Overview
Warehouse-native experiment analysis lets you run statistical computations directly in your data warehouse.
To set this up for BigQuery, connect a BigQuery service account to Datadog and configure your experiment settings. This guide covers:
- Preparing Google Cloud resources
- Granting permissions to the Datadog service account
- Configuring experiment settings in Datadog
Prerequisites
Datadog connects to BigQuery through a Google Cloud service account. If you already have a service account connected to Datadog, skip to Step 1. Otherwise, expand the section below to create one.
Create a Google Cloud service account
Create a Google Cloud service account
- Open your Google Cloud console.
- Navigate to IAM & Admin > Service Accounts.
- Click Create service account.
- Enter the following:
- Service account name.
- Service account ID.
- Service account description.
- Click Create and continue.
- Note: The Permissions and Principals with access settings are optional here. These are configured in Step 2.
- Click Done.
After you create the service account, continue to Step 1 to set up the Google Cloud resources.
If you plan to use other Google Cloud observability functionality in Datadog, see Datadog's Google Cloud Platform integration documentation to determine which resources to enable.
Step 1: Prepare the Google Cloud resources
Datadog Experiments uses a BigQuery dataset for caching experiment results and a Cloud Storage bucket for staging experiment records.
Create a BigQuery dataset
- Open your Google Cloud console.
- In the Search bar, search for BigQuery.
- In the Explorer panel, expand your project (for example,
datadog-sandbox). - Select Datasets, then click Create dataset.
- Enter a Dataset ID (for example,
datadog_experiments_output). - (Optional) Select a Data location from the dropdown, add Tags, and set Advanced options.
- Click Create dataset.
Create a Cloud Storage bucket
Create a Cloud Storage bucket that Datadog Experiments can use to stage experiment exposure records. See Google's Create a bucket documentation.
Step 2: Grant permissions to the Datadog service account
The Datadog Experiments service account requires specific permissions to run warehouse-native experiment analysis.
Assign IAM roles at the project level
To assign IAM roles so Datadog Experiments can read and write data, and run jobs in your data warehouse:
- Open your Google Cloud console and navigate to IAM & Admin > IAM.
- Select the Allow tab and click Grant access.
- In the New principals field, enter the service account email.
- Using the Select a role dropdown, add the following roles:
- BigQuery Job User: Allows the service account to run BigQuery jobs.
- BigQuery Data Owner: Grants the service account full access to the Datadog Experiments output dataset.
- Storage Object User: Allows the service account to read and write objects in the storage bucket that Datadog Experiments uses.
- BigQuery Data Viewer: Allows the service account to read tables used in warehouse-native metrics.
- Click Save.
Grant read access to specific source tables
Repeat the following steps for each dataset you plan to use for experiment metrics:
- In the Google Cloud console Search bar, search for BigQuery.
- In the Explorer panel, expand your project (for example,
datadog-sandbox). - Click Datasets, then select the dataset containing your source tables.
- Click the Share dropdown and select Manage permissions.
- Click Add principal.
- In the New principals field, enter the service account email.
- Using the Select a role dropdown, select the BigQuery Data Viewer role.
- Click Save.
To set this up for Databricks, connect a Databricks service account to Datadog and configure your experiment settings. This guide covers:
- Granting permissions to the service principal
- Connecting Databricks to Datadog
- Configuring experiment settings in Datadog
Prerequisites
Datadog Experiments connects to Databricks through the Datadog Databricks integration. If you already have a Databricks integration configured for the workspace you plan to use, skip to Step 1. Otherwise, expand the section below to create a service principal.
Create a Databricks service principal
Create a Databricks service principal
In your Databricks Workspace:
- Click your profile in the top right corner and select Settings.
- In the Settings menu, click Identity and access.
- On the Service principals row, click Manage, then:
- Click Add service principal, then Add new.
- Enter a service principal name and click Add.
- Click the name of the new service principal to open its details page.
- Select the Permissions tab, then:
- Click Grant access.
- Under User, Group or Service Principal, enter the service principal name.
- Using the Permission dropdown, select Manage.
- Click Save.
- Select the Secrets tab, then:
- Click Generate secret.
- Set the Lifetime (days) value to the maximum allowed (for example, 730).
- Click Generate.
- Note your Secret and Client ID.
- Click Done.
- In the Settings menu, click Identity and access.
- On the Groups row, click Manage, then:
- Click admins, then Add members.
- Enter the service principal name and click Add.
After you create the service principal, continue to Step 1 to grant the required permissions.
If you plan to use other warehouse observability functionality in Datadog, see Datadog's Databricks integration documentation to determine which resources to enable.
Step 1: Grant permissions to the service principal
You must be an account admin to grant these permissions.
In your Databricks Workspace, open the SQL Editor to run the following commands and grant the service principal permissions for warehouse-native experiment analysis.
Grant read access to source tables
Grant the service principal read access to the tables containing your experiment metrics. Run both GRANT USE commands, then run the GRANT SELECT option that matches your access needs. Replace <catalog>, <schema>, <table>, and <principal> with the appropriate values.
GRANT USE CATALOG ON CATALOG <catalog> TO `<principal>`;
GRANT USE SCHEMA ON SCHEMA <catalog>.<schema> TO `<principal>`;
-- Option 1: Give read access to a single table
GRANT SELECT ON TABLE <catalog>.<schema>.<table> TO `<principal>`;
-- Option 2: Give read access to all tables in the schema
GRANT SELECT ON ALL TABLES IN SCHEMA <catalog>.<schema> TO `<principal>`;
Create an output schema
Run the following commands to create a schema where Datadog Experiments can write intermediate results and temporary tables. Replace datadog_experiments_output with your output schema name, and <catalog> and <principal> with the appropriate values.
CREATE SCHEMA IF NOT EXISTS <catalog>.datadog_experiments_output;
GRANT USE SCHEMA ON SCHEMA <catalog>.datadog_experiments_output TO `<principal>`;
GRANT CREATE TABLE ON SCHEMA <catalog>.datadog_experiments_output TO `<principal>`;
Configure a volume for temporary data staging
Datadog Experiments uses a volume to temporarily save exposure data before copying it into a Databricks table. Run the following commands to create and grant access to this volume. Replace datadog_experiments_output with your output schema name, and <catalog> and <principal> with the appropriate values.
CREATE VOLUME IF NOT EXISTS <catalog>.datadog_experiments_output.datadog_experiments_volume;
GRANT READ VOLUME ON VOLUME <catalog>.datadog_experiments_output.datadog_experiments_volume TO `<principal>`;
GRANT WRITE VOLUME ON VOLUME <catalog>.datadog_experiments_output.datadog_experiments_volume TO `<principal>`;
Grant SQL warehouse access
Grant the service principal access to the SQL warehouse that Datadog Experiments uses to run queries.
- Navigate to SQL Warehouses in your Databricks Workspace.
- Select the warehouse for Datadog Experiments.
- At the top right corner, click Permissions.
- Grant the service principal the Can use permission.
- Close the Manage permissions modal.
Step 2: Connect Databricks to Datadog
To connect your Databricks Workspace to Datadog for warehouse-native experiment analysis:
- Navigate to Datadog's integrations page and search for Databricks.
- Click the Databricks tile to open its modal.
- Select the Configure tab and click Add Databricks Workspace. If this is your first Databricks account, the setup form appears automatically.
- Under the Connect a new Databricks Workspace section, enter:
- Workspace Name.
- Workspace URL.
- Client ID.
- Client Secret.
- System Tables SQL Warehouse ID.
- Toggle off Jobs Monitoring and all other products.
- Toggle off the Metrics - Model Serving resource.
- Click Save Databricks Workspace.
To set this up for Amazon Redshift, connect a Redshift cluster to Datadog using the AWS integration and configure your experiment settings. This guide covers:
- Preparing the Redshift cluster
- Creating AWS resources and granting IAM permissions
- Configuring experiment settings in Datadog
Prerequisites
Datadog Experiments connects to Redshift through Datadog's Amazon Web Services (AWS) integration. If you already have the AWS integration configured for the account containing your Redshift cluster, skip to Step 1.
Set up the AWS integration
Set up the AWS integration
Adding an AWS account requires the AWS Configurations Manage permission. If your organization uses custom roles, verify that your role includes this permission.
- Navigate to Datadog's integrations page and search for Amazon Web Services.
- Click the Amazon Web Services tile to open its modal.
- Click Add AWS Account(s) under the Configuration tab.
- If you do not yet have the AWS integration installed, Add AWS Account(s) appears on the AWS landing page after you open the integration tile.
- Follow the CloudFormation setup flow to create an IAM role that allows Datadog to make API calls to your AWS account:
- Select your AWS Region.
- Choose your Datadog API Key.
- Create a Datadog Application Key.
- Toggle off Deploy log forwarder and Disable All Log Resources (these are not needed for experiment analysis).
- Select No for Detect security issues.
- Click Open in AWS Console to launch your CloudFormation template. See the Getting Started with AWS documentation for instructions on navigating the AWS console.
You can follow your configuration's completion steps under Deployment Status on the integration setup page in Datadog.
If you plan to use other warehouse observability functionality in Datadog, see Datadog's Amazon Web Services integration documentation to determine which resources to enable.
Step 1: Prepare the Redshift cluster
Create a Datadog service user and a dedicated schema for Datadog to store experiment results and intermediate tables.
You must have superuser or admin privileges in the Redshift database to create the Datadog service user.
Create a Datadog service user in your Redshift database
Run the following command to create a service user with a strong password that Datadog can use to execute queries. Replace datadog_experiments_user with your user value and Your_Strong_Password with your password.
CREATE USER datadog_experiments_user PASSWORD 'Your_Strong_Password';
Create a Redshift output schema
Run the following commands to create a schema where Datadog can store experiment results and intermediate tables. Replace datadog_experiments_output with your schema name and datadog_experiments_user with your service user value.
CREATE SCHEMA IF NOT EXISTS datadog_experiments_output;
GRANT ALL ON SCHEMA datadog_experiments_output TO datadog_experiments_user;
Grant the service user read access to your metric data
Grant the service user read access to the tables or schemas that contain your source data. These are the tables you plan to use for experiment metrics, and are typically in a different schema than the output schema created above. Run the GRANT USAGE command, then run the GRANT SELECT option that matches your access needs. Replace datadog_experiments_user, <schema>, and <table> with the appropriate values.
GRANT USAGE ON SCHEMA <schema> TO datadog_experiments_user;
-- Option 1: Give read access to a single table
GRANT SELECT ON TABLE <schema>.<table> TO datadog_experiments_user;
-- Option 2: Give read access to all tables in the schema
GRANT SELECT ON ALL TABLES IN SCHEMA <schema> TO datadog_experiments_user;
Step 2: Create AWS resources and grant IAM permissions
Create an S3 bucket
Create an S3 bucket for importing exposure events into your warehouse. The bucket name must start with datadog-experimentation- (for example, datadog-experimentation-[aws_account_id]). You can use the bucket's default settings.
Grant additional IAM permissions
In addition to the permissions listed in the AWS integration documentation, Datadog Experiments requires additional IAM permissions to run warehouse-native experiment analysis.
Use the following table to gather the values for your environment, then add the policy statement below to the IAM role that your Datadog AWS integration uses.
| Field | Example |
|---|---|
[Redshift cluster ARN] | arn:aws:redshift:us-east-1:[account-id]:namespace:[namespace-id] |
[Redshift user ARN] | arn:aws:redshift:us-east-1:[account-id]:dbuser:[cluster-name]/[user] |
[Redshift database ARN] | arn:aws:redshift:us-east-1:[account-id]:dbname:[cluster-name] |
[S3 bucket ARN] | arn:aws:s3:::[bucket-name] |
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "RedshiftGetClusterCredentials",
"Effect": "Allow",
"Action": [
"redshift:GetClusterCredentials"
],
"Resource": [
"[Redshift cluster ARN]",
"[Redshift user ARN]",
"[Redshift database ARN]"
]
},
{
"Sid": "QueryRedshift",
"Effect": "Allow",
"Action": [
"redshift-data:ExecuteStatement",
"redshift-data:GetStatementResult",
"redshift-data:DescribeStatement",
"redshift-data:ListStatements",
"redshift-data:CancelStatement"
],
"Resource": "*"
},
{
"Sid": "ListExperimentationBucket",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": "[S3 bucket ARN]"
},
{
"Sid": "ReadWriteExperimentationBucket",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject"
],
"Resource": "[S3 bucket ARN]/*"
}
]
}
To set this up for Snowflake, connect a Snowflake service account to Datadog and configure your experiment settings. This guide covers:
Step 1: Prepare the Snowflake service account
The examples in this guide use datadog_experiments_user and datadog_experiments_role as the service account's user and role. Replace these with your own values.
Create a dedicated service user and role in Snowflake
- Use the Snowflake documentation to create a public-private key pair for enhanced authentication. Datadog only supports unencrypted private keys.
- Run the following commands in Snowflake to create the user and role in the service account. Replace
<public_key>with the public key you generated in the previous step.
USE ROLE ACCOUNTADMIN;
CREATE ROLE IF NOT EXISTS datadog_experiments_role;
CREATE USER IF NOT EXISTS datadog_experiments_user
RSA_PUBLIC_KEY = '<public_key>';
GRANT ROLE datadog_experiments_role TO USER datadog_experiments_user;
ALTER USER datadog_experiments_user SET DEFAULT_ROLE = datadog_experiments_role;
Grant privileges to the role
- Identify the tables in Snowflake from which you intend to create metrics.
- Run the following commands to grant read privileges to the new role, replacing
<database>,<schema>, and<table>with their appropriate values. Run bothGRANT USAGEcommands, then run theGRANT SELECToption or options that match your access needs.
GRANT USAGE ON DATABASE <database> TO ROLE datadog_experiments_role;
GRANT USAGE ON SCHEMA <database>.<schema> TO ROLE datadog_experiments_role;
-- Option 1: Give read access to a single table
GRANT SELECT ON TABLE <database>.<schema>.<table> TO ROLE datadog_experiments_role;
-- Option 2: Give read access to all existing tables in the schema
GRANT SELECT ON ALL TABLES IN SCHEMA <database>.<schema> TO ROLE datadog_experiments_role;
-- Option 3: Give read access to all future tables in the schema
GRANT SELECT ON FUTURE TABLES IN SCHEMA <database>.<schema> TO ROLE datadog_experiments_role;
Grant the role access to the output schema
Datadog writes experiment exposure logs and intermediate metric results to tables in a dedicated output schema. Run the following commands to create the schema and grant the role full access. Replace <database> with the appropriate value.
CREATE SCHEMA IF NOT EXISTS <database>.datadog_experiments_output;
GRANT ALL ON SCHEMA <database>.datadog_experiments_output TO ROLE datadog_experiments_role;
GRANT ALL PRIVILEGES ON FUTURE TABLES IN SCHEMA <database>.datadog_experiments_output TO ROLE datadog_experiments_role;
Create a dedicated warehouse for Datadog Experiments (optional)
The role you created must have access to at least one warehouse to compute results. You must enter the warehouse name when configuring experiment settings in Step 3.
Creating a dedicated warehouse for Datadog Experiments is optional. Run the following commands to create one. Replace <wh_size> with the appropriate value.
CREATE WAREHOUSE IF NOT EXISTS datadog_experiments_wh
WAREHOUSE_SIZE = <wh_size>
AUTO_SUSPEND = 300
INITIALLY_SUSPENDED = true;
GRANT ALL PRIVILEGES ON WAREHOUSE datadog_experiments_wh TO ROLE datadog_experiments_role;
Step 2: Connect Snowflake to Datadog
To connect your Snowflake account to Datadog for warehouse-native experiment analysis:
- Navigate to Datadog's integrations page and search for Snowflake.
- Click the Snowflake tile to open its modal.
- Select the Configure tab and click Add Snowflake Account.
- Add your Account URL. To find your account URL, see the Snowflake guide.
- Toggle off all resources (these are not needed for experiment analysis).
- Enter the Snowflake User Name you created in Step 1 (for example,
datadog_experiments_user). - Scroll to the Configure a key pair authentication section and upload your unencrypted private key.
- Click Save.
The grants in the Recommended Warehouse Settings section of the Snowflake integration tile are not needed for warehouse-native experiment analysis. The privileges granted in Step 1 are sufficient.
If you plan to use other warehouse observability functionality in Datadog, see Datadog's Snowflake integration documentation to determine which resources to enable.
Step 3: Configure experiment settings
Datadog supports one warehouse connection per organization. Connecting BigQuery replaces any existing warehouse connection (for example, Snowflake).
After you set up your Google Cloud resources and IAM roles, configure the experiment settings in Datadog:
- Open Datadog Product Analytics.
- In the left navigation, hover over Settings and click Experiments.
- Select the Warehouse Connections tab.
- Click Connect a data warehouse. If you already have a warehouse connected, click Edit instead.
- Select the BigQuery tile.
- Under Select BigQuery Account, enter:
- GCP service account: The service account you are using for Datadog Experiments.
- Project: Your Google Cloud project.
- Under Dataset and GCS Bucket, enter:
- Click Save.
After you save your warehouse connection, create experiment metrics using your BigQuery data.
Datadog supports one warehouse connection per organization. Connecting Databricks replaces any existing warehouse connection (for example, Snowflake).
After you set up your Databricks integration and workspace, configure the experiment settings in Datadog:
- Open Datadog Product Analytics.
- In the left navigation, hover over Settings and click Experiments.
- Select the Warehouse Connections tab.
- Click Connect a data warehouse. If you already have a warehouse connected, click Edit instead.
- Select the Databricks tile.
- Using the Account dropdown, select the Databricks Workspace you configured in Step 2.
- Enter the Catalog, Schema, and Volume name you configured in Step 1. If your catalog and schema do not appear in the dropdown, enter them manually to add them to the list.
- Click Save.
After you save your warehouse connection, create experiment metrics using your Databricks data.
Datadog supports one warehouse connection per organization. Connecting Redshift replaces any existing warehouse connection (for example, Snowflake).
Configuring experiment settings requires the Product Analytics Settings Write permission. If your organization uses custom roles, verify that your role includes this permission.
After you set up your AWS integration and Redshift cluster, configure the experiment settings in Datadog:
- Open Datadog Product Analytics.
- In the left navigation, hover over Settings and click Experiments.
- Select the Warehouse Connections tab.
- Click Connect a data warehouse. If you already have a warehouse connected, click Edit instead.
- Select the Redshift tile.
- Select your AWS account from the dropdown.
- Under Cluster Connection, enter:
- AWS region: The region your Redshift cluster is in (for example,
us-east-1). - Cluster identifier: The name of your Redshift cluster.
- Cluster endpoint: The full endpoint URL for your cluster.
- Port: The port your cluster is listening on (default:
5439).
- AWS region: The region your Redshift cluster is in (for example,
- Under Database and Storage, enter:
- Database: The name of the database containing your source tables.
- Database user: The service user you created in Step 1 (for example,
datadog_experiments_user). - Schema: The schema you created in Step 1 for Datadog Experiments to write to (for example,
datadog_experiments_output). - Temp S3 bucket: The S3 bucket you created in Step 2 (for example,
datadog-experimentation-[aws_account_id]).
- Click Save.
After you save your warehouse connection, create experiment metrics using your Redshift data.
Datadog supports one warehouse connection per organization. Connecting Snowflake replaces any existing warehouse connection (for example, Redshift).
After you set up your Snowflake integration, configure the experiment settings in Datadog Product Analytics:
- In the left navigation, hover over Settings, then click Experiments.
- Select the Warehouse Connections tab.
- Click Connect a data warehouse. If you already have a warehouse connected, click Edit instead.
- Select the Snowflake tile.
- Enter the Account, Role, Warehouse, Database, and Schema you configured in Step 1. If your database and schema do not appear in the dropdown, enter them manually to add them to the list.
- Click Save.
After you save your warehouse connection, create experiment metrics using your Snowflake data.
Further reading
Additional helpful documentation, links, and articles:

















