How to Transfer Data from AWS IoT Core to Snowflake

Open Automation Software can be used to transfer data from AWS IoT Core to a Snowflake table, locally or over a network. Rows are written continuously using the Snowpipe Streaming REST API, with no staging files, no COPY INTO job and no warehouse running for ingestion.

This guide walks you through downloading and installing OAS, configuring an AWS IoT Core subscriber and a tag, preparing your Snowflake account, and streaming that tag into a Snowflake table.

For this guide on how to transfer data from AWS IoT Core to Snowflake you will need:

• An AWS account with access to the AWS IoT Core console
• An OAS installation licensed for the Snowflake option
• A Snowflake account with Snowpipe Streaming available
• Access to a Snowflake administrator holding ACCOUNTADMIN, to create the user, role and table

1 - Download and Install OAS

If you have not already done so, you will need to download and install the OAS platform.

Fully functional trial versions of the software are available for Windows, Windows IoT Core, Linux, Raspberry Pi and Docker on our downloads page.

On Windows, run the downloaded setup.exe file to install the Open Automation Software platform. For a default installation, Agree to the End User License Agreement and then click the Next button on each of the installation steps until it has completed.

If you'd like to customize your installation or learn more, use the following instructions:

• Windows Installation
• Linux Installation
• Raspberry Pi Installation
• Docker Installation

The OAS Service Control application will appear when the installation finishes on Windows.

Click on each START SERVICE button to start each of the three OAS services.

2 - Configure OAS

Web Configuration Application

Configuration of the OAS server is performed from the built-in Web Configuration Application. This is the main application for accessing any settings within the OAS server and is completely self-contained within the server.

You can reach this by opening your browser to:

http://<your server>:58725/app/config

If you are browsing from the OAS machine itself, you can use localhost, otherwise use the IP address of the machine. You will also need to ensure port 58725 is open on both the client and the server or you may not be able to reach the application.

On a new installation the OAS engine has no accounts yet, so the first screen you see is Create Admin Account. Once the administrator account exists that screen is not shown again, and browsing to the application displays the sign in screen instead.

1. Enter a name for the administrator in the Admin user name field. Typically you would use admin, but you can use whatever name you choose.

2. Enter a password in the Password field, then enter the same password again in the Confirm password field.

3. Click on the Create admin & sign in button. The account is created and you are signed in to the engine.

To sign in from then on, enter the Network node of the OAS engine, then the Username and Password of your account, and click on the Sign in button.

Legacy Configuration Application

1. From your operating system start menu, open the Configure OAS application.

2. Select the Configure > Tags screen.

   Important

   If this is the first time you have installed OAS, the AdminCreate utility will run when you select a screen in the Configure menu. This will ask you to create a username and password for the admin user. This user will have full permissions in the OAS platform.

   For further information see Getting Started - Security.

3. If this is the first time you are logging in, you will see the AdminCreate utility. Follow the prompts to set up your admin account. Otherwise, select the Log In menu button and provide the Network Node, username and password.

   

   

3 - Create Subscriber Thing in AWS IoT Core

In this step you will create a Thing in the AWS IoT Core service and the required certificate and policies for subscribing to messages sent by AWS IoT Core. This represents your connection and security settings between AWS IoT Core and OAS.

1. Login to the AWS Console and select the AWS IoT service.

2. Under the Manage and All Devices menu select Things.

3. Click on the Create things button to start the create new things wizard.

4. Select Create single thing and click on the Next button.

   

5. Set the Thing name to OAS_Subscriber and click on the Next button.

   

6. Leave the default option to generate device certificate automatically and click on the Next button.

   

7. Select the Create policy button. This will open a new browser tab or window.

8. Set the Policy name to OASSubscriberPolicy. The policy will need to allow the iot:Connect and iot:Subscribe actions. For the purpose of this guide the policy will allow all resources using the * wildcard.

   

   Important

   For security best practices in production systems you should always restrict your policy to the client ID and AWS resource name (ARN) that represents your region, account and topic paths.

9. Go back to the create thing wizard and select the OASSubscriberPolicy. Click on the Create thing button.

10. You will see a window relating to certificates. Download the device certificate, the public key file, the private key file and one of the Root CA certificates. You should keep these files in a folder with limited permissions. You'll need them when configuring the AWS IoT Core subscriber in the OAS platform.

    

4 - Configure AWS IoT Core Subscriber

In the following steps you will create and configure an AWS IoT Core Subscriber for subscribing to tag values.

1. To determine the AWS IoT Core endpoint you will need to login to the AWS console and select the AWS IoT service. Select the Domain configurations menu.

2. If you don't already have a domain name use the Create domain configuration button to create one. You will need to take a note of the Domain name property, which represents your AWS IoT Core broker endpoint.

3. Select Drivers in the sidebar.

4. Click + Add, enter a meaningful Driver Interface Name to give this driver interface instance a unique name (for example AWS IoT Subscriber), and click Create. Once created, the driver interface name should appear in the list of drivers.

5. Ensure the following parameters are configured:

   • Driver: AWS IoT Gateway
   • Broker Port: 8883
   • Create Certificate: Turn this on if running Windows
   • Client Certificate File: The device certificate pem.crt file from the previous section
   • Client Private Key File: The private pem.key file from the previous section
   • Server Certificate File: The Root CA pem file from the previous section
   • Client ID: OASSubscriber
   • IoT End Point: This is your AWS Iot Core endpoint from step 2 above

   Info

   If you are using Linux, turn Create Certificate off and use PFX certificates instead. The form then asks for a Client PFX Certificate File, a Client PFX Certificate Password, a Server PFX Certificate File and a Server PFX Certificate Password.

   You can generate both PFX files using OpenSSL. The client certificate holds the device certificate and its private key:

   openssl pkcs12 -export \
       -out oas-connection-certificate.pfx \
       -inkey 2ed57ff8e30d1a12345f69bc2a8a6b4a1721b123456789912e675cc74111ced7-private.pem.key \
       -in 2ed57ff8e30d1a12345f69bc2a8a6b4a1721b123456789912e675cc74111ced7-certificate.pem.crt \
       -certfile AmazonRootCA1.pem
   

   The server certificate holds the Amazon Root CA, which has no private key of its own:

   openssl pkcs12 -export -nokeys -out oas-server-certificate.pfx -in AmazonRootCA1.pem
   

   Enter the path to each file in the matching PFX Certificate File field and the export password you chose in the matching PFX Certificate Password field. Leave a password field empty if you exported that certificate without one.

6. Turn on Enable and click on the Apply changes button. The driver interface is not active until it is enabled and the changes are applied.

   

5 - Add Data Source Tag

In this section you will create a Tag to represent your data point in the field (for example a temperature sensor). This can then be transferred your desired destination.

1. In the sidebar menu, select Tags.

   

2. If you want to add a Tag to the root Tags group make sure another tag at the root is selected. Click the [+] button and select Add Tag.

   

   If you want to add a Tag to a Tag Group, select the Tag Group first and then click on the [+] button. Alternatively, you can right click on a Tag Group and select Add Tag.

   You can also add Tag Groups by clicking the [+] and selecting Add Group.

3. Provide a Tag Name such as TemperatureSensor and click the Create button.

   

6 - Assign AWS IoT Gateway as Tag Data Source

You will now set the Tag's data source to the AWS IoT Subscriber interface that you created previously.

1. Select the Tag that will source data from the AWS IoT Core data source.

   

2. Set the following properties:

   • Data Source: AWS IoT Gateway
   • Select Driver Interface: AWS IoT Subscriber
   • Topic: oas/temperature

   

3. Click on the Apply changes button to apply the changes.

4. Login to the AWS Console and select the AWS IoT service.

5. Under the Test menu select MQTT test client and then select the Publish to a topic tab.

6. In the Topic name specify oas/temperature.

7. In the Message payload enter a value and then click on the Publish button.

   

8. Check that the quality status is Good and you can see the value.

   

7 - Prepare Your Snowflake Account

Snowflake is a hosted service, so it has to be prepared before OAS can write to it. These steps are performed in Snowflake, by a Snowflake administrator. OAS does not browse or create objects in your account.

1. Find your account identifier. It is the whole subdomain of your Snowflake URL — everything before .snowflakecomputing.com. In Snowsight, go to Admin > Accounts, open the ... menu on your account and choose Manage URLs.

   Important

   Do not use the LOCATOR column on the Accounts page. It looks like an identifier, it is right there on screen, and it does not work — authentication fails with a bare 401 that explains nothing.

2. Create a user and a role in a Snowsight worksheet, as ACCOUNTADMIN.

   CREATE ROLE  IF NOT EXISTS OAS_STREAM_ROLE;
   CREATE USER  IF NOT EXISTS OAS_SVC
       DEFAULT_ROLE = OAS_STREAM_ROLE
       MUST_CHANGE_PASSWORD = FALSE;
   
   GRANT ROLE OAS_STREAM_ROLE TO USER OAS_SVC;
   ALTER USER OAS_SVC SET TYPE = SERVICE;
   

   Info

   If you already have a service user and role for OAS, skip this and use them. Nothing here is specific to this driver — any user whose default role holds the grants below will work. Note the user name for the driver's User field and move on.

   The driver never sends a role. The role that applies is the user's default role, which is why it is set above.

3. Create the target table.

   CREATE DATABASE IF NOT EXISTS OAS_DB;
   CREATE SCHEMA   IF NOT EXISTS OAS_DB.OAS_DATA;
   
   CREATE TABLE IF NOT EXISTS OAS_DB.OAS_DATA.OAS_TAG_VALUES (
       id         STRING,
       value      VARIANT,
       quality    BOOLEAN,
       timestamp  TIMESTAMP_NTZ
   );
   

   These four columns match the driver's built-in Default column mapping, so a table created this way streams with no mapping work at all. If the table already exists, leave it alone and make the column mapping match its columns instead.

4. Grant the role its privileges.

   GRANT USAGE  ON DATABASE OAS_DB                         TO ROLE OAS_STREAM_ROLE;
   GRANT USAGE  ON SCHEMA   OAS_DB.OAS_DATA                TO ROLE OAS_STREAM_ROLE;
   GRANT INSERT ON TABLE    OAS_DB.OAS_DATA.OAS_TAG_VALUES TO ROLE OAS_STREAM_ROLE;
   

   Info

   Those three grants are the entire permission surface for streaming. No warehouse, no CREATE PIPE, no OPERATE, and the driver never issues DROP or ALTER.

8 - Configure Snowflake Driver

In the following steps you will create and configure a Snowflake Driver. This driver streams the Tags you select into the table you created in the previous step. All screenshots and options in this guide will be using the built-in OAS Web Configuration interface.

1. Log into the interface using the credential created after installing OAS. The application can be found by opening your browser to the address of your OAS installation. If you are accessing it from the machine running OAS, just use localhost, otherwise the IP address of the server:

   http://<server address>:58725/app/config

   

2. In the sidebar menu, select Drivers.

   

3. Click + Add in the sidebar to create a new Driver, then set the Driver Interface Name to Snowflake Stream to give this driver interface instance a unique name.

   

   Info

   The driver interface name appears in system errors, in the driver log file name, and in the automatically generated Snowflake channel name. Choose something you will recognise later.

4. Ensure the following parameters are configured:

   • Driver: Snowflake
   • Account Identifier: your account subdomain, for example abcdefg-xy12345
   • Authentication Type: Key Pair JWT
   • User: OAS_SVC

   

   Leave Account Host Override and Ingest Host Override blank. Snowflake assigns each account a separate host for streaming and the driver discovers it on every connect.

5. Supply the private key. If you do not already have a key pair, click the GENERATE KEY button beside the Private Key Path field.

   

   Choose whether to fill the Private Key PEM field or write a file on the engine machine, pick a key size, and optionally set a passphrase.

   Important

   OAS does not register the key in Snowflake for you. The dialog shows an ALTER USER statement with the public key already in it — copy it and run it in a Snowsight worksheet as ACCOUNTADMIN. Until you do, authentication fails.

   The statement is shown once. Copy it before closing the dialog.

   If you already have a key pair, paste the private key into Private Key PEM or point Private Key Path at the .p8 file, and fill in Private Key Passphrase if the key is encrypted.

6. Set the target table:

   • Database: OAS_DB
   • Schema: OAS_DATA
   • Table: OAS_TAG_VALUES

   

   Leave Pipe and Channel Name blank. Snowflake creates a default pipe for every table, and a channel name is generated from the node and driver interface names.

   Important

   Two OAS engines using the same channel name against the same pipe will disconnect each other. Leave Channel Name blank unless you have a specific reason not to.

7. Turn on Enable, then click Apply changes to temporarily save the settings you have entered to this point. The driver interface is not active until it is enabled and the changes are applied.

9 - Test the Snowflake Connection

Before selecting Tags, confirm that OAS can authenticate. Select the Snowflake Stream driver in the list and click the TEST CONNECTION button.

The test performs three checks in order and reports the first one that fails:

10 - Map Tag Data to Table Columns

The column mapping decides what a row looks like. The table you created in the Prepare Your Snowflake Account section has four columns, and the driver's Default preset matches them exactly.

1. Click the Edit… button on the Column Mapping row of the Snowflake driver configuration.

   

2. Click Use Preset and choose Default (4). Four columns appear:

   Column	Type	Source
   id	STRING	Tag Property → Tag Path
   value	VARIANT	Tag Property → Value, as-is
   quality	BOOLEAN	Tag Property → Quality
   timestamp	TIMESTAMP_NTZ	Tag Property → Timestamp, ISO 8601

   The other preset, ISA-95 Lite, produces 24 columns with the ISA-95 hierarchy flattened one column per level. It needs a different table, so use it only if you created the table from its SQL View.

3. Optionally click + Metadata Columns to add PIPE_ID, CHANNEL_ID and STREAM_OFFSET. These let you prove in SQL that no rows were lost. If you add them here, add the matching columns to the Snowflake table as well.

   Info

   A preset is a starting point, not a mode. Once applied you can add, edit and remove columns freely.

4. Click SQL View to see the CREATE TABLE statement your mapping describes. This is the same statement the driver would use, so it is worth comparing against the table you actually created.

   

   Important

   The mapping has to match the table. The Snowflake type dropdown drives the generated DDL only — it does not change what is sent, and changing it will not fix a value that is arriving in the wrong shape. Change the column's source for that.

   OAS never alters an existing table. If your table differs from the preset, edit the mapping to match the table rather than editing the table.

5. Click OK to return to the driver configuration, Apply changes and then Save the driver so that it will be restored when the OAS server is ever restarted.

11 - Select the Tags to Publish

1. On the Snowflake driver configuration, find the Tags to Publish table and add the Tag you created earlier (for example TemperatureSensor).

   

   Important

   Every Tag in this list is written to the same table using the same column mapping. Leaving the list empty is a configuration error, not an idle driver — the driver has nothing to send and will report it.

2. Set Publish Type to Continuous with the Publish Interval set to the default of 10 seconds. This will ensure data will be published on the interval, whether the value changed or not.

3. Click Enable, Apply changes and then Save the driver so that it will be restored with the OAS server is ever restarted.

12 - Verify Rows are Arriving in Snowflake

In a Snowsight worksheet, query the table:

SELECT * FROM OAS_DB.OAS_DATA.OAS_TAG_VALUES
ORDER BY TIMESTAMP DESC
LIMIT 20;

Rows normally become visible five to seven seconds after OAS sends them. That delay is Snowpipe Streaming's commit interval, not the driver waiting.

If you added the metadata columns to the mapping, you can also prove that nothing was dropped. This query returns rows only where the offset sequence skipped:

SELECT STREAM_OFFSET,
       LAG(STREAM_OFFSET) OVER (PARTITION BY PIPE_ID, CHANNEL_ID
                                ORDER BY STREAM_OFFSET) AS previous_offset
FROM   OAS_DB.OAS_DATA.OAS_TAG_VALUES
QUALIFY STREAM_OFFSET <> previous_offset + 1;

An empty result means every row the driver sent arrived exactly once.

If no rows appear at all:

While the connection is down, values are held by Store and Forward and delivered oldest first once it recovers, so a network outage delays rows rather than losing them.

13 - Save Changes

Once you have successfully configured your OAS instances, make sure you save your configuration.

On each configuration page that has a Save button, click on it.

If this is the first time you are saving the configuration, or if you are changing the name of the configuration file, OAS will ask you if you want to change the default configuration file.

If you select Yes then OAS will make this configuration file the default and if the OAS service is restarted then this file will be loaded on start-up.

If you select No then OAS will still save your configuration file, but it will not be the default file that is loaded on start-up.