Skip to main content

Create a Cloud Account Credential

For LiveRamp to be able to access your data at your cloud provider during question runs, you’ll need to create a credential within LiveRamp Clean Room for that cloud account. This often involves entering a credential or token you generate from your cloud provider.

Once you've created a credential, you can use that credential when creating a data connection to connect LiveRamp Clean Room to your data.

Note

  • These are general instructions for adding credentials. For instructions that are specific to your data connection type (which depends on your cloud type and other factors), as well as information on any prerequisites, see the articles in "Connect to Cloud-Based Data".

  • If LiveRamp Clean Room hosts your file drop location, you can generate credentials within the LiveRamp Clean Room UI by selecting Clean Room → Data Source Locations from the LiveRamp Clean Room navigation menu.

Determine the Credential Type to Create

Use the table below to determine the type of credential to create (based on your cloud provider, the type of clean room being used, and other variables), as well as any prerequisites to creating that credential:

Cloud Provider

Clean Room Type

Credential Type(s)

How to Choose Credential Type

Credential Prerequisites / Required Info

Snowflake

Hybrid or Confidential Computing

Snowflake Account with Credentials

Choose this credential type if you authenticate to Snowflake with an unencrypted key.

  • Generate an unencrypted private key

  • Gather the following info:

    • Snowflake account ID

    • Snowflake username

    • Unencrypted private key

Snowflake Account with PEM Credentials

Choose this credential type if your security requirements mandate encrypted key-pair authentication instead of a password or unencrypted key.

  • Generate an encrypted PKCS#8 PEM private key

  • Gather the following info:

    • Snowflake account ID

    • Snowflake username

    • Encrypted private key

    • The passphrase for that encrypted key

Snowflake

Snowflake clean room

Snowflake credential (auto-generated during CLI Framework install; no separate named credential type)

N/A

None beyond the CLI Framework install itself. Select the Snowflake credential that was created automatically during that install.

BigQuery

Hybrid or Confidential Computing

Google Service Account

N/A

  • Create a service account in IAM & Admin

  • Generate a JSON private key for the service account

  • Assign BigQuery permissions: Read Session User and Data Viewer roles

  • Gather the following info:

    • Google Cloud Project ID

    • Credential JSON from the Google service account key

BigQuery

BigQuery clean room

Google Service Account (same name, heavier prerequisites than Hybrid)

N/A

  • Generate a Service Account and Service Account Key

  • Add the service account to the GCP billing project with appropriate roles, including the custom "LiveRamp Clean Room BigQuery Job" role for query orchestration

  • Gather the following info:

    • Google Cloud Project ID

    • Credential JSON from the Google service account key

AWS S3 (customer hosted)

AWS IAM User Credentials

N/A

Gather the following info:

  • AWS Access Key ID

  • AWS Secret Access Key

  • AWS User ARN

  • AWS Region (only required for Hybrid and Confidential Computing clean rooms)

Google Cloud Storage (Customer Hosted)

Google Service Account

N/A

  • Create a service account in GCP's IAM & Admin section

  • Generate a JSON service account key

  • Grant the service account these permissions: storage.buckets.get, storage.objects.get, storage.objects.list

  • Assign a custom Cloud Storage role to the service account with those permissions

  • Gather the following info:

    • Google Cloud Project ID

    • Credential JSON from the Google service account key

Databricks

Databricks clean room

Databricks Delta Credentials

N/A

  • Create a recipient of type "Open" using the "Token" authentication method

  • Gather the following info:

    • Download the JSON credential file from the activation link

Azure Blob Storage

Hybrid or Confidential Computing

Azure SAS Token

Choose this credential type for simpler setup with no extra infrastructure - but you're responsible for secure storage, monitoring expiration, and rotating/replacing the token if compromised.

  • Generate a token in the Azure UI at container or account level

    • Container level: Go to the storage account, select "Shared access tokens," check "Read" and "List" permissions, set an expiration, generate the token

    • Account level: Select "Shared access signature," check "Blob" under Allowed Services, select "Container" and "Object" resource types, check "Read" and "List" permissions, generate the token

  • Gather the following info:

    • SAS token generated in Azure

Azure SAS User Delegation

Choose this credential type if your organization requires Azure AD-based, short-lived access and prohibits long-lived tokens, or if administrators prefer to govern access through Azure AD credentials rather than a static token.

  • Host an Azure Function that issues the SAS token for your target storage account and container

  • Register an Azure AD app to protect that function

  • Share with LiveRamp: the App ID, Function URL, Scope/audience URL, storage account name, and container name

  • Gather the following info:

    • Tenant ID

    • Client ID

    • Client Secret

    • Azure Function URL

    • Scope URL

Salesforce

Hybrid or Confidential Computing

Salesforce Credential

N/A

  • Create a dedicated API user profile with appropriate permissions

  • Create a new Salesforce user account for API access

  • Generate a Security Token for that API user

  • Gather the following info:

    • Domain

    • Consumer Key

    • Consumer Secret

    • API username

    • API password

    • Security token

Apache Iceberg (via AWS Glue Catalog)

Hybrid or Confidential Computing

AWS IAM User Credentials

N/A

Gather the following info:

  • AWS Access Key ID

  • AWS Secret Access Key

  • AWS User ARN

  • AWS Region

Steps to Create a Credential

To create a cloud account credential in LiveRamp Clean Room:

  1. Make sure that you've performed any necessary prerequisites for your cloud and connection type.

  2. From the navigation menu, select Clean Room → Credentials to open the Organization Credentials page.

    LCR-Old_Credentials_Nav_menu.png

  3. Click Create Credential.

    add_credential.png

  4. Enter a descriptive name for the credential.

    LCR-Create_Credential-Name_field.png

  5. Select the appropriate credentials type, depending on the data connection type.

    Note

    For information on the credentials type to select, and the fields to configure, see the data connection articles in the "Connect to Cloud-Based Data" and "Connect to Walled Garden Data" sections.

    LCR-Create_Credential-Credentials_Type_field.png

  6. Enter the necessary configuration information that is specific to your data connection type (which depends on your cloud type and other factors).

  7. If needed, adjust the selection for whether your organization's cloud security policy requires an allowlist for IP addresses and Google Project IDs for this credential (this is not common).

    Note

    • Allowlists only need to be utilized for credentials used in Hybrid and Confidential Computing clean rooms, where the processing of question runs might need to be load-balanced across different data planes. You do not need to require an allowlist for other clean room types.

    • For more information on credential allowlists, see "Create and Manage Credential Allowlists".

    • If your organization requires an allowlist, we recommend that you talk to your LiveRamp representative before creating the credential.

    LCR-Create_Credential-allowlist_selection.png

  8. Click Save Credential.

The credential is created and appears on the Credentials page. The allowlist status varies depending on whether you specified that an allowlist is required:

  • If no allowlist is required, the allowlist status will be "Not Required" and the credential is ready to use when creating data connections.

  • If an allowlist is required, the allowlist status will be "Not Created" and you will need to create an allowlist by following the instructions in "Create and Manage Credential Allowlists".

Note

To edit an existing credential, see "Edit a Cloud Account Credential".

In this section:

A type of clean room that lets parties collaborate on data stored in different cloud warehouse types, such as Snowflake and AWS. LiveRamp orchestrates data access, while queries run on Apache Spark SQL in a LiveRamp-hosted, clean room-specific VPC created at question runtime.

A type of clean room that uses a Trusted Execution Environment (TEE) to process sensitive data or code on dedicated hardware without exposing it to collaborators or LiveRamp. It supports collaboration across data sources in different cloud environments and uses attestation to verify that only approved code ran. Queries use Apache Spark SQL in an AMD-SEV environment provisioned through Azure Confidential Compute.