Skip to main content

Snowflake

Visualize Snowflake cloud resources, map Snowflake users to employees, and monitor changes through queries and alerts.

Installation​

info

This integration reads from your Snowflake account using SHOW commands run under the connecting user's current role. Each SHOW command only returns objects the current role has at least one access privilege on, unless the role holds the MANAGE GRANTS privilege. By default, only the ACCOUNTADMIN and SECURITYADMIN roles hold MANAGE GRANTS, which lets them see every object in the account. To ingest a complete inventory, connect with a role that holds MANAGE GRANTS (or the equivalent broad grants).

Prerequisites​

Before you begin, make sure you have:

  • A Snowflake user that the integration can connect as, with its account name (for example, xy12345.us-east-2.aws).
  • A role for that user that can run SHOW commands across the objects you want to ingest. SHOW USERS only fills in user details (beyond the name) for a role that owns the user or holds MANAGE GRANTS, so use the ACCOUNTADMIN or SECURITYADMIN role, or a role that has been granted MANAGE GRANTS, for a complete inventory.
  • For the optional Organization and Accounts ingestion sources (disabled by default), the Accounts source runs SHOW ACCOUNTS, which only an organization administrator (the ORGADMIN role, in an ORGADMIN-enabled account) can run. Leave the Accounts source disabled if the integration's role is not an organization administrator.

Choose an authentication method​

This integration supports two authentication methods:

  • Key Pair Authentication (recommended)
  • Basic Authentication

Key pair authentication is recommended because it does not store a password in the integration configuration.

Create a key pair (Key Pair Authentication)​

  1. Generate at least a 2048-bit RSA key pair in PEM format, following the Snowflake key-pair authentication guide. Encrypted private keys are supported; if you encrypt the key, note its passphrase.
  2. Assign the public key to the Snowflake user the integration will connect as.
  3. Set that user's DEFAULT_ROLE to the role described in the prerequisites. Key pair authentication has no Role field, so the integration runs under the user's default role.
  4. Keep the private key file available for the integration configuration in JupiterOne.

Configuration in JupiterOne​

To configure the Snowflake integration in JupiterOne:

  1. Navigate to the Integrations tab and select Snowflake.
  2. Click New Instance to begin the setup.
  3. Choose either Key Pair Authentication - Recommended or Basic Authentication.

Every integration instance also requires the following:

  • The Account Name used to identify the Snowflake account in JupiterOne. Ingested entities have this value stored in tag.AccountName when the AccountName toggle is enabled.
  • A Description to assist in identifying the integration instance, if desired.
  • A Polling Interval that fits your monitoring needs. You may leave this as DISABLED and manually execute the integration.

Creating an instance requires:

  • Snowflake Account Name: The full name of your account (for example, xy12345.us-east-2.aws).
  • Username: The Snowflake user login name to connect with.
  • Private Key: The Snowflake user's private key file. Encrypted and unencrypted keys are both supported.
  • Private Key Passphrase: The passphrase used to encrypt the private key file. Leave this empty when the private key is unencrypted.

Basic Authentication​

Creating an instance requires:

  • Snowflake Account Name: The full name of your account (for example, xy12345.us-east-2.aws).
  • Username: The Snowflake user login name to connect with.
  • Password: The password for the Snowflake user.
  • Role: The default security role to use for the session after connecting.

Once all the values are provided, click Create to complete the integration setup.

Next Steps​

With your integration instance configured, it will start running based on the polling interval you selected, ingesting data into JupiterOne. For further details on managing your integration instance, refer to our Instance Management Guide.