/ Docs
Vendor Integrations

Snowflake

Last updated February 18, 2026 · View as Markdown

Snowflake_logo.svg Snowflake offers a cloud-based data storage and analytics service, generally termed "data warehouse-as-a-service" (DWaaS). It enables enterprises to automate data management, security, governance, availability, and data resiliency.

Relyance AI provides three (3) main options to integrate with a tenant’s Snowflake account.

  1. The first option uses Username, Password, Account Name, and Role for authentication.
  2. The second option uses Username, Key Pair, Account Name, and Role for authentication.
  3. The third option uses Client ID, Client Secret, Account Name, and Role for authentication.

WARNING: The customer will incur a cost for the Snowflake processing job. Use a smaller sized warehouse to reduce costs. For more info please see: https://docs.snowflake.com/en/user-guide/cost-understanding-compute

Which method to choose

The connection drop-down offers five, not the three below — the two "with Data Inspection" entries are the same credentials as Options 1 and 3 with data inspection enabled:

Method Credential Notes
Key Pair (recommended) username + RSA private key, optional passphrase rotatable, no shared password, no browser step
Username/Password username + password the password is shared, and expires under most Snowflake password policies
Oauth2 / App Token client id + secret uses a Snowflake OAuth integration and holds a refresh token
Username/Password with Data Inspection as above
Oauth2 / App Token with Data Inspection as above

Every method also needs Account Name, Role, Use Warehouse, and the Skip view tables? toggle, and accepts an optional Config Options allow/deny list (database.schema.table, deny wins):

{
  "allow_list": [],
  "deny_list": ["database_name.*"]
}

Prefer Key Pair. It is the only option with nothing that expires on a schedule set by someone else: a Snowflake password policy expiring the password, or an OAuth refresh token being invalidated, both stop the connection with no change on the Relyance side.

The role must be named relyance — the OAuth methods request the session:role:RELYANCE scope explicitly, so a differently named role will not be assumed.

Common pitfalls

  • A Snowflake network policy that does not allow Relyance. Snowflake enforces network policies before authentication, so this presents as a connection that cannot authenticate at all rather than as a permission error. Add the Relyance IP addresses to the policy.
  • The role has no warehouse usage. Authentication succeeds, then every query fails: the role needs USAGE on the warehouse named in Use Warehouse.
  • Warehouse size drives cost. The scan runs queries in your warehouse, so size it small — see the warning above.

Option 1 - Username, Password, Account Name, and Role for authentication.

In order to integrate Snowflake with Relyance AI you will need your Snowflake Username, Password, Account Name, and Role information.

In Snowflake:

  1. Login to your Snowflake account (xxxx.snowflakecomputing.com).
  2. Navigate to Worksheets in the top left hand corner. The UI may show differently.
  3. Enter in the following the commands (comments may be omitted):

Create Role

create role relyance;

The role MUST be named relyance for OAuth Custom Clients can have different names. Check Grants

show grants to role relyance;

Verify that no grants currently exist.

Grant warehouse access to relyance role

grant usage on warehouse <<WAREHOUSE>> to role relyance;

Replace <<WAREHOUSE>> with the desired warehouse(s).

Grant usage on databases to relyance role

Grant usage on database <<DATABASE>> to role relyance;

Replace <<DATABASE>> with the desired database. 4. Grant select on USERS to relyance role Used for the Asset Intelligence Module

GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE relyance;
  1. Grant the below for cortex-related data to show up (AI Governance)
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE relyance;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE relyance;
  1. Add access to databases you would like to integrate For this step there are two (2) choices. The second choice is more restrictive, choose one or the other. Do NOT use both commands; use one or the other. Choice 1:
grant usage on all schemas in database <<DATABASE>> to role relyance;
grant usage on future schemas in database <<DATABASE>> to role relyance;
grant references on all tables in database <<DATABASE>> to role relyance;
grant references on future tables in database <<DATABASE>> to role relyance;

-- allow the role access to all tables in a database (and that will be created in future...)
grant select on future tables in database <<DATABASE>> to role relyance;
grant select on all tables in database <<DATABASE>> to role relyance;

-- allow the role access to all views in a database (and that will be created in future...)
grant select on future views in database <<DATABASE>> to role relyance;
grant select on all views in database <<DATABASE>> to role relyance;

-- assign the role relyance to user
grant role relyance to user <USERNAME>

-- to verify if the role is assigned
show grants to user <USERNAME>

Replace <<DATABASE>> with your DB name(s). Replace <<USERNAME>> with your username.

Choice 2:

grant references on all tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;
grant references on future tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;

Replace <<DATABASE>> and <<SCHEMA>> with the desired database(s), schema(s).

Verify that the grants are correctly set

show grants to role relyance; 

An explanation of the needed permissions has been added to the Appendix for your consideration.

Create Service Account

use role accountadmin;

CREATE USER RelyanceAI
    PASSWORD = "pw" -- Change me
    LOGIN_NAME = "relyanceai"
    DEFAULT_ROLE = relyance;

The service account username is RelyanceAI in this example. Make sure you change the password.The LOGIN_NAME is what you sign in with and what you'll use in your Relyance settings. Grant the new role to your service account

grant role relyance to user <<USER_NAME>>;

Replace <<USER_NAME>> with your service account name. 7. The Username will correspond with your service account username (LOGIN_NAME) in Snowflake. 8. The Password will correspond with the service account password. 9. The Account Name will contain the subdomain portion of the URL. Namely the portion preceding “.snowflakecomputing.com”. For e.g. if your URL looks like: xxxxxxx.us-central1.gcp.snowflakecomputing.com, you would enter: xxxxxxx.us-central1.gcp If the URL looks different (eg. https://app.snowflake.com /...), you can also retrieve your full url using these steps: 1. Navigate to the bottom left-hand corner of your Snowflake dashboard. 2. Click on your organization name at the bottom. This will pull up your organization info. 3. Hover over the account info section and a small dialog will open to the right. Use the copy link icon to retrieve your account url. 10. The Role value will be relyance (the role that was set up and granted permissions previously).

In the Relyance AI application:

  1. Login to your Relyance account.
  2. Navigate to the Settings Menu in the bottom left-hand side.
  3. Select Integrations.
  4. Click on the Vendor and Data Stores filter.
  5. Find the Snowflake integration card and click it to open its connections.
  6. On the Authentication step, pick the method under Authentication Method.
  7. Choose either Username/Password or Username/Password with Data Inspection from the drop-down menu. By default, Relyance scans metadata in order to identify PII properties in an integration. When Data Inspection is enabled, Relyance will also sample the underlying data in its analysis.
  8. Paste the Username, Password, Account Name, Role, and Warehouse into their respective fields. If the Warehouse is not specified, Relyance will pick the first Warehouse found. If Data Inspection was selected you'll have a few more options to include. Sampling Percent: Enter the percentage of records using the table's row count (1000 records max) to return from a table. Duration of QC samples: The number of days to retain data samples for the purposes of QC. Min Likelihood: This sets the analysis sensitivity. Lower likelihoods (unlikely) will generate more false positives while higher sensitivity may miss some data types (likely). Table AllowList Comma Seperated List: Only scan the tables listed in this list. Leave blank to scan all.
  9. Click Connect.
  10. At this point, you should see the following result on the Vendor Integrations page:
  11. Congratulations, you are now connected to Snowflake.

Option 2 - Username, Key Pair, Account Name, and Role for authentication.

In order to integrate Snowflake with Relyance AI you will need your Snowflake Username, Key Pair (Private/Public Keys), Account Name, and Role information.

In Local Machine:

Step 1: Generate Private/Public Key Pair

On your local machine (Linux/Mac) with the latest version of OpenSSL installed, follow these steps:

  1. Generate a Private Key: To create a private key without encryption (no password required for later use), run:
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

If you prefer to encrypt your private key (recommended for enhanced security), omit the -nocrypt parameter:

openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8

If you encrypt the private key, remember to provide the password in the Private Key Password section of the Relyance UI during the configuration process. 2. Secure the Private Key: Save the generated rsa_key.p8 in a secure location. You’ll need to provide its contents later in the Relyance configuration.

Step 2: Generate a Public Key

Use the private key you just generated to create a corresponding public key:

openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub
Step 3: Prepare the Public Key for Snowflake
  1. Open the rsa_key.pub file using a text editor.
  2. Remove the following lines:
-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----
  1. Convert the remaining key data into a single line (remove all line breaks).

This is the Public Key you’ll apply to your Snowflake user in the next section.

Step 4: Apply Public Key to Snowflake User

In the Snowflake web interface or via SQL:

ALTER USER <your_snowflake_username> SET RSA_PUBLIC_KEY='<your_single_line_public_key>';

Replace <your_snowflake_username> with your actual Snowflake username, and <your_single_line_public_key> with the public key you prepared in the previous step.

Step 5: Configure Relyance AI

In the Relyance AI UI, provide the following details:

  • Username: Your Snowflake username
  • Private Key: Contents of the rsa_key.p8 file
  • Private Key Password: (If applicable, enter the password used when generating the private key)
  • Account Name: Your Snowflake account name (usually in the format account.region.cloudprovider )
  • Role: The Snowflake role with sufficient privileges for the integration

In Snowflake:

  1. Login to your Snowflake account (xxxx.snowflakecomputing.com).
  2. Navigate to Worksheets in the top left hand corner. The UI may show differently.
  3. Enter in the following the commands (comments may be omitted):

Create Role

create role relyance;

The role MUST be named relyance for OAuth Custom Clients can have different names. Check Grants

show grants to role relyance;

Verify that no grants currently exist.

Grant warehouse access to relyance role

grant usage on warehouse <<WAREHOUSE>> to role relyance;

Replace <<WAREHOUSE>> with the desired warehouse(s).

Grant usage on databases to relyance role

Grant usage on database <<DATABASE>> to role relyance;

Replace <<DATABASE>> with the desired database. 4. Grant select on USERS to relyance role Used for the Asset Intelligence Module

GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE relyance;
  1. Grant the below for cortex-related data to show up ( AI Governance )
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE relyance;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE relyance;
  1. Add access to databases you would like to integrate For this step there are two (2) choices. The second choice is more restrictive, choose one or the other. Do NOT use both commands; use one or the other. Choice 1:
grant usage on all schemas in database <<DATABASE>> to role relyance;
grant usage on future schemas in database <<DATABASE>> to role relyance;
grant references on all tables in database <<DATABASE>> to role relyance;
grant references on future tables in database <<DATABASE>> to role relyance;

-- allow the role access to all tables in a database (and that will be created in future...)
grant select on future tables in database <<DATABASE>> to role relyance;
grant select on all tables in database <<DATABASE>> to role relyance;

-- allow the role access to all views in a database (and that will be created in future...)
grant select on future views in database <<DATABASE>> to role relyance;
grant select on all views in database <<DATABASE>> to role relyance;

Replace <<DATABASE>> with your DB name(s).

Choice 2:

grant references on all tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;
grant references on future tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;

Replace <<DATABASE>> and <<SCHEMA>> with the desired database(s), schema(s).

Verify that the grants are correctly set

show grants to role relyance; 

An explanation of the needed permissions has been added to the Appendix for your consideration.

Create Service Account

use role accountadmin;

CREATE USER RelyanceAI
    LOGIN_NAME = "relyanceai"
    DEFAULT_ROLE = relyance;

The service account username is RelyanceAI in this example. Make sure you change the password.The LOGIN_NAME is what you sign in with and what you'll use in your Relyance settings. Grant the new role to your service account

grant role relyance to user <<USER_NAME>>;

Replace <<USER_NAME>> with your service account name. 8. The Username will correspond with your service account username (LOGIN_NAME) in Snowflake. 9. Assign the public key to the above Snowflake user

ALTER USER <<USER_NAME>> SET RSA_PUBLIC_KEY='<<PUBLIC_KEY>>';

Replace <<USER_NAME>> with the username from the step 5 in this section and <<PUBLIC_KEY>> with the Public Key from step 2 in the previous section. 10. public certificate from the previous section. 11. The Account Name will contain the subdomain portion of the URL. Namely the portion preceding “.snowflakecomputing.com”. For e.g. if your URL looks like: xxxxxxx.us-central1.gcp.snowflakecomputing.com, you would enter: xxxxxxx.us-central1.gcp If the URL looks different (eg. https://app.snowflake.com /...), you can also retrieve your full url using these steps: 1. Navigate to the bottom left-hand corner of your Snowflake dashboard. 2. Click on your organization name at the bottom. This will pull up your organization info. 3. Hover over the account info section and a small dialog will open to the right. Use the copy link icon to retrieve your account url. 12. The Role value will be relyance (the role that was set up and granted permissions previously).

In the Relyance AI application:

  1. Login to your Relyance account.
  2. Navigate to the Settings Menu in the bottom left-hand side.
  3. Select Integrations.
  4. Click on the Vendor and Data Stores filter.
  5. Find the Snowflake integration card and click it to open its connections.
  6. Under Authentication Method, choose Key Pair. By default, Relyance scans metadata in order to identify PII properties in an integration. When Data Inspection is enabled, Relyance will also sample the underlying data in its analysis.
  7. Paste the Username, Private Key, Account Name, Role, and Warehouse into their respective fields. If the Warehouse is not specified, Relyance will pick the first Warehouse found. If Data Inspection was selected you'll have a few more options to include. Sampling Percent: Enter the percentage of records using the table's row count (1000 records max) to return from a table. Duration of QC samples: The number of days to retain data samples for the purposes of QC. Min Likelihood: This sets the analysis sensitivity. Lower likelihoods (unlikely) will generate more false positives while higher sensitivity may miss some data types (likely). Table AllowList Comma Seperated List: Only scan the tables listed in this list. Leave blank to scan all.
  8. Click Connect.
  9. At this point, you should see the following result on the Vendor Integrations page:
  10. Congratulations, you are now connected to Snowflake.

Option 3 - Client ID, Client Secret, and Account Name for authentication.

In order to integrate Snowflake with Relyance AI you will need your Snowflake service account to create an Oauth2 connection using the Client ID, Client Secret, and Account Name information.

This Oauth2 integration requires a service account that is assigned the role (relyance). That role is then provided permission to use the newly created relyance_oauth integration; which is then used to sign into Snowflake to complete the Oauth2 flow.

In Snowflake:

  1. Login to your Snowflake account (xxxx.snowflakecomputing.com).
  2. Navigate to Worksheets in the top left hand corner. The UI may show differently.
  3. Enter in the following the commands (comments may be omitted):

Snowflake-5.png

Create Role

create role relyance;

The role MUST be named relyance for OAuth Custom Client can have different names. Check Grants

show grants to role relyance;

Verify that no grants currently exist.

Grant warehouse access to relyance role

grant usage on warehouse <<WAREHOUSE>> to role relyance;

Replace <<WAREHOUSE>> with the desired warehouse(s).

Grant usage on databases to relyance role

Grant usage on database <<DATABASE>> to role relyance;

Replace <<DATABASE>> with the desired database.

Add access to databases you would like to integrate For this step there are two (2) choices. The second choice is more restrictive, choose one or the other. Do NOT use both commands; use one or the other. Choice 1:

grant usage on all schemas in database <<DATABASE>> to role relyance;
grant usage on future schemas in database <<DATABASE>> to role relyance;
grant references on all tables in database <<DATABASE>> to role relyance;
grant references on future tables in database <<DATABASE>> to role relyance;

-- allow the role access to all tables in a database (and that will be created in future...)
grant select on future tables in database <<DATABASE>> to role relyance;
grant select on all tables in database <<DATABASE>> to role relyance;

-- allow the role access to all views in a database (and that will be created in future...)
grant select on future views in database <<DATABASE>> to role relyance;
grant select on all views in database <<DATABASE>> to role relyance;

Replace <<DATABASE>> with your DB name(s).

Choice 2:

grant references on all tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;
grant references on future tables in schema <<DATABASE>>."<<SCHEMA>>" to role relyance;

Replace <<DATABASE>> and <<SCHEMA>> with the desired database(s), schema(s).

Verify that the grants are correctly set

show grants to role relyance; 

An explanation of the needed permissions has been added to the Appendix for your consideration.

Create Integration

CREATE SECURITY INTEGRATION
  relyance_oauth
  TYPE = OAUTH
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = 'CONFIDENTIAL'
  OAUTH_REDIRECT_URI = 'https://root.relyance.ai/api/oauth2'
  ENABLED = TRUE
  PRE_AUTHORIZED_ROLES_LIST = ('RELYANCE')
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 7776000;

The OAUTH_REFRESH_TOKEN_VALIDITY is set to the maximum value of 90 days. Please contact your Snowflake support center in order to extend this token to a year. Verify Integration

desc security integration relyance_oauth;

Display Client ID and Secret

select system$show_oauth_client_secrets('RELYANCE_OAUTH');

Copy the Client ID and Client Secret to be used in Relyance AI. You may select either of the client secrets listed. 4. Grant select on USERS to relyance role Used for the Asset Intelligence Module

GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE relyance;
  1. Grant the below for cortex-related data to show up ( AI Governance )
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE relyance;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE relyance;

  1. The Account Name will contain the subdomain portion of the URL. Namely the portion preceding “.snowflakecomputing.com”. For e.g. if your URL looks like: xxxxxxx.us-central1.gcp.snowflakecomputing.com, you would enter: xxxxxxx.us-central1.gcp If the URL looks different (eg. https://app.snowflake.com /...), you can also retrieve your full url using these steps:

    1. Navigate to the bottom left-hand corner of your Snowflake dashboard.
    2. Click on your organization name at the bottom. This will pull up your organization info.
    3. Hover over the account info section and a small dialog will open to the right. Use the copy link icon to retrieve your account url.

    Snowflake-6.png

    Snowflake-7.png

In the Relyance AI application:

  1. Login to your Relyance account.
  2. Navigate to the Settings Menu in the bottom left-hand side.
  3. Select Integrations.
  4. Click on the Vendor Integration tab.
  5. Find the Snowflake integration card and click it to open its connections.
  6. On the Authentication step, pick the method under Authentication Method.
  7. Choose either Oauth2 / App Token or Oauth2 / App Token with Data Inspection from the drop-down menu. By default, Relyance scans metadata in order to identify PII properties in an integration. When Data Inspection is enabled, Relyance will also sample the underlying data in its analysis.
  8. Paste the Client ID, Client Secret, Account Name, Role, and Warehouse into their respective fields. If the Warehouse is not specified, Relyance will pick the first Warehouse found. If Data Inspection was selected you'll have a few more options to include. Sampling Percent: Enter the percentage of records using the table's row count (1000 records max) to return from a table. Duration of QC samples: The number of days to retain data samples for the purposes of QC. Min Likelihood: This sets the analysis sensitivity. Lower likelihoods (unlikely) will generate more false positives while higher sensitivity may miss some data types (likely). Table AllowList Comma Seperated List: Only scan the tables listed in this list. Leave blank to scan all.
  9. Click Connect.
  10. This will bring you to Snowflake's page. Sign in using the newly created service account info (LOGIN_NAME and PASSWORD). Follow the flow and allow Relyance AI permission to connect to Snowflake.
  11. At this point, you should see the following result on the Vendor Integrations page:
  12. Congratulations, you are now connected to Snowflake.

Snowflake-1a.png

snowflake_key_pair.png

Snowflake-2a.png

Snowflake-8.png

Snowflake-4.png

Snowflake-3.png

Appendix:

Required Permissions

  1. Usage (Warehouse, Database, Schema) Usage simply allows for the object to be used by the role. This allows the role to read data from the specified objects (read-only). This grant provides the ability to execute a USE <object> command on the object; it also grants the ability to execute a SHOW <objects> command on the objects within a database or schema; however, a contained object is only listed in the output if the executing role also has at least one privilege on the object.
  2. References(table) Grants ability to view the structure of an object (but not the data). This is how we view the column names without viewing the data within the tables.
  3. Select (table, view) Grants the ability to execute a SELECT statement on the table/view.

The Authentication step showing all five Snowflake methods

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

Username & password

resource "relyance_integration_connection" "snowflake_0" {
  vendor = "snowflake"
  name   = "<your connection name>"

  auth = {
    method = "username-password"
    params = {
      user = "<user>"
      account = "<account>"
      role = "<role>"
      use_warehouse = "<use_warehouse>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      skip_views = "false"
      password = var.snowflake_password
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}

OAuth (browser authorization)

The OAuth (browser authorization) method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (terraform import relyance_integration_connection.example snowflake/<connection_id>) or reading it with the relyance_integration_connection data source.

Username & password — Username/Password with Data Inspection

resource "relyance_integration_connection" "snowflake_2" {
  vendor = "snowflake"
  name   = "<your connection name>"

  auth = {
    method = "username-password-with-data-inspection"
    params = {
      user = "<user>"
      account = "<account>"
      role = "<role>"
      use_warehouse = "<use_warehouse>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      skip_views = "false"
      password = var.snowflake_password
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}

OAuth (browser authorization) — Oauth2 / App Token with Data Inspection

The OAuth (browser authorization) — Oauth2 / App Token with Data Inspection method uses a browser authorization flow, so the connection is created in the Relyance app. Manage it in Terraform afterwards by importing it (terraform import relyance_integration_connection.example snowflake/<connection_id>) or reading it with the relyance_integration_connection data source.

Key-pair authentication

resource "relyance_integration_connection" "snowflake_4" {
  vendor = "snowflake"
  name   = "<your connection name>"

  auth = {
    method = "key-pair"
    params = {
      account = "<account>"
      role = "<role>"
      use_warehouse = "<use_warehouse>"
      user = "<user>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      skip_views = "false"
      private_key = var.snowflake_private_key
      password = var.snowflake_password
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
← Previous
Snapchat