SQL Server to Snowflake: CDC via Apache Iceberg
SQL Server to Snowflake comes down to one choice. Copy the rows into tables Snowflake owns, or write them once as Apache Iceberg tables that Snowflake and every other engine can read. This guide does the second.
SQL Server's own change data capture (CDC) feature fills change tables from the transaction log. OLake Go reads those change tables and commits the rows as Iceberg tables into a catalog Snowflake reads. With Snowflake's own Horizon catalog, the default on this page, the files sit on Snowflake-managed storage.
Nothing else is in the path: no Openflow, no Kafka, no Debezium. With AWS Glue, the files sit in your S3 bucket and Snowflake reads them through a catalog integration.
Key takeaways
- OLake Go replicates SQL Server into Snowflake as Iceberg tables: a full historical snapshot first, then CDC from the change tables SQL Server already maintains, with no Kafka or Debezium in between.
- Through the Horizon catalog the tables land as Snowflake-managed Iceberg tables. You query them in Snowsight right away, with no
CREATE ICEBERG TABLE, no external volume and no refresh. - The same tables, written once by OLake Go, are also queryable from DuckDB and Spark through the same catalog. In the run on this page all three engines returned identical rows.
The short answer. To replicate SQL Server to Snowflake with change data capture (CDC), enable CDC on the database and tables. Run OLake Go with a read-only login as the source and the Snowflake Horizon catalog as the Iceberg destination.
The first sync copies each table in full (the historical snapshot); every later sync replays inserts, updates and deletes from the change tables. Snowflake, DuckDB and Spark then query the same Iceberg tables, with no second copy.
How SQL Server CDC reaches Snowflake here
Two things happen in order, and OLake Go does both on its own. The first sync records the current log sequence number (LSN). Then it reads each table in parallel chunks and writes Parquet data files: that is the historical load.
Every later sync reads the change tables from the saved LSN and replays the inserts, updates and deletes since. Nothing written during the snapshot is lost, and there is no separate backfill job.
Each sync ends with one commit to Horizon. OLake Go asks Horizon for short-lived storage credentials, uploads the data and delete files, then posts the new snapshot to the catalog. Snowflake sees it the moment the commit lands; DuckDB and Spark see it on their next catalog load.
One thing to keep an eye on: the change tables are SQL Server's replay window, and the Agent is what fills them. The cleanup job drops change rows older than three days by default, so a job paused longer than that needs a fresh snapshot. A stopped Agent means no new change rows at all, with no error on the SQL Server side.
What you need
- SQL Server 2016 SP1 or later on Developer, Standard or Enterprise edition, with CDC available and the SQL Server Agent running. The tables on this page ran on SQL Server 2022 Developer in Docker. Hosted SQL Server on Amazon Relational Database Service (RDS), Azure SQL Managed Instance or Cloud SQL works the same way; step 1 names each setup procedure.
- A Snowflake account where you can run the one-time setup as
ACCOUNTADMIN. Snowflake-managed storage means no cloud bucket or IAM role on your side. - OLake UI from the Docker Compose install with the OLake Go MSSQL source. The run on this page used v1.1.0.
- Docker, and about 30 minutes.
Step 1: Prepare SQL Server for CDC
Most readers point OLake Go at tables they already have. If you want to follow along with the exact data from this page, create these two tables first:
The two sample tables used on this page
CREATE TABLE dbo.customers (
id INT IDENTITY(1,1) PRIMARY KEY,
name NVARCHAR(100), email NVARCHAR(200), city NVARCHAR(100), tier NVARCHAR(20),
created_at DATETIME2 DEFAULT SYSUTCDATETIME(),
updated_at DATETIME2 DEFAULT SYSUTCDATETIME());
CREATE TABLE dbo.orders (
id INT IDENTITY(1,1) PRIMARY KEY,
customer_id INT REFERENCES dbo.customers(id),
product NVARCHAR(100), amount DECIMAL(10,2), status NVARCHAR(20),
created_at DATETIME2 DEFAULT SYSUTCDATETIME(),
updated_at DATETIME2 DEFAULT SYSUTCDATETIME());
-- Then insert whatever you like. This page started with 8 customers and 40 orders.
OLake Go reads SQL Server changes from the change tables that SQL Server's own change data capture (CDC) feature fills from the transaction log. Four things must be in place before the first sync.
| Setting | Value | Why it matters |
|---|---|---|
| CDC on the database | sys.sp_cdc_enable_db | Creates the cdc schema and the capture jobs for the database. |
| CDC on each table | sys.sp_cdc_enable_table per table | Creates the capture instance whose change table OLake Go reads. |
| SQL Server Agent | running | The capture job that copies log records into the change tables is an Agent job; without it nothing lands in cdc.*. On Amazon RDS and Azure SQL Managed Instance the agent is on by default. |
| A login for OLake Go | SELECT on the table schema, on the cdc schema and on msdb.dbo.cdc_jobs | The snapshot reads the tables; the change stream reads the change tables; the source test reads the capture job definition. Without the msdb grant the test fails with no SELECT on msdb.dbo.cdc_jobs. |
-- 1. CDC on the database (Developer, Standard 2016 SP1+ or Enterprise edition)
USE shop;
EXEC sys.sp_cdc_enable_db;
-- 2. CDC on every table you sync. @role_name = NULL skips the gating role.
EXEC sys.sp_cdc_enable_table @source_schema = N'dbo', @source_name = N'customers', @role_name = NULL;
EXEC sys.sp_cdc_enable_table @source_schema = N'dbo', @source_name = N'orders', @role_name = NULL;
-- 3. A login for OLake Go
USE master;
CREATE LOGIN olake WITH PASSWORD = '<password>';
USE shop;
CREATE USER olake FOR LOGIN olake;
GRANT SELECT ON SCHEMA :: dbo TO olake;
GRANT SELECT ON SCHEMA :: cdc TO olake;
GRANT VIEW DATABASE STATE TO olake;
-- 4. OLake Go checks the capture job definition in msdb before each sync
USE msdb;
CREATE USER olake FOR LOGIN olake;
GRANT SELECT ON dbo.cdc_jobs TO olake;
Check the result before moving on:
SELECT name, is_cdc_enabled FROM sys.databases WHERE name = 'shop'; -- 1
SELECT capture_instance FROM cdc.change_tables; -- dbo_customers, dbo_orders
EXEC msdb.dbo.sp_help_job @job_name = N'cdc.shop_capture'; -- the Agent job exists
Hosted SQL Server uses its own procedure to enable CDC on the database: EXEC msdb.dbo.rds_cdc_enable_db 'shop' on Amazon RDS, EXEC msdb.dbo.gcloudsql_cdc_enable_db 'shop' on Cloud SQL; the table step is the same. The full walk-through is the SQL Server connector page.
The cleanup job removes change rows older than three days (sys.sp_cdc_change_job @job_type = 'cleanup' changes it). A job paused longer than that loses its position and needs a fresh snapshot. Lengthen retention before a planned pause.
Step 2: Set up the catalog in Snowflake
Snowflake reads Iceberg tables from two kinds of catalog. Horizon is Snowflake's own: OLake Go writes straight into it, the tables are Snowflake-managed, and they appear in Snowsight the moment a sync commits.
AWS Glue is a catalog outside Snowflake, so the files stay in your S3 bucket. Snowflake reaches them through a catalog integration: a read-only link to that external catalog, refreshed after each sync.
Horizon is the default on this page. Glue is the right pick when Athena, Redshift or Spark on Amazon Elastic MapReduce (EMR) will read the same tables and you want the files in your own bucket.
| Catalog | OLake Go writes | Snowflake reads | Verified on this page |
|---|---|---|---|
| AWS Glue | Yes | Yes: catalog integration (read-only) | Documented, not yet run by us |
| Snowflake Horizon | Yes | Yes: native: tables are Snowflake-managed Iceberg tables | Yes, end to end |
- Snowflake Horizon
- AWS Glue
Snowflake Horizon is the catalog built into every Snowflake account. OLake Go talks to it through the Iceberg REST endpoint at https://<account_identifier>.snowflakecomputing.com/polaris/api/catalog, and the tables it creates are Snowflake-managed Iceberg tables. Writing through this endpoint needs OLake Go 0.11.0 or later.
Run the following once in a Snowsight worksheet as ACCOUNTADMIN. It creates a database for the tables, a role OLake Go writes as, a service user that holds the token, and the authentication policy the token needs.
USE ROLE ACCOUNTADMIN;
-- A small warehouse for your own queries, and the database OLake Go writes into.
CREATE WAREHOUSE IF NOT EXISTS OLAKE_WH WAREHOUSE_SIZE = XSMALL AUTO_SUSPEND = 60 AUTO_RESUME = TRUE;
CREATE DATABASE IF NOT EXISTS OLAKE_DEMO;
ALTER DATABASE OLAKE_DEMO SET CATALOG = 'SNOWFLAKE';
ALTER DATABASE OLAKE_DEMO SET EXTERNAL_VOLUME = 'SNOWFLAKE_MANAGED';
-- The role OLake Go uses. It needs to create schemas; tables are created inside them.
CREATE ROLE IF NOT EXISTS OLAKE_ROLE;
GRANT USAGE, CREATE SCHEMA ON DATABASE OLAKE_DEMO TO ROLE OLAKE_ROLE;
GRANT USAGE ON WAREHOUSE OLAKE_WH TO ROLE OLAKE_ROLE;
GRANT ROLE OLAKE_ROLE TO ROLE SYSADMIN;
-- A service user for OLake Go. It holds the programmatic access token.
CREATE USER IF NOT EXISTS OLAKE_SVC TYPE = SERVICE DEFAULT_ROLE = OLAKE_ROLE;
GRANT ROLE OLAKE_ROLE TO USER OLAKE_SVC;
-- Snowflake issues a token to a service user only under a network policy, unless an
-- authentication policy waives that. This one waives it. Any schema can hold the policy.
USE SCHEMA OLAKE_DEMO.PUBLIC;
CREATE AUTHENTICATION POLICY IF NOT EXISTS olake_pat_policy
PAT_POLICY = (NETWORK_POLICY_EVALUATION = ENFORCED_NOT_REQUIRED);
ALTER USER OLAKE_SVC SET AUTHENTICATION POLICY olake_pat_policy;
-- The two values OLake Go asks for.
SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME() AS account_identifier,
CURRENT_REGION() AS region;
-- The token. Snowflake shows the secret once; copy it straight into OLake Go.
ALTER USER OLAKE_SVC ADD PROGRAMMATIC ACCESS TOKEN OLAKE_PAT
ROLE_RESTRICTION = 'OLAKE_ROLE' DAYS_TO_EXPIRY = 30;
What each block is for:
CATALOG = 'SNOWFLAKE'andEXTERNAL_VOLUME = 'SNOWFLAKE_MANAGED'on the database make every table OLake Go creates a Snowflake-managed Iceberg table on Snowflake's own storage. No S3 bucket, IAM role or external volume on your side. To keep the files in your own bucket, create an external volume and name it here instead.- The authentication policy is the step people miss. Without it, the
ADD PROGRAMMATIC ACCESS TOKENline fails withNetwork Policy is required when creating a programmatic access token for user OLAKE_SVC. In production, attach a network policy that allows OLake Go's egress IP instead of waiving the check. ROLE_RESTRICTIONpins the token toOLAKE_ROLE, so a leaked token cannot act asACCOUNTADMIN. Tokens expire afterDAYS_TO_EXPIRY(15 by default, 365 at most). Rotate it before then or the sync fails with an authentication error.
You can check the token outside OLake Go by exchanging it for a session token, the same call OLake Go makes on every sync:
curl -s -X POST "https://<account_identifier>.snowflakecomputing.com/polaris/api/catalog/v1/oauth/tokens" \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode grant_type=client_credentials \
--data-urlencode scope=session:role:OLAKE_ROLE \
--data-urlencode client_secret=<your PAT>
A good token returns a JSON object with an access_token. The other authentication methods (key-pair JWT, External OAuth, workload identity federation) are on the Horizon catalog page.
AWS Glue Data Catalog is the default catalog in OLake Go. The tables live as Parquet and metadata files in an S3 bucket you own, and Glue holds the pointer to the current metadata file. Athena, Redshift, EMR, Spark and DuckDB read the same tables through Glue, which is why it is the catalog to pick when more than one AWS engine will read the data.
You need:
- An S3 bucket for the table files, in the region where your engines run.
- An IAM user or role for OLake Go with Glue and S3 permissions. The exact policy is on the AWS Glue catalog page.
- No Glue database in advance: OLake Go creates one per job, named after the source database and schema (for example
pg_to_snowflake_shop_public).
Glue has no built-in compaction for tables written by external engines, so plan on OLake Fusion or Spark for maintenance once the change volume grows.
Step 3: Connect SQL Server to OLake Go
- OLake UI
- OLake CLI
- In the OLake UI, open Sources and click Create Source. Pick MSSQL as the connector, give the source a name and keep the OLake Go version on the latest release.
- Under Change data capture (CDC), leave Enable CDC on. Turn on Manage Capture Instance if you want OLake Go to create a new capture instance by itself after a schema change (it then needs
db_owner); leave it off to manage capture instances by hand. - Under Connection details, fill in the host, port, database name, username and password. Keep SSL off for a local test; on hosted SQL Server use the provider's certificate.
- Click Set up source. OLake Go tests the connection, then checks that CDC is on for the database and that the tables have capture instances, and shows the current and recommended value for anything that fails.
Here is the source form from the run on this page. SQL Server ran in another container, so the host is host.docker.internal; the login is the one from step 1, with VIEW DATABASE STATE and SELECT on dbo and cdc.
Set up source runs the connection test and the CDC checks before anything is saved: CDC on the database, a capture instance per table, a readable capture job. When one fails, the dialog names the setting and what to run.
The full field reference, including SSL modes and SSH tunnels, is on the SQL Server connector page.
Create source.json in your config folder. The update_method block is what turns CDC on:
{
"host": "mssql-server-host",
"port": 1433,
"database": "MSSQL DBName",
"username": "MSSQL Username",
"password": "MSSQL Password",
"max_threads": 3,
"retry_count": 3,
"ssl": {
"mode": "disable"
},
"update_method": {
"type": "CDC"
}
}
Then confirm OLake Go can reach the database:
docker run --pull=always \
-v "$PWD/config:/mnt/config" \
olakego/source-mssql:latest \
check --config /mnt/config/source.json
A working setup returns "status": "SUCCEEDED" together with the CDC prerequisite checks. Every field is described on the SQL Server connector page.
Step 4: Configure the Iceberg destination
- Snowflake Horizon
- AWS Glue
- OLake UI
- OLake CLI
- Open Destinations and click Create Destination.
- Pick Apache Iceberg as the connector and Horizon as the catalog type.
- Choose Programmatic Access Token (PAT) as the authentication type and fill in the fields below.
- Click Create. OLake Go calls the Horizon endpoint, exchanges the token and saves the destination.

Horizon Configuration Parameters
| Parameter | Sample Value | Description |
|---|---|---|
Authentication Typerequired | Programmatic Access Token (PAT) | Authentication method OLake Go uses for Horizon Catalog REST API requests. Set to match your workspace's authentication configuration. |
Horizon Iceberg REST Catalog URIrequired | https://<account_identifier>.snowflakecomputing.com/polaris/api/catalog | Snowflake Horizon Catalog REST API endpoint. |
Snowflake Databaserequired | SNOW | The name of the database in Snowflake. |
Session Role Scoperequired | session:role:<HORIZON_ROLE> | Informs Snowflake which role to use for this Horizon Catalog REST session, which controls privileges for catalog and table operations. Space-separated if providing more than one. |
Programmatic Access Tokenrequired | ver:1-hint:... | Snowflake programmatic access token (PAT). |
Cloud Storage Regionrequired | AWS_AP_SOUTH_1 | Snowflake's account region used to route requests to the correct storage endpoint. Run SELECT CURRENT_REGION(); to know the region |
| Catalog Name | horizon | Name of the Iceberg catalog OLake Go registers tables under. Defaults to olake_iceberg if left empty. |
| Enable Arrow Writes | false | Writes data and delete files using Apache Arrow based writer and registers them in Iceberg. |
Create destination.json next to source.json:
{
"type": "ICEBERG",
"writer": {
"catalog_type": "horizon",
"catalog_name": "horizon",
"rest_catalog_url": "https://<account_identifier>.snowflakecomputing.com/polaris/api/catalog",
"iceberg_s3_path": "OLAKE_DEMO",
"aws_region": "AWS_AP_SOUTH_1",
"scope": "session:role:OLAKE_ROLE",
"rest_auth_type": "Programmatic Access Token (PAT)",
"credential": "<your PAT>",
"arrow_writes": false
}
}
Horizon Configuration Parameters
| Parameter | Sample Value | Description |
|---|---|---|
catalog_typerequired | horizon | Defines the catalog type used by the writer. |
rest_auth_typerequired | Programmatic Access Token (PAT) | Authentication method OLake Go uses for Horizon Catalog REST API requests. Set to match your workspace's authentication configuration. |
rest_catalog_urlrequired | https://<account_identifier>.snowflakecomputing.com/polaris/api/catalog | Snowflake Horizon Catalog REST API endpoint. |
iceberg_s3_pathrequired | SNOW | The name of the database in Snowflake. |
credentialrequired | ver:1-hint:... | Snowflake programmatic access token (PAT). |
scoperequired | session:role:<HORIZON_ROLE> | Informs Snowflake which role to use for this Horizon Catalog REST session, which controls privileges for catalog and table operations. Space-separated if providing more than one. |
aws_regionrequired | AWS_AP_SOUTH_1 | Snowflake's account region used to route requests to the correct storage endpoint. Run SELECT CURRENT_REGION(); to know the region |
| catalog_name | horizon | Name of the Iceberg catalog OLake Go registers tables under. Defaults to olake_iceberg if left empty. |
| arrow_writes | false | Writes data and delete files using Apache Arrow based writer and registers them in Iceberg. |
- OLake UI
- OLake CLI
- Open Destinations and click Create Destination.
- Pick Apache Iceberg as the connector and AWS Glue as the catalog type.
- Enter the S3 path, the AWS region and the access key pair (or leave the keys empty to use the instance role).
- Click Create.
| Parameter | Sample Value | Description |
|---|---|---|
S3 Path required | s3://<BUCKET_NAME>/ | S3 bucket path where Iceberg table data and metadata files will be stored. |
AWS Region required | ap-south-1 | AWS Region where your S3 bucket and Glue Data Catalog exist. Required so OLake Go calls the correct regional S3 and Glue endpoints. |
| AWS Access Key | XXX | AWS access key ID for authentication. Optional if using IAM roles or instance profiles. If using IAM: Docker Compose: add the required IAM environment variables under x-envs in your compose file. See Service Environment Variables for setup details.Kubernetes: set up pod IAM in Cloud Integration. |
| AWS Secret Key | XXX | AWS secret access key for authentication. Optional if using IAM roles or instance profiles. If using IAM: Docker Compose: add the required IAM environment variables under x-envs in your compose file. See Service Environment Variables for setup details.Kubernetes: set up pod IAM in Cloud Integration. |
| S3 Endpoint | https://glue.ap-south-1.amazonaws.com | S3 API endpoint for writing Iceberg data files. Optional for AWS S3 but required for S3-compatible storage like MinIO. |
| Custom Glue Endpoint Configuration | true/false | Enable custom Glue catalog configuration when Glue catalog settings differ from S3 (different credentials, region, or endpoint). Shows additional Glue configuration fields. Leave off when Glue and S3 use the same AWS setup. |
| Enable Arrow Writes | true/false | Writes data and delete files using Apache Arrow based writer and registers them in Iceberg. |
The following fields appear in the UI after Custom Glue Endpoint Configuration is turned on. Configure Glue catalog connection settings here separately from the S3 fields above.
| Parameter | Sample Value | Description |
|---|---|---|
| Glue Catalog ID | 123456789012 | AWS account ID used as the Glue Data Catalog identifier. |
| Glue Access Key | XXX | Access key for authenticating Glue catalog requests. Required when Glue credentials differ from S3 credentials. |
| Glue Secret Key | XXX | Secret key for authenticating Glue catalog requests. Required when Glue credentials differ from S3 credentials. |
| Glue Endpoint | https://glue.ap-south-1.amazonaws.com | Custom endpoint URL for AWS Glue or a Glue-compatible catalog service. |
| Glue Region | ap-south-1 | Region for the Glue catalog, if different from the S3 region. Falls back to AWS Region if not set. |
{
"type": "ICEBERG",
"writer": {
"catalog_type": "glue",
"catalog_name": "olake_iceberg",
"iceberg_s3_path": "s3://<BUCKET_NAME>/",
"aws_region": "<AWS_REGION>",
"aws_access_key": "<AWS_ACCESS_KEY>",
"aws_secret_key": "<AWS_SECRET_KEY>",
"arrow_writes": false
}
}
| Parameter | Sample Value | Description |
|---|---|---|
iceberg_s3_path required | s3://<BUCKET_NAME>/ | S3 bucket path where Iceberg table data and metadata files will be stored. |
aws_region required | ap-south-1 | AWS Region where your S3 bucket and Glue Data Catalog exist. Required so OLake Go calls the correct regional S3 and Glue endpoints. |
| aws_access_key | XXX | AWS access key ID for S3 authentication. Optional if using IAM roles or instance profiles. If using IAM: add the required IAM environment variables in your shell or runtime environment. |
| aws_secret_key | XXX | AWS secret access key for S3 authentication. Optional if using IAM roles or instance profiles. If using IAM: add the required IAM environment variables in your shell or runtime environment. |
| s3_endpoint | https://glue.ap-south-1.amazonaws.com | S3 API endpoint for reading/writing Iceberg data files. Optional for AWS S3 but required for S3-compatible storage like MinIO. |
| glue_additional_config | true/false | Enable custom Glue catalog configuration when Glue catalog settings differ from S3 (different credentials, region, or endpoint). Leave off when Glue and S3 use the same AWS setup. |
| arrow_writes | false | Writes data and delete files using Apache Arrow based writer and registers them in Iceberg. |
When using separate Glue catalog settings, set glue_additional_config to true in destination.json and add the fields below. These configure Glue catalog connection settings separately from the S3 fields above.
| Parameter | Sample Value | Description |
|---|---|---|
| glue_catalog_id | 123456789012 | AWS account ID used as the Glue Data Catalog identifier. |
| glue_access_key | XXX | Access key for authenticating Glue catalog requests. Required when Glue credentials differ from S3 credentials. |
| glue_secret_key | XXX | Secret key for authenticating Glue catalog requests. Required when Glue credentials differ from S3 credentials. |
| glue_endpoint | https://glue.ap-south-1.amazonaws.com | Custom endpoint URL for AWS Glue or a Glue-compatible catalog service. |
| glue_region | ap-south-1 | Region for the Glue catalog, if different from the S3 region. Falls back to AWS Region if not set. |
Step 5: Create the job and run the first sync
- OLake UI
- OLake CLI
- Open Jobs and click Create Job. Give it a name and a schedule. Every Day at a fixed hour, or a cron expression, both work; the schedule is how often the change stream is drained, not how often a full copy runs.
- Select the source and the destination you created.
- Under Advanced Settings, set Target Query Engines to Snowflake, plus DuckDB and Apache Spark if they will read the tables too. OLake Go then resolves an Iceberg delete format every one of those engines can read, so you never pick one by hand.
- Click Next. OLake Go discovers the tables and opens the Streams page.
- Tick the tables to replicate. For each one, set the sync mode to Full Refresh + CDC and the ingestion mode to Upsert. Leave the Upsert Type as OLake Go resolved it (Positional Deletes in the run on this page).
- Click Create Job, then open the job's menu and choose Sync Now for the first run.
Three target query engines were set on this job. That is the only format decision you make: OLake Go works out which Iceberg delete format all three can read and sets it on every stream.

Discover the tables, choose the streams, then sync:
docker run --pull=always \
-v "$PWD/config:/mnt/config" \
olakego/source-mssql:latest \
discover --config /mnt/config/source.json
discover writes two files: available_streams.json (every table it found, do not edit) and selected_streams.json (the tables you want and their settings). In selected_streams.json, set sync_mode to {props.cliSyncMode ?? 'cdc'} for each table and pick the delete format your readers can open:
{
"selected_streams": {
"dbo": [
{
"stream_name": "customers",
"sync_mode": "cdc",
"normalization": true,
"append_mode": false,
"update_type": "pos"
}
]
}
}
update_type accepts eq (equality deletes, the default), pos (positional deletes) and dv (deletion vectors). Positional deletes and deletion vectors keep a small index between runs, so give the container a persistent directory for it through OLAKE_INDEX_DB_DIR. The first sync runs without a state file; OLake Go writes one at the end of the run:
docker run --pull=always \
-v "$PWD/config:/mnt/config" \
-e OLAKE_INDEX_DB_DIR=/mnt/config/index-db \
olakego/source-mssql:latest \
sync \
--config /mnt/config/source.json \
--selected-streams /mnt/config/selected_streams.json \
--available-streams /mnt/config/available_streams.json \
--destination /mnt/config/destination.json
Every later run adds --state /mnt/config/state.json to the same command, which is how OLake Go knows to replay only the changes since the last run. The full selected_streams.json reference is on the Docker CLI page; the index directory is described under index DB setup.
On this page the first run copied 8 customers and 40 orders (48 records, 3.05 KB) and finished in 37 seconds, container start included. OLake Go names the destination schema after the job, the source database and the schema, so sql_server_to_snowflake on database shop produced sql_server_to_snowflake_shop_dbo. The Iceberg DB field at the top of the Streams page changes it before the first sync.
Step 6: Query the tables in Snowflake
- Snowflake Horizon
- AWS Glue
There is no registration step. The schema and tables OLake Go committed through Horizon are already Snowflake-managed Iceberg tables in the database you configured. One thing to know before the first query: OLake Go creates them with quoted, lowercase names, so Snowflake needs the double quotes.
-- What OLake Go created (schema = <job name>_<source database>[_<source schema>])
SHOW ICEBERG TABLES IN SCHEMA OLAKE_DEMO."sql_server_to_snowflake_shop_dbo";
-- Quoted identifiers: the names are lowercase, as they were in the source
SELECT "id", "name", "city", "tier"
FROM OLAKE_DEMO."sql_server_to_snowflake_shop_dbo"."customers"
ORDER BY "id";
SHOW ICEBERG TABLES reports catalog_name = SNOWFLAKE, iceberg_table_type = MANAGED and external_volume_name = SNOWFLAKE_MANAGED: Snowflake treats them as its own managed Iceberg tables, not as external tables that need a refresh.
OLake Go adds four columns to every table: _olake_id (a hash of the primary key), _op_type, _olake_timestamp and _cdc_timestamp. _op_type is r for a row from the first snapshot, c for an insert, u for an update and d for a delete. Filter them out of dashboards, or use them to see when a row last changed.
With Glue as the catalog, Snowflake reads the tables through a catalog integration: an external volume that points at the S3 bucket, an integration that points at the Glue database, and one CREATE ICEBERG TABLE per table. These tables are read-only in Snowflake, and Snowflake picks up new snapshots when you refresh them.
-- 1. The bucket OLake Go writes to
CREATE OR REPLACE EXTERNAL VOLUME olake_s3_volume
STORAGE_LOCATIONS = ((
NAME = 'olake-s3',
STORAGE_PROVIDER = 'S3',
STORAGE_BASE_URL = 's3://<bucket>/',
STORAGE_AWS_ROLE_ARN = 'arn:aws:iam::<account>:role/<snowflake-s3-role>',
STORAGE_AWS_EXTERNAL_ID = 'olake_s3_volume_ext_id' -- any string; it goes into the role's trust policy
));
-- 2. The Glue database OLake Go created for the job
CREATE OR REPLACE CATALOG INTEGRATION olake_glue
CATALOG_SOURCE = GLUE
CATALOG_NAMESPACE = 'sql_server_to_snowflake_shop_dbo'
TABLE_FORMAT = ICEBERG
GLUE_AWS_ROLE_ARN = 'arn:aws:iam::<account>:role/<snowflake-glue-role>'
GLUE_CATALOG_ID = '<account>'
GLUE_REGION = '<region>'
ENABLED = TRUE;
-- 3. The values your IAM roles must trust
DESCRIBE EXTERNAL VOLUME olake_s3_volume;
DESCRIBE CATALOG INTEGRATION olake_glue;
-- 4. One table per Iceberg table
CREATE OR REPLACE ICEBERG TABLE customers
EXTERNAL_VOLUME = 'olake_s3_volume'
CATALOG = 'olake_glue'
CATALOG_TABLE_NAME = 'customers';
SELECT id, name, city, tier FROM customers ORDER BY id;
Step 3 is where the AWS side gets wired up. DESCRIBE EXTERNAL VOLUME returns STORAGE_AWS_IAM_USER_ARN and STORAGE_AWS_EXTERNAL_ID; put both into the trust policy of the S3 role. DESCRIBE CATALOG INTEGRATION returns GLUE_AWS_IAM_USER_ARN and GLUE_AWS_EXTERNAL_ID; put those into the trust policy of the Glue role. Until the trust policies carry these values, step 4 fails with an access error.
After every OLake Go sync, run ALTER ICEBERG TABLE customers REFRESH; so Snowflake reads the new snapshot. The full walk-through, including the IAM trust policies, is in Query Iceberg in Snowflake with OLake and AWS Glue and Snowflake's Glue catalog integration guide.
Step 7: Change rows in SQL Server and sync again
To see the change path work, the run on this page made 12 changes in SQL Server after the first sync:
INSERT INTO dbo.customers (name, email, city, tier) VALUES
(N'Maya Patel', 'maya@example.com', N'Pune', 'silver'),
(N'Lucas Silva', 'lucas@example.com', N'São Paulo', 'bronze');
INSERT INTO dbo.orders (customer_id, product, amount, status) VALUES
(9, 'Laptop', 1299.00, 'placed'), (9, 'Mouse', 25.50, 'placed'),
(10, 'Monitor', 349.99, 'placed'), (3, 'Keyboard', 89.00, 'placed'), (7, 'Webcam', 79.90, 'placed');
UPDATE dbo.customers SET tier = 'gold', updated_at = SYSUTCDATETIME() WHERE name = N'Liam Carter';
UPDATE dbo.customers SET city = N'Abu Dhabi', updated_at = SYSUTCDATETIME() WHERE name = N'Zara Ali';
UPDATE dbo.orders SET status = 'delivered', updated_at = SYSUTCDATETIME() WHERE id IN (1, 4, 7);
The second sync read 12 records (855 bytes) from the change tables and finished in 18 seconds end to end. For customers that meant one new data file with 4 rows: 2 inserts plus the new versions of 2 updated rows.
One small delete file retires the 2 old versions. OLake Go's commit report in the sync log shows it directly: addedDataFiles=1, addedRecords=4, addedPositionalDeleteFiles=1, addedPositionalDeletes=2, and orders the same shape with 8 rows and 3 deletes.

Snowflake shows the result with no refresh. Liam Carter is gold, Zara Ali moved to Abu Dhabi, and the two new customers are there.
The _op_type column shows how each row arrived: r for the snapshot, c for the inserts and u for the updates. The Agent capture job runs every few seconds, so a change made right before a sync starts can land in the next one instead.
Schema changes. A column added in SQL Server is not part of the existing capture instance. Create a new capture instance for the table, or let OLake Go do it with Manage Capture Instance on the source. OLake Go then adds the column to the Iceberg table on the next sync, and Snowflake shows it.
Widening changes are applied; narrowing or incompatible type changes fail the sync rather than corrupt the table. Full rules are on the schema evolution page.
Query the same tables from DuckDB and Spark
This is the point of writing Iceberg instead of loading Snowflake tables. Nothing is exported, copied or refreshed: both engines read the files OLake Go wrote, through the same Horizon endpoint, with credentials vended by Snowflake.
- DuckDB
- Apache Spark
DuckDB attaches Horizon as an Iceberg REST catalog. It wants a bearer token rather than the raw PAT, so exchange the PAT first (the curl call from the catalog setup), then attach:
INSTALL iceberg; LOAD iceberg;
INSTALL httpfs; LOAD httpfs;
CREATE SECRET horizon_secret (TYPE iceberg, TOKEN '<access_token from /v1/oauth/tokens>');
ATTACH 'OLAKE_DEMO' AS horizon (
TYPE iceberg,
ENDPOINT 'https://<account_identifier>.snowflakecomputing.com/polaris/api/catalog',
SECRET horizon_secret,
ACCESS_DELEGATION_MODE 'vended_credentials'
);
SHOW ALL TABLES;
SELECT id, name, city, tier FROM horizon.sql_server_to_snowflake_shop_dbo.customers ORDER BY id;
The session token lives about an hour; re-run the exchange and CREATE OR REPLACE SECRET when a query fails with an authorization error. DuckDB reads deletion vectors from duckdb-iceberg 1.5.3 onward, and only attaches REST catalogs backed by S3, S3 Tables or Google Cloud Storage, so pick an AWS- or GCP-hosted Snowflake account for this path.
DuckDB 1.5.5 returned the same 10 customers and the same orders roll-up as Snowflake in the run on this page. It read the current metadata file of each table through Horizon.
Spark reaches Horizon as a plain Iceberg REST catalog. The token is the same PAT OLake Go uses; scope picks the Snowflake role and the X-Iceberg-Access-Delegation header asks Horizon for short-lived storage credentials, so Spark never needs S3 keys.
spark-sql \
--packages org.apache.iceberg:iceberg-spark-runtime-3.5_2.12:1.10.0,org.apache.iceberg:iceberg-aws-bundle:1.10.0 \
--conf spark.sql.extensions=org.apache.iceberg.spark.extensions.IcebergSparkSessionExtensions \
--conf spark.sql.catalog.horizon=org.apache.iceberg.spark.SparkCatalog \
--conf spark.sql.catalog.horizon.type=rest \
--conf spark.sql.catalog.horizon.uri=https://<account_identifier>.snowflakecomputing.com/polaris/api/catalog \
--conf spark.sql.catalog.horizon.warehouse=OLAKE_DEMO \
--conf spark.sql.catalog.horizon.credential=<your PAT> \
--conf spark.sql.catalog.horizon.scope=session:role:OLAKE_ROLE \
--conf spark.sql.catalog.horizon.header.X-Iceberg-Access-Delegation=vended-credentials
SHOW TABLES IN horizon.sql_server_to_snowflake_shop_dbo;
SELECT id, name, city, tier FROM horizon.sql_server_to_snowflake_shop_dbo.customers ORDER BY id;
Use Iceberg 1.8 or later on the classpath when the tables carry deletion vectors; 1.10.0 is what this page was tested with. The AWS_REGION environment variable must be set to the region of the Snowflake account's storage (for example ap-south-1 for AWS_AP_SOUTH_1) or the vended credentials are rejected.
Spark 3.5.6 with Iceberg 1.10.0 returned the same 10 customers and the same orders roll-up as Snowflake and DuckDB in the run on this page.
An orders roll-up matched SQL Server to the cent in all three engines: 16 delivered orders for 8659.68, 18 placed for 10522.26, 11 shipped for 6397.25.
Data types: SQL Server to Iceberg to Snowflake
OLake Go maps SQL Server types to Iceberg types, and Snowflake maps Iceberg types to its own. Integers and strings pass through; numbers with a scale and the date types are the groups to know about.
| SQL Server | Iceberg (written by OLake Go) | Snowflake shows | Notes |
|---|---|---|---|
tinyint, smallint, int | int | NUMBER(10,0) | The IDENTITY keys on this page arrived as NUMBER(10,0). |
bigint | long | NUMBER(19,0) | |
decimal, numeric, money, smallmoney, float | double | FLOAT | OLake Go stores decimals as doubles. The orders.amount sums on this page matched SQL Server to the cent in every engine; round at query time when you need exact decimal arithmetic. |
real | float | FLOAT | |
bit | boolean | BOOLEAN | |
date, smalldatetime, datetime, datetime2, datetimeoffset | timestamptz (UTC) | TIMESTAMP_LTZ(6) | datetime2 has no zone in SQL Server; it is read as UTC, so set the session zone before comparing. datetimeoffset is converted to UTC. |
char, varchar, nchar, nvarchar, text, ntext, uniqueidentifier, xml, json, sql_variant | string | VARCHAR | A uniqueidentifier arrives as its 36-character text form. Parse json with PARSE_JSON(). |
binary, varbinary, image, rowversion, geometry, geography, hierarchyid | string | VARCHAR | Binary and spatial values arrive as text; keep large binaries out of the sync. |
SQL Server types in the table come from the SQL Server connector reference. The Snowflake side comes from Snowflake's Iceberg data types page (checked 2026-10-30) and from DESCRIBE TABLE on the tables of this run. OLake Go adds _cdc_start_lsn and _cdc_seqval on SQL Server tables, the log position each change came from.
Cost and maintenance
- Storage is Snowflake's with
SNOWFLAKE_MANAGED: you pay Snowflake storage rates for the Parquet and delete files. Point the database at your own external volume to keep the files in your bucket instead. - Compute. OLake Go runs wherever you run Docker; it does not use a Snowflake warehouse to write. Snowflake compute is spent only when you query.
- Maintenance. Snowflake expires old snapshots and compacts manifests on Snowflake-managed tables at no cost. Automatic data-file compaction is bundled only when Snowflake alone writes the table (Snowflake-managed Iceberg table maintenance). A CDC table that gets a new small file every minute will want compaction from the writer side; OLake Fusion does this for the catalogs OLake Go writes to, and Spark's
rewrite_data_filesworks through the same Horizon endpoint. - Change table disk. Every captured change is a row in the
cdcschema until the cleanup job removes it. On a busy table three days of changes is real space in the database; watchsys.dm_db_partition_statsfor thecdc.*_CTtables and shorten retention once the job runs reliably every hour. - Token rotation. The programmatic access token expires (30 days in the setup above, 365 at most). Put the renewal on a calendar; an expired token fails the next sync at the catalog handshake, before any data moves.
Troubleshooting
1. The source test fails to log in
failed to connect to MSSQL: failed to ping database: mssql: login error: Login failed for user 'olake'.
The login does not exist on the server, or the password is wrong. CREATE LOGIN runs in master, CREATE USER ... FOR LOGIN runs in the database; both are needed. The run on this page hit this because the login batch had not run, and the fix was the two statements from step 1.
2. The first sync fails on a table you did not create
failed to run change stream: failed in pre cdc run for driver[mssql]: CDC is not enabled for stream dbo.systranschemas
Enabling CDC or replication on a database adds dbo.systranschemas to it, and discovery lists it next to your tables. It has no capture instance, so a job that selects every stream fails before the snapshot.
Untick it on the Streams page (or any other table without a capture instance), and keep the job to the tables from step 1. The run on this page hit this on its first attempt.
3. The source test passes but no changes arrive
Two causes. The common one is timing: the capture job copies log records into the change tables every few seconds, so a sync started right after a write can read nothing and the next sync picks the rows up. The run on this page saw exactly that on one attempt.
The other cause is that the SQL Server Agent is not running, so the capture job never copies log records into the change tables. In Docker the agent is off unless the container starts with MSSQL_AGENT_ENABLED=true. On a VM, start the SQLSERVERAGENT service.
EXEC master.dbo.xp_servicecontrol 'QueryState', 'SQLServerAgent' reports Running. when it is up. After that, SELECT count(*) FROM cdc.dbo_customers_CT starts growing a few seconds after the next insert.
4. The next sync cannot resume
The CDC cleanup job removed the change rows between the saved position and now, because the job was paused longer than the retention (three days by default). Run a fresh full snapshot and raise retention with EXEC sys.sp_cdc_change_job @job_type = 'cleanup', @retention = 10080 (minutes, here seven days).
5. Snowflake cannot find the table
SQL compilation error:
Object 'OLAKE_DEMO.SQL_SERVER_TO_SNOWFLAKE_SHOP_DBO.CUSTOMERS' does not exist or not authorized.
Snowflake upper-cased an unquoted identifier. OLake Go creates the schema and tables with their lowercase names, so quote them: OLAKE_DEMO."sql_server_to_snowflake_shop_dbo"."customers".
6. The destination test fails at the catalog handshake
OLake Go's destination test exchanges the token at /v1/oauth/tokens before anything else. Three causes cover nearly every failure.
The service user has no network or authentication policy, the scope does not match the token's ROLE_RESTRICTION, or the token expired. Run the curl exchange from the catalog setup; it returns the same error Snowflake gives OLake Go.
How this compares with other ways to move SQL Server data to Snowflake
| Method | Freshness | Updates and deletes | Where the data lands | What you run |
|---|---|---|---|---|
| Snowflake Openflow connector for SQL Server | CDC through SQL Server change tracking or CDC | Yes, as soft deletes plus journal tables | Native Snowflake tables; Snowflake is the only reader | An Openflow deployment in Snowpark Container Services or your own AWS account, billed in Snowflake credits |
| Debezium, Kafka and the Snowflake Kafka connector | Seconds | Yes, with the connector's tombstone handling | Kafka topics, then Snowflake tables | Kafka, Kafka Connect, the Debezium SQL Server connector and a schema registry |
| Managed ELT (Fivetran, Estuary, Airbyte Cloud) | Minutes, by plan | Yes | Snowflake tables, a second copy you pay to move and store | Nothing; priced per row, per GB or per connector |
Manual export (bcp or SSIS to files, then COPY INTO) | Hours to daily | No; full reloads only | Files you control | A script and a scheduler |
| OLake Go to Iceberg on Horizon (this guide) | CDC on a schedule down to one minute | Yes, as Iceberg row-level deletes | Apache Iceberg tables that Snowflake, DuckDB, Spark and Trino all read | One Docker Compose stack, open source; Snowflake storage plus your own compute |
Openflow is the simpler choice when Snowflake is the only reader and you want Snowflake to run the pipeline. Writing Iceberg once avoids paying to move and store a second copy as soon as another engine needs the same rows, or you want to own the files.
When not to use this
- The edition has no CDC. SQL Server Express and Web cannot enable change data capture, and Azure SQL Database needs the S3 tier or above. Full Refresh and Full Refresh + Incremental on an
updated_atcolumn still work there. - Your Snowflake account is on Azure and DuckDB is a reader. DuckDB attaches REST catalogs backed by S3, S3 Tables and Google Cloud Storage only, so pick Spark or Trino as the second engine there.
- Tables have no primary key. Inserts replicate; updates and deletes cannot be matched to a row and are not applied. Add a primary key or a unique index first.
FAQs
How do I replicate SQL Server to Snowflake without Openflow or a Kafka pipeline?
Run OLake Go (open source, Apache 2.0) against a SQL Server database with change data capture enabled, and point it at Snowflake's Horizon catalog. The first sync copies the tables in full, every later sync reads only the rows SQL Server's capture job wrote to the change tables, and the tables appear in Snowflake as Snowflake-managed Iceberg tables. No Openflow, Kafka, Debezium or Snowflake connector sits in the path.
Does OLake Go copy the existing SQL Server data before it reads the change tables?
Yes, automatically. A job in Full Refresh + CDC mode records the current log sequence number, copies every selected table in parallel chunks, then reads the change tables from that position. Nothing written during the copy is lost, and there is no separate backfill job.
What does SQL Server need for OLake Go CDC?
Change data capture on the database and on each table, which needs Developer, Standard (2016 SP1 or later) or Enterprise edition, plus a running SQL Server Agent to fill the change tables. The OLake Go login needs SELECT on the table schema and on the cdc schema. Amazon RDS and Azure SQL Managed Instance expose the same feature through their own stored procedures.
Does SQL Server CDC with OLake Go work on Amazon RDS, Azure SQL or Cloud SQL?
Yes. On RDS for SQL Server, enable CDC with msdb.dbo.rds_cdc_enable_db; on Cloud SQL, with msdb.dbo.gcloudsql_cdc_enable_db; Azure SQL Managed Instance and SQL Server on a VM take the standard sys.sp_cdc_enable_db. Azure SQL Database also supports CDC on the S3 tier and above. The table step and the login are the same everywhere.
Which SQL Server data types change on the way to Snowflake?
decimal, numeric, money and float columns become Iceberg double and show up in Snowflake as FLOAT, so round at query time when you need exact decimal arithmetic. datetime, datetime2, smalldatetime and date become timestamps in UTC (Snowflake TIMESTAMP_LTZ). nvarchar, varchar, uniqueidentifier, xml, json and the binary types arrive as VARCHAR. bit becomes BOOLEAN; int and bigint map one to one.
How long does SQL Server keep change rows for OLake Go?
Three days by default. The CDC cleanup job removes change rows older than its retention setting, and a job paused for longer than that cannot resume and needs a fresh snapshot. Raise retention with sys.sp_cdc_change_job before a planned pause, and keep an eye on the size of the cdc schema.
Can I use AWS Glue instead of the Horizon catalog?
Yes. With Glue as the catalog the files stay in your S3 bucket, Athena, Redshift and EMR read them natively, and Snowflake reads them through a catalog integration as read-only tables you refresh after each sync. Horizon is the better default when Snowflake is the main reader, because the tables are Snowflake-managed and need no refresh.
Related guides
Deeper reading on this site: