# Snowflake

![Snowflake_logo.svg](https://assets.relyanceuat.xyz/images/docs/6707751612941/6708027410061.svg)
Snowflake offers a cloud-based data storage and analytics service, generally termed "data warehouse-as-a-service" (DWaaS). It enables enterprises to automate data management, security, governance, availability, and data resiliency.

Relyance AI provides three (3) main options to integrate with a tenant’s Snowflake account.

1. [The first option uses **Username**, **Password**, **Account Name**, and **Role** for authentication.](#h_01G1S16SMFR0A5GF5NX47DKXTG)
2. [The second option uses **Username**, **Key Pair**, **Account Name**, and **Role** for authentication.](#01JBHPKQGH2Z7MK6GYCHRYR5Z7)
3. [The third option uses **Client ID**, **Client Secret**, **Account Name**, and **Role** for authentication.](#h_01G4X6T5HDP94YQ9ZVN7VXPEWS)

WARNING: The customer will incur a cost for the Snowflake processing job. Use a smaller sized warehouse to reduce costs. For more info please see: [https://docs.snowflake.com/en/user-guide/cost-understanding-compute](https://docs.snowflake.com/en/user-guide/cost-understanding-compute)

### Which method to choose

The connection drop-down offers five, not the three below — the two "with Data
Inspection" entries are the same credentials as Options 1 and 3 with data
inspection enabled:

| Method | Credential | Notes |
| --- | --- | --- |
| **Key Pair** (recommended) | username + RSA private key, optional passphrase | rotatable, no shared password, no browser step |
| Username/Password | username + password | the password is shared, and expires under most Snowflake password policies |
| Oauth2 / App Token | client id + secret | uses a Snowflake OAuth integration and holds a refresh token |
| Username/Password with Data Inspection | as above | |
| Oauth2 / App Token with Data Inspection | as above | |

Every method also needs **Account Name**, **Role**, **Use Warehouse**, and the
**Skip view tables?** toggle, and accepts an optional **Config Options** allow/deny
list (`database.schema.table`, deny wins):

```json
{
  "allow_list": [],
  "deny_list": ["database_name.*"]
}
```

**Prefer Key Pair.** It is the only option with nothing that expires on a
schedule set by someone else: a Snowflake password policy expiring the password,
or an OAuth refresh token being invalidated, both stop the connection with no
change on the Relyance side.

The role must be named **relyance** — the OAuth methods request the
`session:role:RELYANCE` scope explicitly, so a differently named role will not be
assumed.

#### Common pitfalls

- **A Snowflake network policy that does not allow Relyance.** Snowflake enforces
  network policies before authentication, so this presents as a connection that
  cannot authenticate at all rather than as a permission error. Add the Relyance
  IP addresses to the policy.
- **The role has no warehouse usage.** Authentication succeeds, then every query
  fails: the role needs `USAGE` on the warehouse named in **Use Warehouse**.
- **Warehouse size drives cost.** The scan runs queries in your warehouse, so
  size it small — see the warning above.

#### Option 1 - Username, Password, Account Name, and Role for authentication.

---

In order to integrate Snowflake with Relyance AI you will need your Snowflake **Username**, **Password**, **Account Name**, and **Role** information.

#### In Snowflake:

1. Login to your Snowflake account (xxxx.snowflakecomputing.com).
2. Navigate to **Worksheets** in the top left hand corner.  The UI may show differently.
3. Enter in the following the commands (comments may be omitted):

**Create Role**
```sql
create role relyance;
```
The role MUST be named **relyance** for OAuth Custom Clients can have different names.
**Check Grants**
```sql
show grants to role relyance;
```
Verify that no grants currently exist.

**Grant warehouse access to relyance role**
```sql
grant usage on warehouse <<WAREHOUSE>> to role relyance;
```
Replace **`<<WAREHOUSE>>`** with the desired warehouse(s).

**Grant usage on databases to relyance role**
```sql
Grant usage on database <<DATABASE>> to role relyance;
```
Replace **`<<DATABASE>>`** with the desired database.
4. **Grant select on USERS to relyance role**
Used for the Asset Intelligence Module
```sql
GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE relyance;
```
5. **Grant the below for** **cortex-related data to show up** (**AI Governance**)
```sql
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE relyance;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE relyance;
```
6. **Add access to databases you would like to integrate**
For this step there are two (2) choices. The second choice is more restrictive, choose one or the other. Do NOT use both commands; use one or the other.
**Choice 1:**
```sql
grant usage on all schemas in database <<DATABASE>> to role relyance;
grant usage on future schemas in database <<DATABASE>> to role relyance;
grant references on all tables in database <<DATABASE>> to role relyance;
grant references on future tables in database <<DATABASE>> to role relyance;

-- allow the role access to all tables in a database (and that will be created in future...)
grant select on future tables in database <<DATABASE>> to role relyance;
grant select on all tables in database <<DATABASE>> to role relyance;

-- allow the role access to all views in a database (and that will be created in future...)
grant select on future views in database <<DATABASE>> to role relyance;
grant select on all views in database <<DATABASE>> to role relyance;

-- assign the role relyance to user
grant role relyance to user <USERNAME>

-- to verify if the role is assigned
show grants to user <USERNAME>
```
Replace **`<<DATABASE>>`** with your DB name(s).
Replace **`<<USERNAME>>`** with your username.

**Choice 2:**
```sql
grant references on all tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;
grant references on future tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;
```
Replace **`<<DATABASE>>`** and **`<<SCHEMA>>`** with the desired database(s), schema(s).

**Verify that the grants are correctly set**
```sql
show grants to role relyance; 
```
An explanation of the needed permissions has been added to the [Appendix](#h_01G4XB6QGPKYBGB56V11TE7TXA) for your consideration.

**Create Service Account**
```sql
use role accountadmin;

CREATE USER RelyanceAI
    PASSWORD = "pw" -- Change me
    LOGIN_NAME = "relyanceai"
    DEFAULT_ROLE = relyance;
```
The service account username is **RelyanceAI** in this example. Make sure you change the password.The LOGIN_NAME is what you sign in with and what you'll use in your Relyance settings.
**Grant the new role to your service account**
```sql
grant role relyance to user <<USER_NAME>>;
```
Replace **`<<USER_NAME>>`** with your service account name.
7. The **Username** will correspond with your service account username (LOGIN_NAME) in Snowflake.
8. The **Password** will correspond with the service account password.
9. The **Account Name** will contain the subdomain portion of the URL. Namely the portion preceding “.snowflakecomputing.com”.  For e.g. if your URL looks like: xxxxxxx.us-central1.gcp.snowflakecomputing.com, you would enter: xxxxxxx.us-central1.gcp If the URL looks different (eg. [https://app.snowflake.com](https://app.snowflake.com) /...), you can also retrieve your full url using these steps:
    1. Navigate to the bottom left-hand corner of your Snowflake dashboard.
    2. Click on your organization name at the bottom. This will pull up your organization info.
    3. Hover over the account info section and a small dialog will open to the right. Use the copy link icon to retrieve your account url.
10. The **Role** value will be **relyance** (the role that was set up and granted permissions previously).

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Click on the **Vendor and Data Stores** filter.
5. Find the **Snowflake** integration card and click it to open its connections.
6. On the **Authentication** step, pick the method under **Authentication Method**.
7. Choose either **Username/Password** or **Username/Password with Data Inspection** from the drop-down menu. By default, Relyance scans metadata in order to identify PII properties in an integration. When Data Inspection is enabled, Relyance will also sample the underlying data in its analysis.
8. Paste the **Username**, **Password**, **Account Name**, **Role**, and **Warehouse** into their respective fields.  If the **Warehouse** is not specified, Relyance will pick the first Warehouse found. If Data Inspection was selected you'll have a few more options to include.  **Sampling Percent**: Enter the percentage of records using the table's row count (1000 records max) to return from a table. **Duration of QC samples**: The number of days to retain data samples for the purposes of QC. **Min Likelihood**: This sets the analysis sensitivity. Lower likelihoods (unlikely) will generate more false positives while higher sensitivity may miss some data types (likely). **Table AllowList Comma Seperated List**: Only scan the tables listed in this list. Leave blank to scan all.
9. Click **Connect.**
10. At this point, you should see the following result on the Vendor Integrations page:
11. Congratulations, you are now connected to **Snowflake**.

#### Option 2 - Username, Key Pair, Account Name, and Role for authentication.

---

In order to integrate Snowflake with Relyance AI you will need your Snowflake **Username**, **Key Pair (Private/Public Keys)**, **Account Name**, and **Role** information.

#### In Local Machine:

##### **Step 1: Generate Private/Public Key Pair**

On your **local machine** (Linux/Mac) with the latest version of OpenSSL installed, follow these steps:

1. **Generate a Private Key:** To create a private key **without encryption** (no password required for later use), run:
```bash
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt
```
If you prefer to **encrypt** your private key (recommended for enhanced security), omit the `-nocrypt` parameter:
```bash
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8
```
If you encrypt the private key, remember to provide the password in the **Private Key Password** section of the Relyance UI during the configuration process.
2. **Secure the Private Key:**
Save the generated `rsa_key.p8` in a secure location. You’ll need to provide its contents later in the **Relyance configuration**.

---

##### **Step 2: Generate a Public Key**

Use the private key you just generated to create a corresponding public key:

```bash
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
```

---

##### **Step 3: Prepare the Public Key for Snowflake**

1. Open the `rsa_key.pub` file using a text editor.
2. Remove the following lines:
```
-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----
```
3. Convert the remaining key data into a single line (remove all line breaks).

This is the **Public Key** you’ll apply to your **Snowflake user** in the next section.

---

##### **Step 4: Apply Public Key to Snowflake User**

In the Snowflake web interface or via SQL:

```sql
ALTER USER <your_snowflake_username> SET RSA_PUBLIC_KEY='<your_single_line_public_key>';
```

Replace `<your_snowflake_username>` with your actual Snowflake username, and `<your_single_line_public_key>` with the public key you prepared in the previous step.

---

##### **Step 5: Configure Relyance AI**

In the **Relyance AI UI**, provide the following details:

- **Username:** Your Snowflake username
- **Private Key:** Contents of the `rsa_key.p8` file
- **Private Key Password:** (If applicable, enter the password used when generating the private key)
- **Account Name:** Your Snowflake account name (usually in the format `account.region.cloudprovider` )
- **Role:** The Snowflake role with sufficient privileges for the integration

#### In Snowflake:

1. Login to your Snowflake account (xxxx.snowflakecomputing.com).
2. Navigate to **Worksheets** in the top left hand corner.  The UI may show differently.
3. Enter in the following the commands (comments may be omitted):

**Create Role**
```sql
create role relyance;
```
The role MUST be named **relyance** for OAuth Custom Clients can have different names.
**Check Grants**
```sql
show grants to role relyance;
```
Verify that no grants currently exist.

**Grant warehouse access to relyance role**
```sql
grant usage on warehouse <<WAREHOUSE>> to role relyance;
```
Replace **`<<WAREHOUSE>>`** with the desired warehouse(s).

**Grant usage on databases to relyance role**
```sql
Grant usage on database <<DATABASE>> to role relyance;
```
Replace **`<<DATABASE>>`** with the desired database.
4. **Grant select on USERS to relyance role**
Used for the Asset Intelligence Module
```sql
GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE relyance;
```
5. **Grant the below for** **cortex-related data to show up** ( **AI Governance** )
```sql
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE relyance;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE relyance;
```
7. **Add access to databases you would like to integrate**
For this step there are two (2) choices. The second choice is more restrictive, choose one or the other. Do NOT use both commands; use one or the other.
**Choice 1:**
```sql
grant usage on all schemas in database <<DATABASE>> to role relyance;
grant usage on future schemas in database <<DATABASE>> to role relyance;
grant references on all tables in database <<DATABASE>> to role relyance;
grant references on future tables in database <<DATABASE>> to role relyance;

-- allow the role access to all tables in a database (and that will be created in future...)
grant select on future tables in database <<DATABASE>> to role relyance;
grant select on all tables in database <<DATABASE>> to role relyance;

-- allow the role access to all views in a database (and that will be created in future...)
grant select on future views in database <<DATABASE>> to role relyance;
grant select on all views in database <<DATABASE>> to role relyance;
```
Replace **`<<DATABASE>>`** with your DB name(s).

**Choice 2:**
```sql
grant references on all tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;
grant references on future tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;
```
Replace **`<<DATABASE>>`** and **`<<SCHEMA>>`** with the desired database(s), schema(s).

**Verify that the grants are correctly set**
```sql
show grants to role relyance; 
```
An explanation of the needed permissions has been added to the [Appendix](#h_01G4XB6QGPKYBGB56V11TE7TXA) for your consideration.

**Create Service Account**
```sql
use role accountadmin;

CREATE USER RelyanceAI
    LOGIN_NAME = "relyanceai"
    DEFAULT_ROLE = relyance;
```
The service account username is **RelyanceAI** in this example. Make sure you change the password.The LOGIN_NAME is what you sign in with and what you'll use in your Relyance settings.
**Grant the new role to your service account**
```sql
grant role relyance to user <<USER_NAME>>;
```
Replace **`<<USER_NAME>>`** with your service account name.
8. The **Username** will correspond with your service account username (LOGIN_NAME) in Snowflake.
9. Assign the public key to the above Snowflake user
```sql
ALTER USER <<USER_NAME>> SET RSA_PUBLIC_KEY='<<PUBLIC_KEY>>';
```
Replace **`<<USER_NAME>>`** with the username from the step 5 in this section and **`<<PUBLIC_KEY>>`** with the **Public Key** from step 2 in the previous section.
10. public certificate from the previous section.
11. The **Account Name** will contain the subdomain portion of the URL. Namely the portion preceding “.snowflakecomputing.com”.  For e.g. if your URL looks like: xxxxxxx.us-central1.gcp.snowflakecomputing.com, you would enter: xxxxxxx.us-central1.gcp If the URL looks different (eg. [https://app.snowflake.com](https://app.snowflake.com) /...), you can also retrieve your full url using these steps:
    1. Navigate to the bottom left-hand corner of your Snowflake dashboard.
    2. Click on your organization name at the bottom. This will pull up your organization info.
    3. Hover over the account info section and a small dialog will open to the right. Use the copy link icon to retrieve your account url.
12. The **Role** value will be **relyance** (the role that was set up and granted permissions previously).

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Click on the **Vendor and Data Stores** filter.
5. Find the **Snowflake** integration card and click it to open its connections.
6. Under **Authentication Method**, choose **Key Pair**. By default, Relyance scans metadata in order to identify PII properties in an integration. When Data Inspection is enabled, Relyance will also sample the underlying data in its analysis.
8. Paste the **Username**, **Private Key**, **Account Name**, **Role**, and **Warehouse** into their respective fields.  If the **Warehouse** is not specified, Relyance will pick the first Warehouse found. If Data Inspection was selected you'll have a few more options to include.  **Sampling Percent**: Enter the percentage of records using the table's row count (1000 records max) to return from a table. **Duration of QC samples**: The number of days to retain data samples for the purposes of QC. **Min Likelihood**: This sets the analysis sensitivity. Lower likelihoods (unlikely) will generate more false positives while higher sensitivity may miss some data types (likely). **Table AllowList Comma Seperated List**: Only scan the tables listed in this list. Leave blank to scan all.
9. Click **Connect.**
10. At this point, you should see the following result on the Vendor Integrations page:
11. Congratulations, you are now connected to **Snowflake**.

#### Option 3 - Client ID, Client Secret, and Account Name for authentication.

---

In order to integrate Snowflake with Relyance AI you will need your Snowflake service account to create an Oauth2 connection using the **Client ID**, **Client Secret**, and **Account Name** information.

This Oauth2 integration requires a service account that is assigned the role (**relyance**). That role is then provided permission to use the newly created **relyance_oauth** integration; which is then used to sign into Snowflake to complete the Oauth2 flow.

#### In Snowflake:

1. Login to your Snowflake account (xxxx.snowflakecomputing.com).
2. Navigate to **Worksheets** in the top left hand corner.  The UI may show differently.
3. Enter in the following the commands (comments may be omitted):

![Snowflake-5.png](https://assets.relyanceuat.xyz/images/docs/6707751612941/6712643134093.png)

**Create Role**
```sql
create role relyance;
```
The role MUST be named **relyance** for OAuth Custom Client can have different names.
**Check Grants**
```sql
show grants to role relyance;
```
Verify that no grants currently exist.

**Grant warehouse access to relyance role**
```sql
grant usage on warehouse <<WAREHOUSE>> to role relyance;
```
Replace **`<<WAREHOUSE>>`** with the desired warehouse(s).

**Grant usage on databases to relyance role**
```sql
Grant usage on database <<DATABASE>> to role relyance;
```
Replace **`<<DATABASE>>`** with the desired database.

**Add access to databases you would like to integrate**
For this step there are two (2) choices. The second choice is more restrictive, choose one or the other.
Do NOT use both commands; use one or the other.
**Choice 1:**
```sql
grant usage on all schemas in database <<DATABASE>> to role relyance;
grant usage on future schemas in database <<DATABASE>> to role relyance;
grant references on all tables in database <<DATABASE>> to role relyance;
grant references on future tables in database <<DATABASE>> to role relyance;

-- allow the role access to all tables in a database (and that will be created in future...)
grant select on future tables in database <<DATABASE>> to role relyance;
grant select on all tables in database <<DATABASE>> to role relyance;

-- allow the role access to all views in a database (and that will be created in future...)
grant select on future views in database <<DATABASE>> to role relyance;
grant select on all views in database <<DATABASE>> to role relyance;
```
Replace **`<<DATABASE>>`** with your DB name(s).

**Choice 2:**
```sql
grant references on all tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;
grant references on future tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;
```
Replace **`<<DATABASE>>`** and **`<<SCHEMA>>`** with the desired database(s), schema(s).

**Verify that the grants are correctly set**
```sql
show grants to role relyance; 
```
An explanation of the needed permissions has been added to the [Appendix](#h_01G4XB6QGPKYBGB56V11TE7TXA) for your consideration.

**Create Integration**
```sql
CREATE SECURITY INTEGRATION
  relyance_oauth
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://root.relyance.ai/api/oauth2'
  ENABLED = TRUE
  PRE_AUTHORIZED_ROLES_LIST = ('RELYANCE')
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;
```
The OAUTH_REFRESH_TOKEN_VALIDITY is set to the maximum value of 90 days. Please contact your Snowflake support center in order to extend this token to a year.
**Verify Integration**
```sql
desc security integration relyance_oauth;
```
**Display Client ID and Secret**
```sql
select system$show_oauth_client_secrets('RELYANCE_OAUTH');
```
Copy the **Client ID** and **Client Secret** to be used in Relyance AI.
You may select either of the client secrets listed.
4. **Grant select on USERS to relyance role**
Used for the Asset Intelligence Module
```sql
GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE relyance;
```
5. **Grant the below for** **cortex-related data to show up** ( **AI Governance** )
```sql
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE relyance;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE relyance;
```
7. The **Account Name** will contain the subdomain portion of the URL. Namely the portion preceding “.snowflakecomputing.com”.  For e.g. if your URL looks like: xxxxxxx.us-central1.gcp.snowflakecomputing.com, you would enter: xxxxxxx.us-central1.gcp If the URL looks different (eg. [https://app.snowflake.com](https://app.snowflake.com) /...), you can also retrieve your full url using these steps:
    1. Navigate to the bottom left-hand corner of your Snowflake dashboard.
    2. Click on your organization name at the bottom. This will pull up your organization info.
    3. Hover over the account info section and a small dialog will open to the right. Use the copy link icon to retrieve your account url.

    ![Snowflake-6.png](https://assets.relyanceuat.xyz/images/docs/6707751612941/6712876897037.png)

    ![Snowflake-7.png](https://assets.relyanceuat.xyz/images/docs/6707751612941/22957107377421.png)

#### In the Relyance AI application:

1. Login to your Relyance account.
2. Navigate to the **Settings** Menu in the bottom left-hand side.
3. Select **Integrations**.
4. Click on the Vendor **Integration** tab.
5. Find the **Snowflake** integration card and click it to open its connections.
6. On the **Authentication** step, pick the method under **Authentication Method**.
7. Choose either **Oauth2 / App Token** or **Oauth2 / App Token with Data Inspection** from the drop-down menu. By default, Relyance scans metadata in order to identify PII properties in an integration. When Data Inspection is enabled, Relyance will also sample the underlying data in its analysis.
8. Paste the **Client ID**, **Client Secret**, **Account Name**, **Role**, and **Warehouse** into their respective fields.  If the **Warehouse** is not specified, Relyance will pick the first Warehouse found. If Data Inspection was selected you'll have a few more options to include.  **Sampling Percent**: Enter the percentage of records using the table's row count (1000 records max) to return from a table. **Duration of QC samples**: The number of days to retain data samples for the purposes of QC. **Min Likelihood**: This sets the analysis sensitivity. Lower likelihoods (unlikely) will generate more false positives while higher sensitivity may miss some data types (likely). **Table AllowList Comma Seperated List**: Only scan the tables listed in this list. Leave blank to scan all.
9. Click **Connect.**
10. This will bring you to Snowflake's page. Sign in using the newly created service account info (**LOGIN_NAME** and **PASSWORD**). Follow the flow and allow Relyance AI permission to connect to Snowflake.
11. At this point, you should see the following result on the Vendor Integrations page:
12. Congratulations, you are now connected to **Snowflake**.

![Snowflake-1a.png](https://assets.relyanceuat.xyz/images/docs/6707751612941/21550443106189.png)

![snowflake_key_pair.png](https://assets.relyanceuat.xyz/images/docs/6707751612941/31513238160269.png)

![Snowflake-2a.png](https://assets.relyanceuat.xyz/images/docs/6707751612941/21555348361101.png)

![Snowflake-8.png](https://assets.relyanceuat.xyz/images/docs/6707751612941/23324978173197.png)

![Snowflake-4.png](https://assets.relyanceuat.xyz/images/docs/6707751612941/6712688409357.png)

![Snowflake-3.png](https://assets.relyanceuat.xyz/images/docs/6707751612941/6708437742861.png)

#### Appendix:

Required Permissions

1. Usage (Warehouse, Database, Schema) Usage simply allows for the object to be used by the role. This allows the role to read data from the specified objects (read-only). This grant provides the ability to execute a [USE `<object>`](https://docs.snowflake.com/en/sql-reference/sql/use.html) command on the object; it also grants the ability to execute a [SHOW `<objects>`](https://docs.snowflake.com/en/sql-reference/sql/show.html) command on the objects within a database or schema; however, a contained object is only listed in the output if the executing role also has at least one privilege on the object.
2. References(table) Grants ability to view the structure of an object (but not the data). This is how we view the column names without viewing the data within the tables.
3. Select (table, view) Grants the ability to execute a [SELECT](https://docs.snowflake.com/en/sql-reference/sql/select) statement on the table/view.

![The Authentication step showing all five Snowflake methods](https://assets.relyanceuat.xyz/images/docs/ui/snowflake/07-wizard-authentication.png)

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

### Username & password

```hcl
resource "relyance_integration_connection" "snowflake_0" {
  vendor = "snowflake"
  name   = "<your connection name>"

  auth = {
    method = "username-password"
    params = {
      user = "<user>"
      account = "<account>"
      role = "<role>"
      use_warehouse = "<use_warehouse>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      skip_views = "false"
      password = var.snowflake_password
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

### OAuth (browser authorization)

The **OAuth (browser authorization)** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example snowflake/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### Username & password — Username/Password with Data Inspection

```hcl
resource "relyance_integration_connection" "snowflake_2" {
  vendor = "snowflake"
  name   = "<your connection name>"

  auth = {
    method = "username-password-with-data-inspection"
    params = {
      user = "<user>"
      account = "<account>"
      role = "<role>"
      use_warehouse = "<use_warehouse>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      skip_views = "false"
      password = var.snowflake_password
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

### OAuth (browser authorization) — Oauth2 / App Token with Data Inspection

The **OAuth (browser authorization) — Oauth2 / App Token with Data Inspection** method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (`terraform import relyance_integration_connection.example snowflake/<connection_id>`) or reading it with the `relyance_integration_connection` data source.

### Key-pair authentication

```hcl
resource "relyance_integration_connection" "snowflake_4" {
  vendor = "snowflake"
  name   = "<your connection name>"

  auth = {
    method = "key-pair"
    params = {
      account = "<account>"
      role = "<role>"
      use_warehouse = "<use_warehouse>"
      user = "<user>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      skip_views = "false"
      private_key = var.snowflake_private_key
      password = var.snowflake_password
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->