Management

Posit Team includes a Posit Connect management page for an administrator to perform post-installation operations.

The Connect card on the Posit Team landing page with the vertical dots menu open, showing the Manage option. — Connect management menu

To manage Connect, click the menu icon (vertical dots) on the Connect card and click Manage.

The Connect product management page showing service status, product URL, and configuration options. — Connect management page

Stop, start, restart

The Connect service can be managed in several ways:

Manually triggered operations
Programmatic operations
Scheduled operations

If there are times when Connect is not used, such as on weekends and holidays, stopping (suspending) the service can help reduce your Snowflake compute costs. By default, a suspended service resumes when a user visits it.

Some features of Connect, such as scheduled jobs, do not run while the service is suspended.

Manual operations

You can manually stop, start, and restart the Connect service from the Manage page.

The Connect management page showing Stop, Start, Restart, and Upgrade buttons for manually controlling the Connect service. — Connect service operations

Programmatic operations

You can start, stop, and restart the Connect service using SQL commands.

Start service

Starts the named product service.

Syntax

START_SERVICE(product VARCHAR)

Start Connect within the POSIT_TEAM Native App:

Snowsight UI

SELECT POSIT_TEAM.app.START_SERVICE('connect');

Stop service

Stops the named product service.

Syntax

STOP_SERVICE(product VARCHAR, allow_resume BOOLEAN DEFAULT TRUE)

The optional allow_resume argument indicates whether or not user activity is allowed to resume the service. With allow_resume = TRUE (the default), a user visiting the product resumes the service. With allow_resume = FALSE, the service does not resume on user activity. This setting persists until an administrator starts the service from the management page or a SQL call.

The Posit Team management page for Connect shows a badge indicating when auto-resume is disabled. Users visiting the product through Posit Team see that the service is stopped.

Stop Connect within the POSIT_TEAM Native App, allowing the service to resume on user activity:

Snowsight UI

SELECT POSIT_TEAM.app.STOP_SERVICE('connect');

Stop Connect within the POSIT_TEAM Native App, preventing automatic resume on user activity:

Snowsight UI

SELECT POSIT_TEAM.app.STOP_SERVICE('connect', FALSE);

Restart service

Restarts the named product service.

Syntax

RESTART_SERVICE(product VARCHAR)

Restart Connect within the POSIT_TEAM Native App:

Snowsight UI

SELECT POSIT_TEAM.app.RESTART_SERVICE('connect');

Scheduled operations

Schedule the start and stop of Connect with Snowflake tasks. This example stops Connect with allow_resume = FALSE so user activity does not resume the service.

Snowsight UI

-- Create a task to stop Connect at 6 PM daily.
CREATE OR REPLACE TASK task_connect_stop
    SCHEDULE = 'USING CRON 0 18 * * * America/New_York'
AS
    SELECT POSIT_TEAM.app.STOP_SERVICE('connect', FALSE);

-- Enable the stop task.
ALTER TASK task_connect_stop RESUME;

-- Create a task to start Connect at 8 AM daily
CREATE OR REPLACE TASK task_connect_start
    SCHEDULE = 'USING CRON 0 8 * * * America/New_York'
AS
    SELECT POSIT_TEAM.app.START_SERVICE('connect');

-- Enable the start task.
ALTER TASK task_connect_start RESUME;

Upgrade

Note

Posit frequently upgrades the Posit Team Native App and its associated version of Connect. When the Posit Team Native App is updated, Posit Team automatically upgrades Connect.

Some configuration changes require a service upgrade before they take effect. The management page indicates when configuration changes require an upgrade. Click Upgrade to upgrade Connect.

The Connect management page with the Upgrade button visible, showing a pending configuration change requiring an upgrade. — Connect upgrade

Change configuration

In the management page you can change the license, modify the compute pool instance family, increase storage, update user roles and access, update the OAuth integration, and configure email. Some changes require a service upgrade. Follow the upgrade section instructions.

Modify compute pool

The Manage page lets you change the instance family of the compute pool that runs Connect. Choose an instance family appropriate to your workload requirements.

The Connect management page showing a dropdown to select the compute pool instance family used to run the Connect service. — Connect compute pool

Click Upgrade to apply an instance family change and restart Connect.

Increase storage

The Manage page lets you increase the storage for Connect content. Enter a larger size and click Set.

The Connect management page showing the Storage setting. — Connect storage

Storage can only grow. Click Upgrade to apply the change. The upgrade backs up Connect, recreates it with the larger storage, and restores the backup. This can take some time, and the Connect URL changes. Existing OAuth integrations stop working. Update them as described in Configure Snowflake OAuth, and update any saved links.

Automatic upgrades also apply a pending storage increase.

Configure Snowflake OAuth

Configure Snowflake OAuth for Connect after setup is complete. Configure OAuth directly in the Connect UI, not in the Posit Team Native App.

Step 1: Create the Snowflake OAuth security integration

Open the Manage page and click Snowflake OAuth to access the setup instructions and SQL template.

The Connect management page with the Snowflake OAuth button highlighted for updating the Snowflake OAuth integration. — Manage Snowflake OAuth

Customize the SQL template with your desired security integration name, then run it in a Snowflake Worksheet as an ACCOUNTADMIN.

The Snowflake OAuth page showing SQL templates for creating the security integration and retrieving client credentials. — Snowflake OAuth setup instructions

Step 2: Retrieve the client ID and client secret

After creating the integration, run the following SQL as an ACCOUNTADMIN to retrieve the OAuth client credentials:

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('YOUR_APP_NAME_CONNECT_OAUTH');

Step 3: Configure the integration in Connect

Visit System > Integrations in Connect and use the OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET from Step 2 to configure the integration.

The Connect System > Integrations page showing existing OAuth integrations and an option to add a new integration. — Connect Integrations

Follow the Snowflake OAuth integration instructions to complete the configuration.

Enable Restricted Caller’s Rights

Private Preview

This feature is in private preview. To enroll, request access from Posit support.

Restricted Caller’s Rights (RCR) routes Connect Snowflake queries directly through the Snowflake internal network. On the Manage page, turn on Enable RCR under Restricted Caller’s Rights, then click Upgrade to apply the change.

RCR also requires a network rule and a caller grant in your Snowflake account. See Restricted Caller’s Rights for the full configuration.

Backup and restore

Posit Team automatically creates a Connect backup roughly once per week and retains the most recent four, about one month of backups. Posit Team removes older automatic backups.

You can also create a backup manually, which is useful when you want one taken at a specific point in time, such as before an upgrade or a configuration change. Posit Team does not manage manual backups; delete them when they are no longer needed.

To create a manual backup, specify a backup name or leave it blank for a randomly assigned name and click Save New Backup.

The Connect management page showing a text field for a backup name and a 'Save New Backup' button. — Create backup

Next, wait several minutes for the backup to be created.

The Connect management page showing a successfully created backup entry in the backups list. — Backup created

Restoring from a backup takes about 10 minutes. You cannot restore a backup that is larger than the configured storage. Increase storage first. You can delete backups that are no longer needed.

Logs

You can view logs of the Connect installation.

The Connect management page showing a scrollable log viewer with output from the Connect service. — Connect logs

User access

Snowflake users can access Connect after you grant the appropriate application role to their user roles. We recommend you grant the application role POSIT_TEAM_USER to most users.

Snowsight UI

GRANT APPLICATION ROLE POSIT_TEAM.POSIT_TEAM_USER TO ROLE YOUR_USER_ROLE;

To give users access to Connect but not the other products in the Posit Team Native App, grant the POSIT_CONNECT_PUBLISHER or POSIT_CONNECT_VIEWER application role. Grant POSIT_CONNECT_PUBLISHER to users who publish content and POSIT_CONNECT_VIEWER to users who only view content. See Managing Application Roles to learn more.

Snowsight UI

GRANT APPLICATION ROLE POSIT_TEAM.POSIT_CONNECT_PUBLISHER TO ROLE YOUR_PUBLISHER_ROLE;
GRANT APPLICATION ROLE POSIT_TEAM.POSIT_CONNECT_VIEWER TO ROLE YOUR_VIEWER_ROLE;

Connect groups

You can create additional application roles to use as groups in Connect. Publishers and Collaborators can use “groups” to associate multiple users to content as viewers or collaborators. This can often provide an easier alternative to maintaining a discrete list of users associated with each instance of published content.

To add a new application role, click User Roles and Access on the Connect management page.

The Connect management page with the User Roles and Access button highlighted. — Manage user roles and access

The application roles page lets you manage custom application roles. Posit Team owns the POSIT_* roles. Custom application roles cannot use the POSIT_* prefix.

The User Roles and Access page showing a table of managing roles with a text field and Create button for adding new application roles. — Adjust application roles

Change the egress

To ensure full product functionality, key endpoints must be accessible, such as those for Snowflake OAuth and the Online Certificate Status Protocol (OCSP). For more information, see the security egress traffic documentation.

Editing the default egress policy requires the ACCOUNTADMIN role. You can modify the default egress policy for Connect by:

Using the Snowsight UI (recommended) or
Writing your own SQL

To edit network rules via Snowsight UI:

Visit Governance & security > Network policies > Network Rules.

The Snowsight Governance & security Network Rules page showing the Connect egress network rule available for editing. — Network rule edit

Edit the Connect egress network rule and remember to include the required endpoints detailed in the security egress documentation.

Snowflake generates the egress network rule and external access integration from the application egress references at install time. Each of these names begins with your application name, so substitute your application name for POSIT_TEAM below. For an application installed as POSIT_TEAM, the Connect network rule is POSIT_TEAM_APP_DATA.CONFIGURATION.POSIT_TEAM_CONNECT_EGRESS_NETWORK_RULE.

To edit network rules via SQL:

Find the network rule bound to the Connect external access integration, then modify it.

Snowsight UI

-- The ALLOWED_NETWORK_RULES property lists the fully qualified network rule
DESCRIBE EXTERNAL ACCESS INTEGRATION POSIT_TEAM_CONNECT_EGRESS_EXTERNAL_ACCESS;

-- Inspect the current network rule
DESCRIBE NETWORK RULE posit_team_app_data.configuration.posit_team_connect_egress_network_rule;

--- include custom <host>:<port>
--- host names are allowed
--- this example policy allows all ips on port 80 and 443
ALTER NETWORK RULE posit_team_app_data.configuration.posit_team_connect_egress_network_rule SET VALUE_LIST('0.0.0.0:80', '0.0.0.0:443');

Modify the egress rules only after a successful installation, and only change one rule at a time, allowing two to three minutes for each rule to take effect.

Common egress endpoints

The default egress policy allows the endpoints below. If you restrict egress, keep the endpoints that support the Connect features you use:

github.com:443: Hosts Git-backed content when the repository is hosted on GitHub. Hosts Connect Gallery examples.
raw.githubusercontent.com:443: Hosts the list of Connect Gallery examples.
release-assets.githubusercontent.com:443: Hosts releases of Connect Gallery examples.
posit-dev.github.io:443: The Connect dashboard uses this for its news feed.
p3m.dev:443, packagemanager.posit.co:443, rspm-sync.rstudio.com:443: Hosts R and Python packages. Omit when Connect does not install packages from the public Package Manager.
pypi.org:443, files.pythonhosted.org:443: Hosts Python packages. Omit when Connect does not install packages from PyPI.

Git-backed content might need additional endpoints, such as a package repository, to build the environment for the deployed content. See Egress traffic.

Troubleshooting and support

Visit the troubleshooting page for known issues and troubleshooting steps. If none of the troubleshooting steps help, please submit a request through the Posit support form or click Support in the navigation header.