートプール削除には snow spcs compute-pool drop と --if-exists を使用する内容へ読み替える必要がある。
変更内容: 本文を更新（10行追加・74行削除）
--- ahttps://docs.snowflake.com/en/developer-guide/snowflake-cli/command-reference/spcs-commands/compute-pool-commands/drop+++ bhttps://docs.snowflake.com/en/developer-guide/snowflake-cli/command-reference/spcs-commands/compute-pool-commands/drop@@ -5,25 +5,16 @@ - [spcs command reference](/developer-guide/snowflake-cli/command-reference/spcs-commands/overview) - [compute-pool commands reference](/developer-guide/snowflake-cli/command-reference/spcs-commands/compute-pool-commands/overview)-- [](/developer-guide/snowflake-cli/command-reference/spcs-commands/compute-pool-commands/stop-all)+- [](/sql-reference/sql/drop-compute-pool) You can use Snowpark Container Services from Snowflake CLI only if you have the necessary permissions to use Snowpark Container Services. -Creates a new compute pool.+Drops the specified compute pool. ## Syntax ```console-snow spcs compute-pool create+snow spcs compute-pool drop <name>- --family <instance_family>- --min-nodes <min_nodes>- --max-nodes <max_nodes>- --auto-resume- --no-auto-resume- --init-suspend / --no-init-suspend- --auto-suspend-secs <auto_suspend_secs>- --tag <tags>- --comment <comment>- --if-not-exists+ --if-exists --connection <connection> --host <host>@@ -78,62 +69,8 @@ <dl>-<dt><code className="samp">--family <em>TEXT</em></code></dt>-<dd>--Name of the instance family. For more information about instance families, refer to the SQL CREATE COMPUTE POOL command.--</dd>-<dt>`--min-nodes {INTEGER RANGE}`</dt>-<dd>--Minimum number of nodes for the compute pool. Default: 1.--</dd>-<dt>`--max-nodes {INTEGER RANGE}`</dt>-<dd>--Maximum number of nodes for the compute pool.--</dd>-<dt>`--auto-resume`</dt>-<dd>--The compute pool will automatically resume when a service or job is submitted to it. Default: False.--</dd>-<dt>`--no-auto-resume`</dt>-<dd>--The compute pool will automatically resume when a service or job is submitted to it. Default: False.--</dd>-<dt>`--init-suspend / --no-init-suspend`</dt>-<dd>--Starts the compute pool in a suspended state. Default: False.--</dd>-<dt>`--auto-suspend-secs {INTEGER RANGE}`</dt>-<dd>--Number of seconds of inactivity after which you want Snowflake to automatically suspend the compute pool. Default: 3600.--</dd>-<dt><code className="samp">--tag <em>NAME=VALUE</em></code></dt>-<dd>--Tag for the compute pool.--</dd>-<dt><code className="samp">--comment <em>TEXT</em></code></dt>-<dd>--Comment for the compute pool.--</dd>-<dt>`--if-not-exists`</dt>-<dd>--Only apply this operation if the specified object does not already exist. Default: False.+<dt>`--if-exists`</dt>+<dd>++Only apply this operation if the specified object exists. Default: False. </dd>@@ -371,8 +308,7 @@ ## Examples -The following example creates a compute pool named "pool_1" using the minimal CPU_X64_XS family, which comprises two-CPUs with 4GB of memory.+The following example drops a compute pool named "pool_1". ```snowcli-snow spcs compute-pool create "pool_1" --min-nodes 2 --max-nodes 2 --family "CPU_X64_XS"+snow spcs compute-pool drop "pool_1" ```
Output セクションが追加され、SHOW APPLICATION PACKAGES の出力列と説明が明記されました。created_on、name、distribution、retention_time、multiple_instances など、アプリケーションパッケージのプロパティやメタデータを示す 13 列が文書化されています。
影響: 出力列の意味や options が常に空、type が常に NATIVE であることを確認でき、メタデータ参照や結果の処理に活用しやすくなります。
変更内容: 本文を更新（73行追加・0行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/show-application-packages+++ bhttps://docs.snowflake.com/en/sql-reference/sql/show-application-packages@@ -118,4 +118,77 @@ The double quotes ensure that the column names in the SELECT list or WHERE clause match the column names in the SHOW command output that was scanned.++## Output++The command output provides application package properties and metadata in the following columns:++<div className="colwidths-given">++ <colgroup>+ <col style={{width: "25.0%"}} />+ <col style={{width: "75.0%"}} />+ </colgroup>+ <thead>+ <tr>+ <th>Column</th>+ <th>Description</th>+ </tr>+ </thead>+ <tbody>+ <tr>+ <td>`created_on`</td>+ <td>Date and time when the application package was created.</td>+ </tr>+ <tr>+ <td>`name`</td>+ <td>The name of the application package.</td>+ </tr>+ <tr>+ <td>`is_default`</td>+ <td>Specifies whether the application package is in the default namespace for the current user.</td>+ </tr>+ <tr>+ <td>`is_current`</td>+ <td>Specifies whether the application package is in the current session context.</td>+ </tr>+ <tr>+ <td>`distribution`</td>+ <td>The distribution type of the application package. Valid values are `INTERNAL` and `EXTERNAL`.</td>+ </tr>+ <tr>+ <td>`owner`</td>+ <td>The role that owns the application package.</td>+ </tr>+ <tr>+ <td>`comment`</td>+ <td>Text that provides information about the application package.</td>+ </tr>+ <tr>+ <td>`options`</td>+ <td>Reserved for future use. This field is always empty.</td>+ </tr>+ <tr>+ <td>`retention_time`</td>+ <td>The Time Travel retention period for the application package, in days.</td>+ </tr>+ <tr>+ <td>`dropped_on`</td>+ <td>The date and time when the application package was dropped. `NULL` if the application package has not been dropped.</td>+ </tr>+ <tr>+ <td>`application_class`</td>+ <td>Reserved for internal use.</td>+ </tr>+ <tr>+ <td>`multiple_instances`</td>+ <td>Indicates whether the provider has configured the application package to allow consumers to install multiple instances of an app. Valid values are `TRUE` and `FALSE`.</td>+ </tr>+ <tr>+ <td>`type`</td>+ <td>The type of the application package. This value is always `NATIVE`.</td>+ </tr>+ </tbody>++</div> ## Examples
2026年8月28日付で、Runtime Operator、Ingress Controller、Control Plane／Data Plane、UI などにセキュリティ修正と依存関係更新が追加されました。Control Plane Core 0.130.0 では診断バンドル生成の自動リトライ、Data Plane Service 0.130.0 では一時的な活動データ欠落時の誤った idle 表示の修正、AWS Data Plane Agent 1.62.0 では IAM 伝播遅延や証明書ずれ、Terraform 状態不整合、membership ring 障害からのデプロイ自動復旧が追加されています。 影響: 診断バンドル生成、コネクタ状態表示、AWS データプレーンのデプロイ信頼性が向上し、障害時の手動対応を減らせます。
変更内容: 本文を更新（60行追加・0行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/version-history+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/version-history@@ -254,4 +254,64 @@ </div> +## August 28, 2026++<a id="label-runtime-operator-0-75-0"></a>++### Runtime Operator 0.75.0++- Security patches and dependency upgrades.++<a id="label-ingress-controller-2026-8-25-18"></a>++### Ingress Controller 2026.8.25-18++- Security patches and dependency upgrades.++<a id="label-control-plane-core-0-130-0"></a>++### Control Plane Core 0.130.0++- Diagnostic bundle generation is now more reliable — transient failures are automatically retried rather than requiring manual intervention.+- Security patches and dependency upgrades.++<a id="label-data-plane-service-0-130-0"></a>++### Data Plane Service 0.130.0++- Fixed an issue where connectors were incorrectly shown as idle when activity data was temporarily unavailable.+- Security patches and dependency upgrades.++<a id="label-control-plane-ui-0-89-0"></a>++### Control Plane UI 0.89.0++- Security patches and dependency upgrades.++<a id="label-data-plane-ui-0-21-0"></a>++### Data Plane UI 0.21.0++- Security patches and dependency upgrades.++<a id="label-openflow-token-refresher-1-19-0"></a>++### Openflow Token Refresher 1.19.0++- Security patches and dependency upgrades.++<a id="label-aws-data-plane-agent-1-62-0"></a>++### AWS Data Plane Agent 1.62.0++- Improved deployment reliability across several common failure scenarios, including slow IAM propagation, certificate drift after upgrades, and Terraform state inconsistencies with custom ingress rules.+- Deployments now automatically recover from membership ring issues that could previously cause stuck or degraded runtime states.+- Security patches and dependency upgrades.++<a id="label-spcs-data-plane-agent-1-46-0"></a>++### SPCS Data Plane Agent 1.46.0++- Security patches and dependency upgrades.+ ## August 25, 2026
CREATE APPLICATION、CREATE APPLICATION PACKAGE、CREATE PREVIEW APPLICATION の権限説明が追加され、いずれも ACCOUNTADMIN ロールによる付与が必要と明記されました。CREATE PREVIEW APPLICATION は QA または ALPHA リリースチャネルからの作成時に必要で、さらに Application instance privileges に OWNERSHIP（削除を含む完全な制御）が追加されました。
影響: アプリケーションの作成や非デフォルトチャネルからのインストールには、ACCOUNTADMIN による明示的な権限付与が必要になり、アプリケーションインスタンスの完全管理権限も文書化されました。
変更内容: 本文を更新（40行追加・0行削除）
--- ahttps://docs.snowflake.com/en/user-guide/security-access-control-privileges+++ bhttps://docs.snowflake.com/en/user-guide/security-access-control-privileges@@ -655,4 +655,19 @@ <td>CREATE ACCOUNT</td> <td>Enables a data provider to create a new managed account (i.e. reader account). For more details, see [](/user-guide/data-sharing-reader-create).</td>+ <td>Must be granted by the ACCOUNTADMIN role.</td>+ </tr>+ <tr>+ <td>CREATE APPLICATION</td>+ <td>Enables creating a new [%native-app%](/developer-guide/native-apps/native-apps-about) from an application package or listing.</td>+ <td>Must be granted by the ACCOUNTADMIN role.</td>+ </tr>+ <tr>+ <td>CREATE APPLICATION PACKAGE</td>+ <td>Enables creating a new [application package](/developer-guide/native-apps/creating-app-package) to develop a %native-app%.</td>+ <td>Must be granted by the ACCOUNTADMIN role.</td>+ </tr>+ <tr>+ <td>CREATE PREVIEW APPLICATION</td>+ <td>Enables creating a %native-app% from a non-default release channel (`QA` or `ALPHA`). Not required when installing from the `DEFAULT` release channel.</td> <td>Must be granted by the ACCOUNTADMIN role.</td> </tr>@@ -4010,4 +4025,29 @@ </div> +## Application instance privileges++<a id="label-application-instance-privileges"></a>++<div className="colwidths-given">++ <colgroup>+ <col style={{width: "20.0%"}} />+ <col style={{width: "80.0%"}} />+ </colgroup>+ <thead>+ <tr>+ <th>Privilege</th>+ <th>Usage</th>+ </tr>+ </thead>+ <tbody>+ <tr>+ <td>OWNERSHIP</td>+ <td>Grants full control over the application instance, including dropping it. Only a single role can hold this privilege on a specific application at a time.</td>+ </tr>+ </tbody>++</div>+ ## Contact privileges
OPENFLOW_USAGE_HISTORY は Openflow BYOC デプロイメントのみを返すことが明記され、Snowflake Deployment は対象外となり、コスト確認先が追加されました。列定義では DATA_PLANE_NAME と RUNTIME_TYPE が削除され、RUNTIME_ID は RUNTIME_KEY に変更され、DATA_PLANE_TYPE は BYOC のみ、DATA_PLANE_CREDITS_USED は常に 0 と説明されています。 影響: Snowflake Deployment のコストはこのビューでは追跡できないため、指定されたコスト確認ページを参照する必要があります。
変更内容: 本文を更新（10行追加・30行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/account-usage/openflow_usage_history+++ bhttps://docs.snowflake.com/en/sql-reference/account-usage/openflow_usage_history@@ -11,4 +11,8 @@ This Account Usage view returns the hourly runtime credit usage for an account within the last 365 days (1 year).++This view returns records only for Openflow BYOC deployments. It doesn't return records for Openflow Snowflake+Deployments, which are billed under the *OPENFLOW_COMPUTE_SNOWFLAKE* service type. To track the cost of an Openflow+Snowflake Deployment, see [](/user-guide/data-integration/openflow/cost-spcs). <a id="label-openflow-usage-history-columns"></a>@@ -42,21 +46,9 @@ </tr> <tr>- <td>DATA_PLANE_NAME</td>- <td>VARCHAR</td>- <td>Name of the data plane which incurred the credit usage.</td>- </tr>- <tr> <td>DATA_PLANE_TYPE</td> <td>VARCHAR</td> <td> -Type of the data plane. Supported values include:--<blockquote>--- *BYOC*-- *SNOWFLAKE*--</blockquote>+Type of the data plane. The only value currently returned is *BYOC*. </td>@@ -67,14 +59,14 @@ <td> -Number of compute credits the data plane used in the hour.-The data plane credits are only incurred for SNOWFLAKE data planes.-For *BYOC*, there are no credits incurred for data planes and customers are charged credits only for runtime usage.+Number of compute credits the data plane used in the hour. This value is always 0, because *BYOC* data planes+run on infrastructure you manage and incur no Snowflake compute credits. For *BYOC*, you're charged credits only+for runtime usage. </td> </tr> <tr>- <td>RUNTIME_ID</td>+ <td>RUNTIME_KEY</td> <td>VARCHAR</td>- <td>ID of the runtime which incurred the credit usage.</td>+ <td>Key identifying the runtime which incurred the credit usage.</td> </tr> <tr>@@ -82,16 +74,4 @@ <td>VARCHAR</td> <td>Name of the runtime which incurred the credit usage.</td>- </tr>- <tr>- <td>RUNTIME_TYPE</td>- <td>VARCHAR</td>- <td>--Type of the runtime. Supported values include:--- *RUNTIME*-- *READ_ONLY RUNTIME*--</td> </tr> <tr>
各種の Python、JavaScript、cURL サンプルで、指定モデルが claude-sonnet-4-5 から openai-gpt-5 に変更された。通常のチャット、ストリーミング、ツール呼び出し、構造化出力の例に適用されている。 影響: サンプルを利用する場合は、指定モデルを openai-gpt-5 に更新する必要がある。
変更内容: 本文を更新（18行追加・18行削除）
--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-rest-api+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-rest-api@@ -94,5 +94,5 @@ response = client.chat.completions.create(- model="claude-sonnet-4-5",+ model="openai-gpt-5", messages=[ {"role": "system", "content": "You are a helpful assistant."},@@ -114,5 +114,5 @@ const response = await client.chat.completions.create({- model: "claude-sonnet-4-5",+ model: "openai-gpt-5", messages: [ { role: "system", content: "You are a helpful assistant." },@@ -131,5 +131,5 @@ -H "Authorization: Bearer <SNOWFLAKE_PAT>" \ -d '{- "model": "claude-sonnet-4-5",+ "model": "openai-gpt-5", "messages": [ {"role": "user", "content": "How does a snowflake get its unique pattern?"}@@ -998,5 +998,5 @@ response = client.chat.completions.create(- model="claude-sonnet-4-5",+ model="openai-gpt-5", messages=[ {"role": "system", "content": "You are a helpful assistant."},@@ -1020,5 +1020,5 @@ const stream = await client.chat.completions.create({- model: "claude-sonnet-4-5",+ model: "openai-gpt-5", messages: [ { role: "system", content: "You are a helpful assistant." },@@ -1040,5 +1040,5 @@ -H "Authorization: Bearer <SNOWFLAKE_PAT>" \ -d '{- "model": "claude-sonnet-4-5",+ "model": "openai-gpt-5", "messages": [ {"role": "user", "content": "How does a snowflake get its unique pattern?"}@@ -1178,5 +1178,5 @@ # Step 1: Send the request with tools response = client.chat.completions.create(- model="claude-sonnet-4-5",+ model="openai-gpt-5", messages=messages, tools=tools,@@ -1201,5 +1201,5 @@ final_response = client.chat.completions.create(- model="claude-sonnet-4-5",+ model="openai-gpt-5", messages=messages, tools=tools,@@ -1244,5 +1244,5 @@ // Step 1: Send the request with tools const response = await client.chat.completions.create({- model: "claude-sonnet-4-5",+ model: "openai-gpt-5", messages, tools,@@ -1267,5 +1267,5 @@ const finalResponse = await client.chat.completions.create({- model: "claude-sonnet-4-5",+ model: "openai-gpt-5", messages, tools,@@ -1285,5 +1285,5 @@ -H "Authorization: Bearer <SNOWFLAKE_PAT>" \ -d '{- "model": "claude-sonnet-4-5",+ "model": "openai-gpt-5", "messages": [ {"role": "user", "content": "What is the weather like in San Francisco?"}@@ -1343,5 +1343,5 @@ -H "Authorization: Bearer <SNOWFLAKE_PAT>" \ -d '{- "model": "claude-sonnet-4-5",+ "model": "openai-gpt-5", "messages": [ {"role": "user", "content": "What is the weather like in San Francisco?"},@@ -1670,5 +1670,5 @@ response = client.chat.completions.create(- model="claude-sonnet-4-5",+ model="openai-gpt-5", messages=[ {"role": "user", "content": "Create a dataset of 3 people with their names and ages."}@@ -1713,5 +1713,5 @@ const response = await client.chat.completions.create({- model: "claude-sonnet-4-5",+ model: "openai-gpt-5", messages: [ { role: "user", content: "Create a dataset of 3 people with their names and ages." }@@ -1753,5 +1753,5 @@ -H "Authorization: Bearer <SNOWFLAKE_PAT>" \ -d '{- "model": "claude-sonnet-4-5",+ "model": "openai-gpt-5", "messages": [ {"role": "user", "content": "Create a dataset of 3 people with their names and ages."}@@ -1958,5 +1958,5 @@ response = client.chat.completions.create(- model="claude-sonnet-4-5",+ model="openai-gpt-5", messages=[ {@@ -1994,5 +1994,5 @@ const response = await client.chat.completions.create({- model: "claude-sonnet-4-5",+ model: "openai-gpt-5", messages: [ {@@ -2024,5 +2024,5 @@ -H "Authorization: Bearer <SNOWFLAKE_PAT>" \ -d '{- "model": "claude-sonnet-4-5",+ "model": "openai-gpt-5", "messages": [ {
execute-as ロール名が汎用名から OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL に変更され、ランタイム名を含む形式になりました。また、<RUNTIME_NAME> の説明と「What is an execute-as role?」へのリンクが明確化され、権限付与手順の表現も整理されています。
影響: ランタイムごとに異なるロール名を使用し、ユーザー・ウェアハウス・Snowflake オブジェクトへの GRANT 文をそのロール名に合わせて設定する必要があります。
変更内容: 本文を更新（18行追加・18行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/setup-openflow-spcs-create-rr+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/setup-openflow-spcs-create-rr@@ -18,6 +18,6 @@ This topic describes the creation of these resources. -1. Create an execute-as role and associated privileges for runtimes in Snowflake deployments-2. Associate the execute-as role with the runtime.+1. Create an execute-as role and grant it the privileges needed to write data to Snowflake.+2. Associate the execute-as role with a runtime. 3. Create External Access Integrations and associate them to Runtimes. See [Creating External Access Integrations](#label-create-network-rules-and-external-access-integrations)@@ -28,7 +28,7 @@ ## Create an execute-as role -When creating and editing Openflow Runtimes, Runtime Owners will have the ability to associate a role with the Runtime.-This role will be used for flows that execute within the Runtime.-For more information about execute-as roles, see [](#label-openflow-spcs-what-is-runtime-role).+When creating and editing Openflow runtimes, runtime owners associate a role with the runtime.+This role is used for flows that execute within the runtime.+For more information, see [What is an execute-as role?](/user-guide/data-integration/openflow/about-spcs#label-openflow-spcs-what-is-runtime-role). Creating an execute-as role is a prerequisite for creating a runtime and involves the following steps:@@ -41,8 +41,8 @@ To create an execute-as role: -1. Create the required execute-as role.+1. Create the role. - `` denotes the name of the associated runtime.+ `<RUNTIME_NAME>` denotes the name of the associated runtime. @@ -50,25 +50,25 @@ USE ROLE ACCOUNTADMIN; - CREATE ROLE IF NOT EXISTS OPENFLOW_RUNTIME_ROLE_;+ CREATE ROLE IF NOT EXISTS OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; - GRANT ROLE OPENFLOW_RUNTIME_ROLE_ TO USER <username>;+ GRANT ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL TO USER <username>; ``` -2. Allow the execute-as role to use an existing warehouse that you are planning to use for data ingestion.- Use this warehouse later when configuring your connectors for runtimes where you will be using this execute-as role.+2. Allow the execute-as role to use an existing warehouse that you plan to use for data ingestion.+ Use this warehouse later when configuring your connectors for runtimes where you use this execute-as role. ```sql- GRANT USAGE, OPERATE ON WAREHOUSE <OPENFLOW_INGEST_WAREHOUSE> TO ROLE OPENFLOW_RUNTIME_ROLE_;+ GRANT USAGE, OPERATE ON WAREHOUSE <OPENFLOW_INGEST_WAREHOUSE> TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` -3. Allow the execute-as role to use, create or otherwise access Snowflake objects.+3. Allow the execute-as role to use, create, or otherwise access Snowflake objects. - Depending on the Openflow connector being created the required underlying objects will vary.+ Depending on the Openflow connector being created, the required underlying objects vary. The example below is for illustration purposes only. ```sql- GRANT USAGE ON DATABASE <OPENFLOW_SPCS_DATABASE> TO ROLE OPENFLOW_RUNTIME_ROLE_;- GRANT USAGE ON SCHEMA <OPENFLOW_SPCS_SCHEMA> TO ROLE OPENFLOW_RUNTIME_ROLE_;+ GRANT USAGE ON DATABASE <OPENFLOW_SPCS_DATABASE> TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL;+ GRANT USAGE ON SCHEMA <OPENFLOW_SPCS_SCHEMA> TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` @@ -87,5 +87,5 @@ 1. Create the network rule, grouping the network identifiers into logical areas.-2. Create the external access integration (EAI), specifying the list of network rules and assuring the execute-as role has USAGE on the EAI.+2. Create the external access integration (EAI), specifying the list of network rules and ensuring the execute-as role has USAGE on the EAI. 3. Associate the EAI with the Runtime in the Openflow UI when creating Runtimes. @@ -147,5 +147,5 @@ 3. Grant access to the EAI to the previously created execute-as role. ```sql- GRANT USAGE ON INTEGRATION OPENFLOW_<RUNTIME_NAME>_EAI TO ROLE OPENFLOW_RUNTIME_ROLE_<RUNTIME_NAME>;+ GRANT USAGE ON INTEGRATION OPENFLOW_<RUNTIME_NAME>_EAI TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ```
SNOWFLAKE_MANAGED 認証を使用するコネクタが、特定の Openflow runtime に紐づく execute-as role（またはその子ロール）の権限で実行されることを明記。ロール名のプレースホルダーを <RUNTIME_NAME> に統一し、作成・権限付与 SQL を OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL を使う構文へ更新。
影響: execute-as role の作成時および warehouse・Snowflake オブジェクト・ユーザーへの権限付与時に、更新後のロール命名規則と SQL 構文へ合わせる必要がある。
変更内容: 本文を更新（14行追加・14行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/setup-openflow-byoc+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/setup-openflow-byoc@@ -90,34 +90,34 @@ #### Execute-as role -An execute-as role is a Snowflake role associated with a specific Openflow runtime and used for the following tasks:+An execute-as role is a Snowflake role bound to a specific Openflow runtime. Connectors that use `SNOWFLAKE_MANAGED` authentication run with this role's privileges (or those of a child role granted to it). The execute-as role is used for the following tasks: - Grant access to Snowflake resources. - Grant access to connector-specific resources. -Execute-as roles are linked to Openflow Snowflake Managed Token, avoiding the need for customers to create separate service users and key pairs for authentication to Snowflake.--<RUNTIMENAME> denotes the name of the associated runtime.+Because execute-as roles are linked to Openflow managed tokens, you don't need to create separate service users and key pairs for authentication to Snowflake.++<RUNTIME_NAME> denotes the name of the associated runtime. To create an execute-as role: -1. Create the required execute-as role.+1. Create the role. ```sql USE ROLE ACCOUNTADMIN;- CREATE ROLE IF NOT EXISTS OPENFLOW_RUNTIME_ROLE_+ CREATE ROLE IF NOT EXISTS OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` 2. Grant the execute-as role access to a warehouse. Snowflake recommends using a dedicated warehouse for data ingestion.- This warehouse should be used when configuring your connectors for runtimes where you will be using this execute-as role.+ This warehouse should be used when configuring your connectors for runtimes where you use this execute-as role. ```sql- GRANT USAGE, OPERATE ON WAREHOUSE <OPENFLOW_INGEST_WAREHOUSE> TO ROLE OPENFLOW_RUNTIME_ROLE_;+ GRANT USAGE, OPERATE ON WAREHOUSE <OPENFLOW_INGEST_WAREHOUSE> TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` -3. Allow the execute-as role to use, create or otherwise access Snowflake objects.+3. Allow the execute-as role to use, create, or otherwise access Snowflake objects. <blockquote> - Depending on the Openflow connector being created, the required underlying objects will vary.+ Depending on the Openflow connector being created, the required underlying objects vary. The example below is for illustration purposes only. @@ -126,11 +126,11 @@ ```sql- GRANT USAGE ON DATABASE <OPENFLOW_DATABASE> TO ROLE OPENFLOW_RUNTIME_ROLE_;- GRANT USAGE ON SCHEMA <OPENFLOW_SCHEMA> TO ROLE OPENFLOW_RUNTIME_ROLE_;+ GRANT USAGE ON DATABASE <OPENFLOW_DATABASE> TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL;+ GRANT USAGE ON SCHEMA <OPENFLOW_SCHEMA> TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` -4. Allow the user to use the execute-as role+4. Allow the user to use the execute-as role. ```sql- GRANT ROLE OPENFLOW_RUNTIME_ROLE_ TO USER <username>;+ GRANT ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL TO USER <username>; ```
SNOWFLAKE_MANAGED の認証では、使用するロールが従来の Snowflake ロールから ランタイムの execute-as role（またはその子ロール） に変更されました。BYOC で事前設定が必要な「runtime roles」も「execute-as roles」に改称され、Openflow UI の案内表記も更新されています。 影響: SNOWFLAKE_MANAGED を利用する場合は、Openflow の Runtime に設定された execute-as role またはその子ロールを指定する必要があります。
変更内容: 本文を更新（11行追加・11行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/box/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/box/setup@@ -262,5 +262,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -335,6 +335,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user. @@ -518,5 +518,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -591,6 +591,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user. @@ -1014,5 +1014,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -1087,6 +1087,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user. @@ -1240,5 +1240,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -1259,5 +1259,5 @@ <tr> <td>Snowflake Role</td>- <td>When using SNOWFLAKE_MANAGED Authentication Strategy, use your Snowflake Role. You can find your Snowflake Role in the Openflow UI, by going to View Details for your Runtime. When using Key Pair Authentication Strategy, use a valid role configured for your service user.</td>+ <td>When using SNOWFLAKE_MANAGED Authentication Strategy, use the runtime's execute-as role (or a child role granted to it). You can find your execute-as role in the Openflow UI by going to View Details for your runtime. When using Key Pair Authentication Strategy, use a valid role configured for your service user.</td> </tr> <tr>
MULTIPLE_INSTANCES 設定時のアプリ最大インストール数が 10 件から 30 件に増加しました。また、ENABLE_RELEASE_CHANNELS は TRUE または FALSEを指定でき、既定値は TRUE（省略時も有効）で、FALSE を作成時に指定すると従来のバージョン・パッチ管理を利用できます。
影響: 既存設定への影響は限定的ですが、リリースチャネルを無効化したい場合はアプリケーションパッケージ作成時に ENABLE_RELEASE_CHANNELS = FALSE を明示する必要があります。
変更内容: 本文を更新（11行追加・8行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-application-package+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-application-package@@ -37,5 +37,5 @@ [ LISTING_AUTO_REFRESH = { TRUE | FALSE } ] [ MULTIPLE_INSTANCES = TRUE ]- [ ENABLE_RELEASE_CHANNELS = TRUE ]+ [ ENABLE_RELEASE_CHANNELS = { TRUE | FALSE } ] ``` @@ -168,15 +168,18 @@ set for applications packages that are included in a trial or paid listing. -When multiple instances are allowed, consumers can install a maximum of 10 instances of an app in their account.+When multiple instances are allowed, consumers can install a maximum of 30 instances of an app in their account. After this property is set to `TRUE`, it cannot be set to `FALSE` or unset later. </dd>-<dt>`ENABLE_RELEASE_CHANNELS = TRUE | FALSE`</dt>-<dd>--Enables [release channels](/developer-guide/native-apps/release-channels) for the application package.--After setting this property to `TRUE`, it cannot be set to `FALSE` or unset later.+<dt>`ENABLE_RELEASE_CHANNELS = { TRUE | FALSE }`</dt>+<dd>++Enables or disables [release channels](/developer-guide/native-apps/release-channels) for the application package.++- `TRUE` enables release channels. This is the default. You can also omit this parameter; release channels are enabled automatically.+- `FALSE` disables release channels. Specify this value at create time to opt out of release channels and use the legacy version and patch management workflow instead.++After this property is set to `TRUE`, it cannot be set to `FALSE` or unset later. </dd>
2026_07 バンドルのプレビュー情報が追加されました。10.32 リリース（2026年9月4〜8日予定）では Disabled by Default として導入され、アカウント管理者がテスト用に有効化できます。その後、2026年10月のリリースで Enabled by Default、さらにその後のリリースで Generally Enabled への変更が予定されています（いずれも変更の可能性あり）。 影響: 管理者は 2026_07 の導入を事前にテストでき、既定で有効化される時期に備えて影響を確認する必要があります。
変更内容: 本文を更新（16行追加・0行削除）
--- ahttps://docs.snowflake.com/en/release-notes/behavior-changes+++ bhttps://docs.snowflake.com/en/release-notes/behavior-changes@@ -50,4 +50,20 @@ <tbody> <tr>+ <td>**2026_07**</td>+ <td>++Planned to be introduced in the 10.32 release (September 4-8, 2026, subject to change) as **Disabled by Default**; once introduced, account admins can enable for testing.++Status planned to change in a subsequent October 2026 release to **Enabled by Default**; however, this schedule is+subject to change.++Status planned to change in a release after October 2026 to **Generally Enabled**; however, this schedule+is subject to change.++</td>+ <td></td>+ <td>This is a preview of the upcoming release of the 2026_07 bundle.</td>+ </tr>+ <tr> <td>**2026_06**</td> <td>
2026年8月26日リリースの Snowpark Connect 1.40.0 で、未対応の Delta Lake 書き込み時に暗黙的な別テーブル作成をせずエラーを返すようになり、レガシー JSON/CSV の日時解析フォールバック設定も転送されます。さらに、pandas UDTF の chained mapInPandas・mapInArrow・cogroup、uncacheTable と引数なしの addArtifacts() の no-op 動作が修正され、Iceberg の CALL system.ancestors_of がサポートされました。
影響: 未対応の Delta Lake 書き込みはエラーとして検知されるため処理の見直しが必要になる一方、対象の日時解析設定や pandas UDTF、Iceberg 操作の互換性・期待どおりの動作が改善します。
変更内容: 本文を更新（16行追加・0行削除）
--- ahttps://docs.snowflake.com/en/release-notes/clients-drivers/snowpark-connect-2026+++ bhttps://docs.snowflake.com/en/release-notes/clients-drivers/snowpark-connect-2026@@ -9,4 +9,20 @@ For documentation, see [](/developer-guide/snowpark-connect/snowpark-connect-apache-spark) and [](/developer-guide/snowpark-connect/snowpark-connect-orchestration).++## 1.40.0 (August 26, 2026)++### %spconnect%++#### Bug fixes++- Raise errors for unsupported Delta Lake writes instead of silently creating other table types+- Forward legacy JSON and CSV date-time parsing fallback session settings+- Fix chained `mapInPandas`, `mapInArrow`, and `cogroup` with pandas UDTFs+- Make `uncacheTable` a no-op when the table is not cached+- Treat `addArtifacts()` with no paths as a no-op++#### New features++- Support Iceberg `CALL system.ancestors_of` ## 1.39.0 (August 19, 2026)
Account Usage に MODEL_SERVING_USAGE_HISTORY（Historical）が追加され、データ保持期間は 1年と記載されました。また、このビューに対するアクセス権として USAGE_VIEWER が追加されました。 影響: モデルサービングの利用履歴を Account Usage で参照できるようになります。
変更内容: 本文を更新（14行追加・0行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/account-usage+++ bhttps://docs.snowflake.com/en/sql-reference/account-usage@@ -799,4 +799,11 @@ </tr> <tr>+ <td>[MODEL_SERVING_USAGE_HISTORY](/sql-reference/account-usage/model_serving_usage_history)</td>+ <td>Historical</td>+ <td></td>+ <td></td>+ <td>Data retained for 1 year.</td>+ </tr>+ <tr> <td>[NETWORK_POLICIES](/sql-reference/account-usage/network_policies)</td> <td>Object</td>@@ -2072,4 +2079,11 @@ <td> [METERING_HISTORY view](/sql-reference/account-usage/metering_history)+ </td>+ <td>USAGE_VIEWER</td>+ </tr>+ <tr>+ <td>+ [MODEL_SERVING_USAGE_HISTORY+ view](/sql-reference/account-usage/model_serving_usage_history) </td> <td>USAGE_VIEWER</td>
依存関係のバージョン範囲の説明が明確化され、PyPI の pandas>=2.0.0,<3.0.0 は「2.0.0 以上、3.0.0 未満」、JFrog の pandas=2.* は「2.x 範囲」と表現されました。その他は conda や dropdown の表記修正、文言調整、不要な Admonition タグの削除などの体裁変更で、機能・構文の追加や削除はありません。
影響: バージョン指定の解釈が明確化されますが、依存関係の動作や設定方法に実質的な変更はありません。
変更内容: 本文を更新（5行追加・7行削除）
--- ahttps://docs.snowflake.com/en/developer-guide/streamlit/app-development/dependency-management+++ bhttps://docs.snowflake.com/en/developer-guide/streamlit/app-development/dependency-management@@ -153,5 +153,5 @@ When migrating between runtimes or changing your package manager, review your dependency names. For example, some packages have different names between-Conda and PyPI:+conda and PyPI: <div className="colwidths-given">@@ -297,6 +297,4 @@ If one or more artifact repositories are configured on an app, EAIs will not work as artifact repos override the uv environment in the container runtime.--</Admonition > In certain cases, you may need to access PyPI or another external repository, but cannot use an artifact repository@@ -437,5 +435,5 @@ If you have an EAI for PyPI, the following `pyproject.toml` file declares-a minimum Python version of 3.11 and includes four Python packages which will be+a minimum Python version of 3.11 and includes four Python packages that will be installed from PyPI: @@ -466,5 +464,5 @@ To pin a version of a package, you must use the `==` operator. To specify a version range, you must use `<`, `<=`, `>=`, and `>` operators. For example, `pandas>=2.0.0,<3.0.0` will install-any version between 2.0.0 and 2.99.99. For more information, see [Dependency specifiers](https://packaging.python.org/en/latest/specifications/dependency-specifiers/).+any version from 2.0.0 up to (but not including) 3.0.0. For more information, see [Dependency specifiers](https://packaging.python.org/en/latest/specifications/dependency-specifiers/). #### JFrog dependency file examples@@ -562,5 +560,5 @@ To pin a version of a package, you must use the `=` operator. To specify a version range, you must use `*` wildcards. For example, `pandas=2.*` will install-any version of pandas between 2.0.0 and 2.99.99.+any version of pandas in the 2.x range. ### Local development with conda@@ -604,5 +602,5 @@ 4. In the upper-left corner of the editor pane, select **Packages**. - A drop-down pane appears with the **Anaconda Packages** tab selected.+ A dropdown pane appears with the **Anaconda Packages** tab selected. 5. Do any of the following actions:
ゼロ設定ファイルアップロードの対応形式が、従来の7種類の列挙からカテゴリ別の一覧に更新され、.md・.doc・.xlsや各種画像形式（.png、.jpgなど）が追加されました。1ファイル50 MB未満、最大5ファイルという制限は変更ありません。
影響: 画像や追加の文書・表計算形式をアップロードできるようになり、利用可能な入力ファイルの範囲が広がります。
変更内容: 本文を更新（5行追加・7行削除）
--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/snowflake-cowork+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/snowflake-cowork@@ -108,11 +108,9 @@ %sf-intelligence% supports the following file types for zero-setup file upload: -- CSV-- DOCX-- JSON-- PDF-- PPTX-- TXT-- XLSX+- Documents: `.pdf`, `.txt`, `.md`, `.docx`, `.doc`+- Spreadsheets: `.xlsx`, `.xls`, `.csv`+- Presentations: `.pptx`+- Code and data: `.json`+- Images: `.png`, `.jpg`, `.jpeg`, `.gif`, `.svg`, `.bmp`, `.tiff`, `.tif`, `.webp`, `.heic`, `.heif` Each file must be less than 50 MB, and users can upload up to 5 files.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（6行追加・6行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/sharepoint/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/sharepoint/setup@@ -396,5 +396,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -469,6 +469,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user. @@ -728,5 +728,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -801,6 +801,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（6行追加・6行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/security/workload-identity-federation+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/security/workload-identity-federation@@ -85,7 +85,7 @@ ```sql-GRANT USAGE ON DATABASE wif_demo TO ROLE openflow_runtime_role;-GRANT USAGE ON SCHEMA wif_demo.secrets_schema TO ROLE openflow_runtime_role;-GRANT USAGE ON SECRET wif_demo.secrets_schema.my_demo TO ROLE openflow_runtime_role;+GRANT USAGE ON DATABASE wif_demo TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL;+GRANT USAGE ON SCHEMA wif_demo.secrets_schema TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL;+GRANT USAGE ON SECRET wif_demo.secrets_schema.my_demo TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` @@ -186,5 +186,5 @@ ENABLED = TRUE; -GRANT USAGE ON INTEGRATION openflow_sqs_eai TO ROLE openflow_runtime_role;+GRANT USAGE ON INTEGRATION openflow_sqs_eai TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` @@ -271,5 +271,5 @@ ENABLED = TRUE; -GRANT USAGE ON INTEGRATION openflow_azure_eai TO ROLE openflow_runtime_role;+GRANT USAGE ON INTEGRATION openflow_azure_eai TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` @@ -387,5 +387,5 @@ ENABLED = TRUE; -GRANT USAGE ON INTEGRATION openflow_gcs_eai TO ROLE openflow_runtime_role;+GRANT USAGE ON INTEGRATION openflow_gcs_eai TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ```
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（5行追加・5行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/google-big-query/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/google-big-query/setup@@ -38,5 +38,5 @@ If you are using Openflow - BYOC, you need to configure your cloud network egress to allow TLS 443 access to the endpoints listed above.-If you are using %ofsfspcs-plural%, you need to create a network rule and an external access integration (EAI). Then, grant the Snowflake Role usage privileges on the EAI.+If you are using %ofsfspcs-plural%, you need to create a network rule and an external access integration (EAI). Then, grant the execute-as role usage privileges on the EAI. ## Set up BigQuery@@ -121,5 +121,5 @@ - To allow the connector to call the required Google APIs from a Snowflake-hosted runtime, you must create a network rule and an external access integration (EAI). Then, grant the Snowflake role usage privileges on the EAI.+ To allow the connector to call the required Google APIs from a Snowflake-hosted runtime, you must create a network rule and an external access integration (EAI). Then, grant the execute-as role usage privileges on the EAI. To create the external access integration and network rule and grant access, perform the following steps:@@ -147,8 +147,8 @@ ``` - 3. Grant your Snowflake Role USAGE on the integration:+ 3. Grant your execute-as role USAGE on the integration: ```sql GRANT USAGE ON INTEGRATION openflow_<runtime_name>_eai- TO ROLE openflow_runtime_role_<runtime_name>;+ TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` @@ -296,5 +296,5 @@ When using: -- `SNOWFLAKE_MANAGED` Authentication Strategy: Use your Snowflake Role. You can find your Snowflake Role in the Openflow UI, by navigating to View Details for your Runtime.+- `SNOWFLAKE_MANAGED` Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it). You can find your execute-as role in the Openflow UI by navigating to View Details for your runtime. - `KEY_PAIR` Authentication Strategy: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（5行追加・5行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/streaming/configuring-dead-letter-queue-handling+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/streaming/configuring-dead-letter-queue-handling@@ -88,5 +88,5 @@ - You have an existing **Kafka high-performance** or **Kinesis high-performance** connector deployed in Openflow. - You know where failed records should go (a Kafka topic / Kinesis stream, or a Snowflake table).-- For a **Snowflake table** destination: the runtime role can insert data into the target table (see [Grants](#label-openflow-streaming-dlq-grants)).+- For a **Snowflake table** destination: the execute-as role can insert data into the target table (see [Grants](#label-openflow-streaming-dlq-grants)). - For a **messaging destination** (Kafka topic / Kinesis stream): follow the connector-specific page. @@ -163,10 +163,10 @@ ### Grants -The runtime role needs the following grants:+The execute-as role needs the following grants: ```sql-GRANT USAGE ON DATABASE <db> TO ROLE <execute_as_role>;-GRANT USAGE ON SCHEMA <db>.<schema> TO ROLE <execute_as_role>;-GRANT INSERT ON TABLE <db>.<schema>.<table> TO ROLE <execute_as_role>;+GRANT USAGE ON DATABASE <db> TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL;+GRANT USAGE ON SCHEMA <db>.<schema> TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL;+GRANT INSERT ON TABLE <db>.<schema>.<table> TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ```
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（5行追加・5行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/google-drive/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/google-drive/setup@@ -306,5 +306,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -379,6 +379,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user. @@ -547,5 +547,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -566,5 +566,5 @@ <tr> <td>Snowflake Role</td>- <td>When using SNOWFLAKE_MANAGED Authentication Strategy, use your Snowflake Role. You can find your Snowflake Role in the Openflow UI, by going to View Details for your Runtime. When using Key Pair Authentication Strategy, use a valid role configured for your service user.</td>+ <td>When using SNOWFLAKE_MANAGED Authentication Strategy, use the runtime's execute-as role (or a child role granted to it). You can find your execute-as role in the Openflow UI by going to View Details for your runtime. When using Key Pair Authentication Strategy, use a valid role configured for your service user.</td> </tr> <tr>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（5行追加・5行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/shopify/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/shopify/setup@@ -173,5 +173,5 @@ To allow the connector to call the Shopify API from a Snowflake-hosted runtime, create a-network rule and an external access integration (EAI), and then grant the Snowflake role usage+network rule and an external access integration (EAI), and then grant the execute-as role usage privileges on the EAI. @@ -196,8 +196,8 @@ ``` -3. Grant your Snowflake role USAGE on the integration:+3. Grant your execute-as role USAGE on the integration: ```sql GRANT USAGE ON INTEGRATION openflow_<runtime_name>_shopify_eai- TO ROLE openflow_runtime_role_<runtime_name>;+ TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` @@ -372,5 +372,5 @@ Authentication strategy for the connector to connect to Snowflake. -- `SNOWFLAKE_MANAGED` (default): Uses the Snowflake-managed token associated with the specified Snowflake runtime role. Snowflake recommends this option for both %ofsfspcs-plural% and %ofbyoc-plural%.+- `SNOWFLAKE_MANAGED` (default): Uses the Snowflake-managed token associated with the runtime's execute-as role. Snowflake recommends this option for both %ofsfspcs-plural% and %ofbyoc-plural%. - `KEY_PAIR`: Uses a user-provided RSA key pair. Available only on %ofbyoc-plural%, for cross-account scenarios. @@ -417,5 +417,5 @@ <tr> <td>Snowflake Role</td>- <td>The Snowflake role used for table creation, data ingestion, and access verification.</td>+ <td>The execute-as role used for table creation, data ingestion, and access verification.</td> </tr> <tr>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（5行追加・5行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/veeva-vault/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/veeva-vault/setup@@ -131,5 +131,5 @@ To allow the connector to call the Veeva Vault API from a Snowflake-hosted runtime, create a-network rule and an external access integration (EAI), and then grant the Snowflake role usage+network rule and an external access integration (EAI), and then grant the execute-as role usage privileges on the EAI. @@ -151,8 +151,8 @@ ``` -3. Grant your Snowflake role USAGE on the integration:+3. Grant your execute-as role USAGE on the integration: ```sql GRANT USAGE ON INTEGRATION openflow_<runtime_name>_veeva_eai- TO ROLE openflow_runtime_role_<runtime_name>;+ TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ``` @@ -275,5 +275,5 @@ Authentication strategy for the connector to connect to Snowflake. -- `SNOWFLAKE_MANAGED` (default): Uses the Snowflake-managed token associated with the specified Snowflake runtime role. This is the recommended strategy for both %ofsfspcs-plural% and %ofbyoc-plural%.+- `SNOWFLAKE_MANAGED` (default): Uses the Snowflake-managed token associated with the runtime's execute-as role. This is the recommended strategy for both %ofsfspcs-plural% and %ofbyoc-plural%. - `KEY_PAIR`: Uses a user-provided RSA key pair. Available only on %ofbyoc-plural%, for cross-account scenarios where the connector writes to a Snowflake account different from the one hosting the Openflow runtime. @@ -310,5 +310,5 @@ <tr> <td>Snowflake Role</td>- <td>The Snowflake role used for table creation, data ingestion, and access verification. When using `SNOWFLAKE_MANAGED`, this is the Snowflake role for Openflow runtimes. When using `KEY_PAIR`, this is the role assigned to the specified Snowflake user.</td>+ <td>The execute-as role used for table creation, data ingestion, and access verification. When using `SNOWFLAKE_MANAGED`, this is the execute-as role for Openflow runtimes. When using `KEY_PAIR`, this is the role assigned to the specified Snowflake user.</td> </tr> <tr>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（10行追加・0行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-application+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-application@@ -241,4 +241,14 @@ </tr> <tr>+ <td>CREATE PREVIEW APPLICATION</td>+ <td>Account</td>+ <td>++Required to create an app from a non-default release channel (QA or ALPHA). Not required+when using `USING RELEASE CHANNEL DEFAULT` or when the `USING RELEASE CHANNEL` clause is omitted.++</td>+ </tr>+ <tr> <td>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（9行追加・0行削除）
--- ahttps://docs.snowflake.com/en/release-notes/preview-features+++ bhttps://docs.snowflake.com/en/release-notes/preview-features@@ -78,4 +78,13 @@ </thead> <tbody>+ <tr>+ <td>Stable egress IP addresses on Azure</td>+ <td>Open</td>+ <td>August 2026</td>+ <td>[](/user-guide/egress-ip/network-egress), [](/sql-reference/functions/system_get_snowflake_egress_ip_ranges)</td>+ <td>+ Generate Snowflake egress IP address ranges to allowlist on external servers. This preview covers Azure deployments. The feature is generally available on AWS Commercial deployments.+ </td>+ </tr> <tr> <td>Remote Development with the %sf-vscext%</td>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（6行追加・2行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/cost-spcs+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/cost-spcs@@ -71,8 +71,12 @@ - [METERING_HISTORY](/sql-reference/account-usage/metering_history) -Compute pool costs related to Openflow appear under *SERVICE_TYPE* as *OPENFLOW_COMPUTE_SNOWFLAKE*.+Compute pool costs related to Openflow appear under *SERVICE_TYPE* as *OPENFLOW_COMPUTE_SNOWFLAKE*. In these rows,+*NAME* returns the name of the compute pool that incurred the cost, which lets you separate Openflow Management+Services costs from runtime costs. The [OPENFLOW_USAGE_HISTORY](/sql-reference/account-usage/openflow_usage_history) view currently does not-contain records for the *OPENFLOW_COMPUTE_SNOWFLAKE* service type.+contain records for the *OPENFLOW_COMPUTE_SNOWFLAKE* service type. That view covers Openflow BYOC deployments only.++As a result, per-runtime cost attribution isn't available for Openflow Snowflake Deployments. For more information on compute costs in Snowflake, see [](/user-guide/cost-exploring-compute).
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（4行追加・4行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/revoke-privilege+++ bhttps://docs.snowflake.com/en/sql-reference/sql/revoke-privilege@@ -79,7 +79,7 @@ ACCOUNT | APPLICATION | APPLICATION PACKAGE | COMPUTE POOL | LISTING | DATABASE | EXTERNAL VOLUME | FAILOVER GROUP | INTEGRATION | NETWORK POLICY- | ORGANIZATION LISTING | ORGANIZATION PROFILE | REPLICATION GROUP | ROLE | SHARE- | USER | WAREHOUSE- }+ | ORGANIZATION LISTING | ORGANIZATION PROFILE | PREVIEW APPLICATION+ | REPLICATION GROUP | ROLE | SHARE | USER | WAREHOUSE+ } | ATTACH POLICY | AUDIT | BIND SERVICE ENDPOINT | APPLY {@@ -90,5 +90,5 @@ | EXECUTE { ALERT | DATA METRIC FUNCTION | MANAGED ALERT | MANAGED TASK | TASK } | IMPORT { SHARE | ORGANIZATION LISTING }- | MANAGE { ACCOUNT SUPPORT CASES | EVENT SHARING | GRANTS | LISTING AUTO FULFILLMENT | ORGANIZATION SUPPORT CASES | SHARE TARGET | USER SUPPORT CASES | VISIBILITY | WAREHOUSES }+ | MANAGE { ACCOUNT SUPPORT CASES | APPLICATION SPECIFICATIONS | EVENT SHARING | GRANTS | LISTING AUTO FULFILLMENT | ORGANIZATION SUPPORT CASES | SHARE TARGET | USER SUPPORT CASES | VISIBILITY | WAREHOUSES } | MODIFY { LOG LEVEL | TRACE LEVEL | SESSION LOG LEVEL | SESSION TRACE LEVEL } | MONITOR { EXECUTION | SECURITY | USAGE }
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（6行追加・2行削除）
--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-setup+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-setup@@ -2,4 +2,6 @@ This feature is not available in the People's Republic of China.++- [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling) Access to Cortex Agents is governed by Snowflake's role-based access control. This topic covers the database roles and privileges that let users create, manage, and call agents, along with the authentication methods the API supports.@@ -132,7 +134,9 @@ Because the agent runs with the querying user's default role, that role also needs privileges on the objects used by the agent's tools: -`USAGE` on the agent isn't sufficient on its own. If the user's default role is missing privileges on a tool or on the objects behind it, the request is rejected with a 4XX error instead of running without that tool. The specific error depends on which tool access is missing. Grant the privileges for every tool the agent uses.+`USAGE` on the agent isn't sufficient on its own. The user's default role also needs privileges on each tool you expect the agent to use. Grant the privileges in the following table for those tools. -The exception is an `agent_toolset` reference, which is skipped when the role doesn't have `USAGE` on the referenced agent.+By default (`accept`), a missing privilege on a configured tool doesn't reject the entire run. The agent continues with the tools the role can access and reports the rest as warnings. Set `orchestration.tool_not_accessible` to `reject` or `legacy` if you want the run to fail instead. For modes, which tools Snowflake checks, and warning format, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling).++An `agent_toolset` reference is skipped when the role doesn't have `USAGE` on the referenced agent. <thead>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（6行追加・2行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/alter-agent+++ bhttps://docs.snowflake.com/en/sql-reference/sql/alter-agent@@ -101,4 +101,5 @@ orchestration:+ tool_not_accessible: <accept | reject | legacy> budget: seconds: <number_of_seconds>@@ -141,4 +142,5 @@ }, "orchestration": {+ "tool_not_accessible": "<accept | reject | legacy>", "budget": { "seconds": <number_of_seconds>,@@ -207,5 +209,5 @@ <td>`orchestration`</td> <td>[](/user-guide/snowflake-cortex/cortex-agents-rest-api#label-snowflake-agent-object-orchestrationconfig)</td>- <td>An optional orchestration configuration, including budget constraints (e.g., seconds, tokens).</td>+ <td>An optional orchestration configuration, including budget constraints (seconds, tokens) and `tool_not_accessible` (`accept`, `reject`, or `legacy`). If `tool_not_accessible` is omitted, the default is `accept`. For details, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling).</td> </tr> <tr>@@ -304,4 +306,5 @@ - Both YAML and JSON formats are supported for specifications. - Invalid specification fields result in an error.+- To control whether a missing privilege on a configured tool aborts the run, set `orchestration.tool_not_accessible`. For details, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling). - Regarding metadata: @@ -342,4 +345,5 @@ orchestration:+ tool_not_accessible: accept budget: seconds: 30@@ -358,5 +362,5 @@ ```sql ALTER AGENT my_support_agent- MODIFY LIVE VERSION SET SPECIFICATION = '{"models":{"orchestration":"claude-4-sonnet"},"orchestration":{"budget":{"seconds":45,"tokens":80000}}}';+ MODIFY LIVE VERSION SET SPECIFICATION = '{"models":{"orchestration":"claude-4-sonnet"},"orchestration":{"tool_not_accessible":"accept","budget":{"seconds":45,"tokens":80000}}}'; ```
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（7行追加・0行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/snowflake-db-roles+++ bhttps://docs.snowflake.com/en/sql-reference/snowflake-db-roles@@ -539,4 +539,11 @@ <td> [METERING_HISTORY view](/sql-reference/account-usage/metering_history)+ </td>+ <td>USAGE_VIEWER</td>+ </tr>+ <tr>+ <td>+ [MODEL_SERVING_USAGE_HISTORY+ view](/sql-reference/account-usage/model_serving_usage_history) </td> <td>USAGE_VIEWER</td>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/meta-ads/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/meta-ads/setup@@ -181,5 +181,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -254,6 +254,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/linkedin-ads/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/linkedin-ads/setup@@ -221,5 +221,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -294,6 +294,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/jira-cloud/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/jira-cloud/setup@@ -221,5 +221,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -294,6 +294,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/hubspot/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/hubspot/setup@@ -193,5 +193,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -266,6 +266,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/google-sheets/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/google-sheets/setup@@ -175,5 +175,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -248,6 +248,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/google-ads/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/google-ads/setup@@ -265,5 +265,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -338,6 +338,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/amazon-ads/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/amazon-ads/setup@@ -223,5 +223,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -296,6 +296,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/sql-server-cdc/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/sql-server-cdc/setup@@ -895,5 +895,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -1017,6 +1017,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use Snowflake Role assigned to the runtime or child role granted to this Snowflake Role.- You can find your runtime Snowflake Role in the Openflow UI, by expanding the **More Options [⋮]** button for your runtime and selecting **Set Snowflake role**.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/workday/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/workday/setup@@ -207,5 +207,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -280,6 +280,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/postgres/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/postgres/setup@@ -643,5 +643,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -728,6 +728,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use Snowflake Role assigned to the runtime or child role granted to this Snowflake Role.- You can find your runtime Snowflake Role in the Openflow UI, by expanding the **More Options [⋮]** button for your runtime and selecting **Set Snowflake role**.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/mysql/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/mysql/setup@@ -544,5 +544,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -629,6 +629,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use Snowflake Role assigned to the runtime or child role granted to this Snowflake Role.- You can find your runtime Snowflake Role in the Openflow UI, by expanding the **More Options [⋮]** button for your runtime and selecting **Set Snowflake role**.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/mongodb/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/mongodb/setup@@ -218,9 +218,9 @@ When using: -- `SNOWFLAKE_MANAGED` Authentication Strategy: Use your Runtime Role. You can find your Runtime- Role in the Openflow UI, by navigating to View Details for your Runtime.+- `SNOWFLAKE_MANAGED` Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it). You can find your+ execute-as role in the Openflow UI by navigating to View Details for your runtime. - `KEY_PAIR` Authentication Strategy: Use a valid role configured for your service user. -Example: `OPENFLOW_ROLE`+Example: `OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL` </td>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/dataverse/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/dataverse/setup@@ -227,5 +227,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -300,6 +300,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（5行追加・1行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-agent+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-agent@@ -84,4 +84,5 @@ orchestration:+ tool_not_accessible: <accept | reject | legacy> budget: seconds: <number_of_seconds>@@ -141,5 +142,5 @@ <td>`orchestration`</td> <td>[](/user-guide/snowflake-cortex/cortex-agents-rest-api#label-snowflake-agent-object-orchestrationconfig)</td>- <td>An optional orchestration configuration, including budget constraints (e.g., seconds, tokens).</td>+ <td>An optional orchestration configuration, including budget constraints (seconds, tokens) and `tool_not_accessible` (`accept`, `reject`, or `legacy`). If `tool_not_accessible` is omitted, the default is `accept`. For details, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling).</td> </tr> <tr>@@ -188,4 +189,6 @@ Customers should ensure that no personal data (other than for a User object), sensitive data, export-controlled data, or other regulated data is entered as metadata when using the Snowflake service. For more information, see [Metadata fields in Snowflake](/sql-reference/metadata). ++- To control whether a missing privilege on a configured tool aborts the run, set `orchestration.tool_not_accessible`. For details, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling). ## Examples@@ -201,4 +204,5 @@ orchestration:+ tool_not_accessible: accept budget: seconds: 30
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/about-spcs+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/about-spcs@@ -37,5 +37,5 @@ ### What is an execute-as role? -An execute-as role is a Snowflake role associated with a specific Openflow runtime, used for the following tasks:+An execute-as role is a Snowflake role bound to a specific Openflow runtime. Connectors that use `SNOWFLAKE_MANAGED` authentication run with this role's privileges (or those of a child role granted to it). The execute-as role is used for the following tasks: - Grant access to external access integrations (EAIs).@@ -43,7 +43,7 @@ to access the data sources and destinations from within Snowflake itself. - Grant access to Snowflake resources.-- Grant access to resources that are connector-specific+- Grant access to resources that are connector-specific. -Execute-as roles are linked to Openflow session tokens, avoiding the need for customers+Because execute-as roles are linked to Openflow session tokens, you don't need to create separate service users and key pairs for authentication to Snowflake.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/jira-cloud/setup-core+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/jira-cloud/setup-core@@ -281,5 +281,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -354,6 +354,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/jira-cloud/setup-agile+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/jira-cloud/setup-agile@@ -285,5 +285,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -358,6 +358,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake role.- You can find your Snowflake role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（6行追加・0行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/organization-usage+++ bhttps://docs.snowflake.com/en/sql-reference/organization-usage@@ -307,4 +307,10 @@ </tr> <tr>+ <td>[MODEL_SERVING_USAGE_HISTORY](/sql-reference/organization-usage/model_serving_usage_history)</td>+ <td>Historical</td>+ <td>24 hours</td>+ <td>[Premium view](/user-guide/organization-accounts-premium-views) (only available in organization account).</td>+ </tr>+ <tr> <td>[MONETIZED_USAGE_DAILY](/collaboration/views/monetized-usage-daily-org)</td> <td>Historical</td>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/oracle/setup-connector+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/oracle/setup-connector@@ -290,5 +290,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -375,6 +375,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use Snowflake Role assigned to the runtime or child role granted to this Snowflake Role.- You can find your runtime Snowflake Role in the Openflow UI, by expanding the **More Options [⋮]** button for your runtime and selecting **Set Snowflake role**.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（6行追加・0行削除）
--- ahttps://docs.snowflake.com/en/release-notes/bcr-bundles/un-bundled/unbundled-behavior-changes+++ bhttps://docs.snowflake.com/en/release-notes/bcr-bundles/un-bundled/unbundled-behavior-changes@@ -213,4 +213,10 @@ <tbody> <tr>+ <td>**September 2, 2026**</td>+ <td>Cortex Agents, %sf-intelligence%</td>+ <td>[](/release-notes/bcr-bundles/un-bundled/bcr-2425)</td>+ <td>Cortex Agents and %sf-intelligence% continue a run with the tools the caller's role can access instead of failing with an HTTP 4XX error. Set `orchestration.tool_not_accessible` to `legacy` before the rollout to keep the current behavior.</td>+ </tr>+ <tr> <td>**August 20, 2026**</td> <td>Azure access: Snowflake Network Identifiers for rules that filter based on subnet IDs</td>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/snowflake-to-kafka/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/snowflake-to-kafka/setup@@ -143,5 +143,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -172,6 +172,6 @@ When using -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use your Snowflake Role.- You can find your Snowflake Role in the Openflow UI, by navigating to **View Details** for your Runtime.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR** Authentication Strategy: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・3行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/sql-server/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/sql-server/setup@@ -533,5 +533,5 @@ This token is managed automatically by Snowflake. BYOC deployments must have previously configured- [runtime roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED.+ [execute-as roles](#label-deployment-byoc-setup-runtime-role) to use SNOWFLAKE_MANAGED. - **BYOC**: Alternatively, BYOC can use KEY_PAIR as the value for the authentication strategy. @@ -655,6 +655,6 @@ When using: -- **SNOWFLAKE_MANAGED** Authentication Strategy: Use Snowflake Role assigned to the runtime or child role granted to this Snowflake Role.- You can find your runtime Snowflake Role in the Openflow UI, by expanding the **More Options [⋮]** button for your runtime and selecting **Set Snowflake role**.+- **SNOWFLAKE_MANAGED** Authentication Strategy: Use the runtime's execute-as role (or a child role granted to it).+ You can find your execute-as role in the Openflow UI by navigating to **View Details** for your runtime. - **KEY_PAIR**: Use a valid role configured for your service user.
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（2行追加・2行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/salesforce-bulk-api/configure-connector+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/salesforce-bulk-api/configure-connector@@ -217,5 +217,5 @@ <tr> <td>Snowflake Role</td>- <td>Name of the Snowflake role used during query execution. When using `SNOWFLAKE_MANAGED`, this is the Snowflake Role for Openflow Runtimes. When using `KEY_PAIR` (Openflow BYOC only), this is the role assigned to the specified Snowflake username.</td>+ <td>Name of the execute-as role used during query execution. When using `SNOWFLAKE_MANAGED`, this is the execute-as role for Openflow runtimes. When using `KEY_PAIR` (Openflow BYOC only), this is the role assigned to the specified Snowflake username.</td> </tr> <tr>@@ -225,5 +225,5 @@ Authentication strategy for the connector to connect to Snowflake. -Using `SNOWFLAKE_MANAGED` (default) uses the Snowflake managed token associated with the specified Snowflake Runtime Role. If using Openflow BYOC, you can also use `KEY_PAIR` to specify a specific user and role via a custom Key Pair.+Using `SNOWFLAKE_MANAGED` (default) uses the Snowflake managed token associated with the runtime's execute-as role. If using Openflow BYOC, you can also use `KEY_PAIR` to specify a specific user and role via a custom Key Pair. </td>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（2行追加・2行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/kinesis/setup+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/kinesis/setup@@ -353,5 +353,5 @@ ``` -3. Attach both network rules to an external access integration, then grant the runtime role permission to use the integration:+3. Attach both network rules to an external access integration, then grant the execute-as role permission to use the integration: ```sql@@ -366,5 +366,5 @@ COMMENT = 'External access integration for the Openflow Connector for Kinesis'; - GRANT USAGE ON INTEGRATION openflow_kinesis_eai TO ROLE <openflow_runtime_role>;+ GRANT USAGE ON INTEGRATION openflow_kinesis_eai TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ```
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（3行追加・1行削除）
--- ahttps://docs.snowflake.com/en/user-guide/egress-ip/network-egress+++ bhttps://docs.snowflake.com/en/user-guide/egress-ip/network-egress@@ -12,5 +12,7 @@ ## Supported deployments -Stable egress IP addresses are available on AWS Commercial deployments.+Stable egress IP addresses are generally available on AWS Commercial deployments.++Support for stable egress IP addresses on Azure is in preview. ## Supported uses
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（2行追加・2行削除）
--- ahttps://docs.snowflake.com/en/user-guide/multi-party-approval+++ bhttps://docs.snowflake.com/en/user-guide/multi-party-approval@@ -81,6 +81,6 @@ **Granting or revoking administrative roles** (`MODIFY_PRIVILEGED_ROLE_GRANTS`) -Requires approval for granting or revoking privileged roles such as ACCOUNTADMIN or-SECURITYADMIN, and privileges such as MANAGE GRANTS.+Requires approval for granting or revoking the `ACCOUNTADMIN` or `SECURITYADMIN`+role, and for granting or revoking the `MANAGE GRANTS` privilege. **Managing Cortex AI guardrails** (`MODIFY_CORTEX_GUARDRAILS`)
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（2行追加・2行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/create-multi-party-approval-policy+++ bhttps://docs.snowflake.com/en/sql-reference/sql/create-multi-party-approval-policy@@ -131,6 +131,6 @@ <dd> -Requires approval for granting or revoking privileged roles such as ACCOUNTADMIN or-SECURITYADMIN, and privileges such as MANAGE GRANTS.+Requires approval for granting or revoking the `ACCOUNTADMIN` or `SECURITYADMIN`+role, and for granting or revoking the `MANAGE GRANTS` privilege. </dd>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（1行追加・3行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/alter-application-package+++ bhttps://docs.snowflake.com/en/sql-reference/sql/alter-application-package@@ -138,5 +138,5 @@ set for application packages that are included in a trial or paid listing. -When multiple instances are allowed, consumers can install a maximum of 10 instances of an app in their account.+When multiple instances are allowed, consumers can install a maximum of 30 instances of an app in their account. After setting this property to true, it cannot be set to `FALSE` or unset later.@@ -175,6 +175,4 @@ - `DATA_RETENTION_TIME_IN_DAYS` - `MAX_DATA_EXTENSION_TIME_IN_DAYS`-- `EXTERNAL_VOLUME`-- `CATALOG` - `DEFAULT_DDL_COLLATION` - <code className="samp">TAG <em>tag_name</em> [ , <em>tag_name</em> ... ]</code>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（2行追加・2行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/alter-multi-party-approval-policy+++ bhttps://docs.snowflake.com/en/sql-reference/sql/alter-multi-party-approval-policy@@ -146,6 +146,6 @@ <dd> -Requires approval for granting or revoking privileged roles such as ACCOUNTADMIN or-SECURITYADMIN, and privileges such as MANAGE GRANTS.+Requires approval for granting or revoking the `ACCOUNTADMIN` or `SECURITYADMIN`+role, and for granting or revoking the `MANAGE GRANTS` privilege. </dd>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（4行追加・0行削除）
--- ahttps://docs.snowflake.com/en/sql-reference/sql/show-applications+++ bhttps://docs.snowflake.com/en/sql-reference/sql/show-applications@@ -212,4 +212,8 @@ </td>+ </tr>+ <tr>+ <td>`type`</td>+ <td>The type of the application. This value is always `NATIVE`.</td> </tr> </tbody>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（2行追加・2行削除）
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/shopify/troubleshoot+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/shopify/troubleshoot@@ -27,7 +27,7 @@ ## Connector fails with `UnknownHostException` on OAuth2 token request -If the connector logs an error such as `OAuth2 access token request failed` caused by `java.net.UnknownHostException: <your_store>.myshopify.com`, the runtime can't reach the Shopify domain. This means the External Access Integration (EAI) for the connector hasn't been created, or USAGE on the EAI hasn't been granted to the runtime role.+If the connector logs an error such as `OAuth2 access token request failed` caused by `java.net.UnknownHostException: <your_store>.myshopify.com`, the runtime can't reach the Shopify domain. This means the External Access Integration (EAI) for the connector hasn't been created, or USAGE on the EAI hasn't been granted to the runtime's execute-as role. -Follow the steps in [](/user-guide/data-integration/openflow/connectors/shopify/setup#label-create-network-rule) to create the network rule and EAI, and grant the runtime role USAGE on the integration.+Follow the steps in [](/user-guide/data-integration/openflow/connectors/shopify/setup#label-create-network-rule) to create the network rule and EAI, and grant the execute-as role USAGE on the integration. ## Connector fails with `UnresolvedAddressException` when downloading bulk results
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（4行追加・0行削除）
--- ahttps://docs.snowflake.com/en/developer-guide/snowflake-app-runtime/privileges+++ bhttps://docs.snowflake.com/en/developer-guide/snowflake-app-runtime/privileges@@ -76,4 +76,8 @@ </div> +You can grant `USAGE`, `MONITOR`, and `OPERATE` on one Application Service, on+all of them in a schema, or on those created later. See+[](/developer-guide/snowflake-app-runtime/access-control#label-snowflake-app-runtime-access-control-bulk-grants).+ <a id="label-snowflake-app-runtime-privileges-cli-deploy"></a>
（この変更は要約対象外です。diff を参照してください）
変更内容: 本文を更新（1行追加・3行削除）
--- ahttps://docs.snowflake.com/en/developer-guide/streamlit/features/restricted-callers-rights+++ bhttps://docs.snowflake.com/en/developer-guide/streamlit/features/restricted-callers-rights@@ -6,5 +6,5 @@ not the privileges of the caller. The Streamlit app developer can define whether a container-runtime app runs with owner's rights or restricted caller's rights. Restricted caller's rights-aren't supported in warehouse runtimes. Restricted caller's rights requires Streamlit version 1.53.1 or later.+aren't supported in warehouse runtimes. Restricted caller's rights require Streamlit version 1.53.1 or later. Restricted caller's rights allow a Streamlit app to run with caller's rights, but restrict which of the caller's@@ -13,6 +13,4 @@ to define which of the caller's privileges an app can run with. This way, Streamlit apps only access data (on behalf of the viewer) that they are authorized to access.--Restricted caller's rights require Streamlit version 1.53 or later. For more information, see [](/developer-guide/restricted-callers-rights).
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents@@ -30,5 +30,6 @@ An agent's tools give it access to your data. An agent with no tools configured can still hold a conversation, but it answers only from the language model's general knowledge and can't query-anything in your account.+anything in your account. If the caller's role can't use every configured tool, the run can still+continue with the tools it can access. See [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling). To build your first agent end to end, see [](/user-guide/snowflake-cortex/cortex-agents-get-started).
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-rest-api+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-rest-api@@ -4,4 +4,5 @@ - [](/user-guide/snowflake-cortex/cortex-agents)+- [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling) Requests to the Cortex Agent REST API time out after 15 minutes.@@ -827,4 +828,6 @@ ## Schemas +The `OrchestrationConfig` schema documents `budget`. The same object also accepts `tool_not_accessible` (`accept`, `reject`, or `legacy`) to control whether a missing tool privilege aborts the run. For behavior, defaults, and which tools Snowflake checks, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling).+ <a id="label-snowflake-agent-object-agentinstructions"></a>
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-run+++ bhttps://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-run@@ -4,4 +4,5 @@ - [](/user-guide/snowflake-cortex/cortex-agents)+- [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling) - [](/sql-reference/functions/data_agent_run-snowflake-cortex) @@ -493,4 +494,6 @@ Make sure your application can handle unknown event types. +When a named tool isn't accessible and `tool_not_accessible` is `accept`, the stream includes `response.warning` events before the first model call. For the warning format and the other access modes, see [](/user-guide/snowflake-cortex/cortex-agents-inaccessible-tool-handling).+ **Example Response**
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/developer-guide/snowflake-ml/inference/inference-overview+++ bhttps://docs.snowflake.com/en/developer-guide/snowflake-ml/inference/inference-overview@@ -70,2 +70,5 @@ </div>++To monitor the estimated credits consumed by these inference workloads, whether run through a warehouse or through Snowpark+Container Services, query the [](/sql-reference/account-usage/model_serving_usage_history).
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/streaming/configuring-custom-transformations+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/streaming/configuring-custom-transformations@@ -55,5 +55,5 @@ - The connector currently connects its source processor (for example, `ConsumeKafka`) directly to `PublishSnowpipeStreaming`. - You know which transformation you need and to which table(s) records should be written.-- The runtime role can create any target tables used for routing (see the connector's destination grants).+- The execute-as role can create any target tables used for routing (see the connector's destination grants). ## Architecture
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/functions/system_get_snowflake_egress_ip_ranges+++ bhttps://docs.snowflake.com/en/sql-reference/functions/system_get_snowflake_egress_ip_ranges@@ -53,4 +53,6 @@ ``` +Support for this function on Azure is in preview.+ Additionally, in Azure regions you see a more detailed output:
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/sql/grant-privilege-application+++ bhttps://docs.snowflake.com/en/sql-reference/sql/grant-privilege-application@@ -17,5 +17,5 @@ ```sqlsyntax GRANT { { globalPrivileges } ON ACCOUNT- | { accountObjectPrivileges | ALL [ PRIVILEGES ] } ON { USER | RESOURCE MONITOR | WAREHOUSE | COMPUTE POOL | DATABASE | INTEGRATION | CONNECTION | FAILOVER GROUP | REPLICATION GROUP | EXTERNAL VOLUME } <object_name>+ | { accountObjectPrivileges | ALL [ PRIVILEGES ] } ON { USER | RESOURCE MONITOR | WAREHOUSE | COMPUTE POOL | DATABASE | INTEGRATION | CONNECTION | FAILOVER GROUP | REPLICATION GROUP | EXTERNAL VOLUME | APPLICATION PACKAGE | APPLICATION } <object_name> | { schemaPrivileges | ALL [ PRIVILEGES ] } ON { SCHEMA <schema_name> | ALL SCHEMAS IN DATABASE <db_name> } | { schemaObjectPrivileges | ALL [ PRIVILEGES ] } ON { <object_type> <object_name> | ALL <object_type_plural> IN { DATABASE <db_name> | SCHEMA <schema_name> }
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/sql/alter-application-package-release-directive+++ bhttps://docs.snowflake.com/en/sql-reference/sql/alter-application-package-release-directive@@ -1,3 +1,3 @@-# ALTER APPLICATION PACKAGE ... RELEASE DIRECTIVE+# ALTER APPLICATION PACKAGE ... RELEASE DIRECTIVE (Legacy) This feature is not available in the People's Republic of China.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/sql-server/about+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/sql-server/about@@ -72,5 +72,5 @@ the included list in the Column Filter JSON. - The connector supports common source table schema changes during replication, such as adding, dropping, and renaming columns. See [Schema changes](#label-database-schema-changes) for the full list and a few unsupported change types.-- The connector doesn't support the truncate table operation.+- The connector doesn't support the truncate table operation. `TRUNCATE` statements on the source are ignored, and the corresponding row deletions are not applied to the destination table. You can bypass limitations affecting certain table columns by excluding these specific columns from replication.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/sql-server-cdc/about+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/sql-server-cdc/about@@ -86,5 +86,5 @@ capture instance already tracks. The connector still reflects the latest value of the new column in the destination table after the connector switches to the new capture instance.-- The connector doesn't support the truncate table operation.+- The connector doesn't support the truncate table operation. `TRUNCATE` statements on the source are ignored, and the corresponding row deletions are not applied to the destination table. You can bypass limitations affecting certain table columns by excluding these specific columns from replication.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/veeva-vault/about+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/veeva-vault/about@@ -105,5 +105,5 @@ <dd> -Uses the Snowflake-managed token associated with the Openflow runtime role. This is the+Uses the Snowflake-managed token associated with the Openflow runtime's execute-as role. This is the recommended strategy for both %ofsfspcs-plural% and %ofbyoc-plural%.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/functions/get_ddl+++ bhttps://docs.snowflake.com/en/sql-reference/functions/get_ddl@@ -16,4 +16,5 @@ - Cortex Agents (see [](/sql-reference/sql/create-agent))+- Cortex Search services (see [](/sql-reference/sql/create-cortex-search)) - Alerts (see [](/sql-reference/sql/create-alert)) - Databases (see [](/sql-reference/sql/create-database)), including [catalog-linked databases](/sql-reference/sql/create-database-catalog-linked).@@ -68,4 +69,5 @@ - CORTEX_AGENT+- CORTEX_SEARCH_SERVICE - CONTACT - DATABASE
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/salesforce-bulk-api/setup-snowflake+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/salesforce-bulk-api/setup-snowflake@@ -138,5 +138,5 @@ COMMENT = 'External Access Integration to connect to Salesforce'; -GRANT USAGE ON INTEGRATION MY_OPENFLOW_SALESFORCE_EAI TO ROLE <openflow_role_name>;+GRANT USAGE ON INTEGRATION MY_OPENFLOW_SALESFORCE_EAI TO ROLE OPENFLOW_<RUNTIME_NAME>_EXECUTE_AS_RL; ```
（この変更は要約対象外です。diff を参照してください）
判定根拠: 書式・空白のみの変更
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/setup-openflow-spcs-create-runtime+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/setup-openflow-spcs-create-runtime@@ -51,5 +51,5 @@ </tr> <tr>- <td>**Execute-as Role**</td>+ <td>**Execute-as role**</td> <td>Choose the execute-as role previously created in [](/user-guide/data-integration/openflow/setup-openflow-spcs-create-rr).</td> </tr>
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/veeva-vault/use+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/veeva-vault/use@@ -121,5 +121,5 @@ If the connector reports permission errors when creating tables or loading data: -- Verify that the Snowflake role configured in the connector has `USAGE` on the destination+- Verify that the execute-as role configured in the connector has `USAGE` on the destination database and schema, `CREATE TABLE` on the schema, and `USAGE` and `OPERATE` on the warehouse.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/developer-guide/native-apps/ui-consumer-installing+++ bhttps://docs.snowflake.com/en/developer-guide/native-apps/ui-consumer-installing@@ -166,5 +166,5 @@ the [Snowflake Marketplace](#label-nativeapps-consumer-listings-install-marketplace). -If multiple instances are enabled for an app, you can install a maximum of 10 instances in your account.+If multiple instances are enabled for an app, you can install a maximum of 30 instances in your account. To install a new instance of an app, perform the following tasks:
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/developer-guide/native-apps/release-channels+++ bhttps://docs.snowflake.com/en/developer-guide/native-apps/release-channels@@ -46,5 +46,5 @@ Providers can add an account to a release channel using the MODIFY RELEASE CHANNEL clause of the-[](/sql-reference/sql/alter-application) command.+[](/sql-reference/sql/alter-application-package-release-channel) command. To add the ORG1.ACCOUNT1 account to the ALPHA release channel:
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/sql-reference/sql/alter-application+++ bhttps://docs.snowflake.com/en/sql-reference/sql/alter-application@@ -141,4 +141,5 @@ - `DEBUG_MODE` Disables debug mode for the installed app. This clause is semantically the same as setting `DEBUG_MODE = FALSE`.+- `SHARE_EVENTS_WITH_PROVIDER` - <code className="samp">TAG <em>tag_name</em> [ , <em>tag_name</em> ... ]</code> - <code className="samp">REFERENCES[ ( '<em>reference_name</em>' [, '<em>reference_alias</em>' ] ) ]</code>
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/oracle/about+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/oracle/about@@ -598,4 +598,5 @@ the old row, which results in duplicate active rows in the destination. For more information, see [](#label-oracle-logical-key-value-change).+- The connector doesn't support the truncate table operation. `TRUNCATE` statements on the source are ignored, and the corresponding row deletions are not applied to the destination table. ## How the connector works
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/postgres/about+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/postgres/about@@ -145,4 +145,5 @@ - The connector supports common source table schema changes during replication, such as adding, dropping, and renaming columns. See [Schema changes](#label-database-schema-changes) for the full list and a few unsupported change types. - When using incremental replication without snapshots, if a row was inserted before incremental replication started, any subsequent update to that row will produce a destination row with missing values in VARCHAR, VARIANT, BINARY, and ARRAY columns.+- The connector doesn't support the truncate table operation. `TRUNCATE` statements on the source are ignored, and the corresponding row deletions are not applied to the destination table. Limitations affecting certain table columns can be bypassed by excluding these specific columns from replication.
（この変更は要約対象外です。diff を参照してください）
変更内容: 3行以下の小規模な更新
--- ahttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/mysql/about+++ bhttps://docs.snowflake.com/en/user-guide/data-integration/openflow/connectors/mysql/about@@ -149,4 +149,5 @@ Foreign key cascade deletions are executed internally by InnoDB (the storage engine used by MySQL and MariaDB) and aren't recorded in the binary log, resulting in incomplete replication of dependent table deletions to Snowflake.+- The connector doesn't support the truncate table operation. `TRUNCATE` statements on the source are ignored, and the corresponding row deletions are not applied to the destination table. Limitations affecting certain table columns can be bypassed by excluding these specific columns from replication.
| セクション | S | A | B | C | 計 |
|---|---|---|---|---|---|
| Loading & Unloading Data | 0 | 0 | 34 | 10 | 44 |
| SQL Commands | 0 | 2 | 10 | 3 | 15 |
| Snowflake Cortex (AI & ML) | 0 | 1 | 3 | 3 | 7 |
| Release Notes | 1 | 0 | 4 | 0 | 5 |
| Native Apps Framework | 0 | 1 | 0 | 2 | 3 |
| Developer Guide | 0 | 1 | 2 | 0 | 3 |
| User Guide | 0 | 0 | 3 | 0 | 3 |
| Snowflake ML | 0 | 1 | 0 | 1 | 2 |
| Account Usage | 0 | 0 | 2 | 0 | 2 |
| Streamlit in Snowflake | 0 | 0 | 2 | 0 | 2 |
| SQL Functions | 0 | 0 | 0 | 2 | 2 |
| Clean Rooms | 0 | 0 | 1 | 0 | 1 |
| Cortex Code | 0 | 0 | 1 | 0 | 1 |
| Snowflake CLI | 0 | 0 | 1 | 0 | 1 |
| SQL General Reference | 0 | 0 | 1 | 0 | 1 |
| Organization Usage | 0 | 0 | 1 | 0 | 1 |