# Deprecated Deployment Method This documentation covers the **legacy Request Manager Agent deployment** that supported ingress. This deployment method has been deprecated. **New deployments should use the [simplified egress-only Request Manager Agent](https://docs.datagrail.io/docs/integrations/internal-systems-integrations/request-manager-agent/overview)**, which eliminates the need for public internet exposure. Automate the fulfillment of data subject access, deletion, opt-out, and identifier retrieval requests in Snowflake. ## Setup Instructions In the setup process below, you will create and configure a [Connection](https://docs.datagrail.io/docs/integrations/internal-systems-integrations/legacy-solutions/request-manager-agent-legacy/configuration/environment-variables#connection-schema) object with a Snowflake [ConnectorType](https://docs.datagrail.io/docs/integrations/internal-systems-integrations/legacy-solutions/request-manager-agent-legacy/configuration/environment-variables#connectortype) that is used to instantiate a connection. The agent configuration will be updated by placing the connection object into the [DataGrailAgentConfig](https://docs.datagrail.io/docs/integrations/internal-systems-integrations/legacy-solutions/request-manager-agent-legacy/configuration/environment-variables#datagrailagentconfig-schema)`connections` array. ### Example Connection Object ```js { "name": "Contacts DB", "uuid": "c6dc661e-c917-4291-9702-e20d40266289", "capabilities": ["privacy/access", "privacy/delete", "privacy/optout", "privacy/identifiers"], "mode": "live", "connector_type": "Snowflake", "queries": { "access": ["CALL sp_dsr_access(%(email)s);"] , "delete": ["CALL sp_dsr_delete(%(email)s);"] , "optout": ["CALL sp_dsr_optout(%(email)s);"] , "identifiers": { "phone_number": ["CALL sp_dsr_get_phone(%(email)s);"] } }, "credentials_location": "arn:aws:secretsmanager:Region:AccountId:secret:datagrail-rm-agent-snowflake" } ``` ### Prerequisites Before performing the steps below, ensure the following: - Request Manager Agent is [deployed and connected](https://docs.datagrail.io/docs/integrations/internal-systems-integrations/request-manager-agent/quick-start) in DataGrail. - Network is configured to allow the Agent to connect with the Snowflake instance. ### Create Request Logic In this step, create the request logic to be executed in your system for a specific [request type](https://docs.datagrail.io/docs/request-manager/request-processing/overview#request-lifecycle). - Access - Delete - Opt-Out - Identifier When a Data Subject requests to access the personal information that your company maintains on them, they will submit an [Access request](https://docs.datagrail.io/docs/request-manager/request-processing/privacy-right/access). Your request logic should return all applicable information found in this system. #### Example Access Query ```sql SELECT * FROM contacts WHERE email = 'subject@domain.com'; ``` ### Using Stored Procedures For ease of maintainability and readability, using stored procedures is recommended instead of individual queries. When you need to modify the underlying queries, there will be no need to modify the Agent configuration nor restart the Agent. #### Example Stored Procedure ```sql CALL sp_dsr_access('subject@domain.com'); ``` When a Data Subject wants their personal data removed from your systems, they will submit a [Deletion request](https://docs.datagrail.io/docs/request-manager/request-processing/privacy-right/deletion). Your request logic should delete or anonymize the Subject's information stored in this system. #### Example Deletion Query ```sql DELETE FROM contacts WHERE email = 'subject@domain.com'; ``` #### Example Stored Procedure ```sql CALL sp_dsr_delete('subject@domain.com'); ``` When a Data Subject wants to opt out of the Sale of their Personal Information to third parties, they will submit an [Opt-Out request](https://docs.datagrail.io/docs/request-manager/opt-out-requests). Your request logic should perform the necessary action to honor this request (e.g., setting a flag). #### Example Opt Out Query ```sql UPDATE contacts SET optout = true WHERE email = 'subject@domain.com'; ``` #### Example Stored Procedure ```sql CALL sp_dsr_optout('subject@domain.com'); ``` Some third party integrations use identifiers other than an email to process a request (e.g., Phone Number), and the Agent can be used to automate [identifier retrieval](https://docs.datagrail.io/docs/request-manager/settings/multi-id#extracted-identifiers). Your request logic should return the identifier value stored in this system. #### Example Identifier Retrieval Query ```sql SELECT phone_number FROM contacts WHERE email = 'subject@domain.com'; ``` #### Example Stored Procedure ```sql CALL sp_dsr_get_phone('subject@domain.com'); ``` --- ### Create and Store Credentials The Snowflake connection supports the following authentication methods: - [Key-Pair Authentication](https://docs.datagrail.io/docs/integrations/internal-systems-integrations/legacy-solutions/request-manager-agent-legacy/configuration/connections/snowflake/#key-pair-authentication2) (Recommended) - [Username/Password Authentication](https://docs.datagrail.io/docs/integrations/internal-systems-integrations/legacy-solutions/request-manager-agent-legacy/configuration/connections/snowflake/#username-password-authentication2) #### Key-Pair Authentication To utilize key-pair authentication, a public and private key must be generated using the following steps. Additional information can be found in the [Snowflake documentation](https://docs.snowflake.com/en/user-guide/key-pair-auth). 1. Generate the private key: ```sh openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt ``` 2. Generate the public key: ```sh openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub ``` 3. Assign the public key to a Snowflake user: ```sql ALTER USER {user} SET RSA_PUBLIC_KEY={public_key} ``` 4. Base64 encode the private key: ```sh openssl base64 -in rsa_key.p8 -out encoded_rsa_key.p8 ``` 5. Create a secret in your credentials manager with the following key-value pairs: ```js { "user": "", "private_key": "", "account": "", "warehouse": "", "database": "" } ``` --- #### Username/Password Authentication 1. In **Snowflake**, create a new user for the agent. Only grant the minimum necessary permissions for executing the request. 2. Configure the following JSON key-value pairs: ```js { "user": "", "password": "", "account": "", "warehouse": "", "database": "" } ``` 3. Store the JSON value in your vault with an entry name like `datagrail-rm-agent-snowflake`. 4. Ensure that the agent is configured to retrieve the value of this vault entry. --- ### Create Connection Object To define the interactions between the agent and the internal system, configure the [Connection](https://docs.datagrail.io/docs/integrations/internal-systems-integrations/legacy-solutions/request-manager-agent-legacy/configuration/environment-variables#connection-schema) object. 1. Using the empty connection object below, enter a connection **name** and **uuid** (v4). ```js { "name": "", "uuid": "", "capabilities": [], "mode": "", "connector_type": "Snowflake", "queries": { "access": [], "delete": [], "optout": [], "identifiers": {} }, "credentials_location": "" } ``` 2. Set the [**capabilities**](https://docs.datagrail.io/docs/integrations/internal-systems-integrations/legacy-solutions/request-manager-agent-legacy/configuration/environment-variables#capability) that correspond to your request logic. 3. Under **queries**, add your **request logic** as a string to the corresponding request type. 4. The `queries` object allows query strings to be dynamically formatted with identifiers. Identifiers are passed _individually_ to queries, and are bound to the variables in the operation. Replace any **static** identifier in the request logic using [pyformat parameter formatting](https://peps.python.org/pep-0249/#paramstyle) (e.g., `...WHERE email=%(email)s`). ### Parameter Binding Example ```sql -- BEFORE CALL sp_dsr_access('subject@domain.com'); -- AFTER CALL sp_dsr_access(%(email)s); ``` 5. Set the **credentials_location** value to the location of the secret created above (e.g., AWS ARN). ### Example Connection Objects After following the steps above, the resulting connection object should look similar to these examples. #### Example Connection Object with Access Capability ```js { "name": "Contacts DB", "uuid": "c6dc661e-c917-4291-9702-e20d40266289", "capabilities": ["privacy/access"], "mode": "live", "connector_type": "Snowflake", "queries": { "access": ["CALL sp_dsr_access(%(email)s);"] , "delete": [], "optout": [], "identifiers": {} }, "credentials_location": "arn:aws:secretsmanager:Region:AccountId:secret:datagrail-rm-agent-snowflake" } ``` #### Example Connection Object with Deletion Capability ```js { "name": "Contacts DB", "uuid": "c6dc661e-c917-4291-9702-e20d40266289", "capabilities": ["privacy/delete"], "mode": "live", "connector_type": "Snowflake", "queries": { "access": [], "delete": ["CALL sp_dsr_delete(%(email)s);"] , "optout": [], "identifiers": {} }, "credentials_location": "arn:aws:secretsmanager:Region:AccountId:secret:datagrail-rm-agent-snowflake" } ``` #### Example Connection Object with Opt Out Capability ```js { "name": "Contacts DB", "uuid": "c6dc661e-c917-4291-9702-e20d40266289", "capabilities": ["privacy/optout"], "mode": "live", "connector_type": "Snowflake", "queries": { "access": [], "delete": [], "optout": ["CALL sp_dsr_optout(%(email)s);"] , "identifiers": {} }, "credentials_location": "arn:aws:secretsmanager:Region:AccountId:secret:datagrail-rm-agent-snowflake" } ``` #### Example Connection Object with Identifiers Retrieval Capability ```js { "name": "Contacts DB", "uuid": "c6dc661e-c917-4291-9702-e20d40266289", "capabilities": ["privacy/identifiers"], "mode": "live", "connector_type": "Snowflake", "queries": { "access": [], "delete": [], "optout": [], "identifiers": { "phone_number": ["CALL sp_dsr_get_phone(%(email)s);"] } }, "credentials_location": "arn:aws:secretsmanager:Region:AccountId:secret:datagrail-rm-agent-snowflake" } ``` #### Example Connection with Multiple Capabilities ```js { "name": "Contacts DB", "uuid": "c6dc661e-c917-4291-9702-e20d40266289", "capabilities": ["privacy/access", "privacy/delete", "privacy/optout", "privacy/identifiers"], "mode": "live", "connector_type": "Snowflake", "queries": { "access": ["CALL sp_dsr_access(%(email)s);"] , "delete": ["CALL sp_dsr_delete(%(email)s);"] , "optout": ["CALL sp_dsr_optout(%(email)s);"] , "identifiers": { "phone_number": ["CALL sp_dsr_get_phone(%(email)s);"] } }, "credentials_location": "arn:aws:secretsmanager:Region:AccountId:secret:datagrail-rm-agent-snowflake" } ``` --- ### Update and Restart Agent In this section, you will integrate the internal system with DataGrail by updating the agent environment variable and restarting the agent to apply the changes. #### Already Processing Requests? If your DataGrail account is already processing Data Subject Requests, new agent connections may be automatically processed with all new requests. If you are not sure, check with your DataGrail admin or dedicated Account Manager before starting this section. 1. In the `DATAGRAIL_AGENT_CONFIG` environment variable, add the new connection object to the `connections` array. 2. **Save** the environment variable, and **restart** the agent service to apply the changes. 3. After the restart, confirm that the agent service is healthy, and the logs contain no errors. 4. In DataGrail, update the integration by navigating to **Integrations** and select the agent integration. 5. Select **Edit Integration**, enter the **Client Secret**, and then select **Save Changes**. 6. To view the new connection, navigate back to **Integrations** and locate it in the list. ### Processing Your First Request Now that you've successfully added this connection to DataGrail, try it out by [submitting](https://docs.datagrail.io/docs/request-manager/request-intake/privacy-request-center) and [processing](https://docs.datagrail.io/docs/request-manager/request-processing/overview) a request.