Snowflake

Connect Snowflake so CloudThinker can break down warehouse credits, rank slow and failing queries, and review storage overhead

Connect Snowflake to let CloudThinker show which warehouses burn the most credits, rank slow and failing queries, and measure time travel and failsafe storage. CloudThinker calls the Snowflake SQL REST API with a programmatic access token (PAT) for a service user, and a new connection only reads until you turn on Allow writes.

---

Prerequisites

• ACCOUNTADMIN, or an equivalent role, to create a role, a service user, a network policy, and a token.
• A warehouse the role can use. The connection test needs no compute, so it can pass while real analysis fails without one. Setup step 1 creates a capped one.
• If your account has an authentication policy, its AUTHENTICATION_METHODS must include PROGRAMMATIC_ACCESS_TOKEN, or the token is refused at sign-in.
• The Admin role in the CloudThinker workspace, which you need to add connections. See Roles.

---

Setup

Run all the SQL below as ACCOUNTADMIN (start with USE ROLE ACCOUNTADMIN;), since creating a resource monitor needs it. The SQL uses CT_WH as the warehouse. To use a warehouse you already have, swap in its name everywhere.

1. Create a capped warehouse (recommended)

   Analysis queries bill credits to this warehouse. A dedicated X-Small one with a short auto-suspend and a resource monitor keeps the cost capped:

   USE ROLE ACCOUNTADMIN;
   
   CREATE WAREHOUSE IF NOT EXISTS CT_WH WAREHOUSE_SIZE = XSMALL AUTO_SUSPEND = 60 AUTO_RESUME = TRUE INITIALLY_SUSPENDED = TRUE;
   CREATE RESOURCE MONITOR IF NOT EXISTS CT_MONITOR WITH CREDIT_QUOTA = 10 FREQUENCY = MONTHLY START_TIMESTAMP = IMMEDIATELY TRIGGERS ON 100 PERCENT DO SUSPEND;
   ALTER WAREHOUSE CT_WH SET RESOURCE_MONITOR = CT_MONITOR;
   

   To size CREDIT_QUOTA: an X-Small warehouse uses 1 credit per running hour, billed per second with a 60-second minimum each time it resumes. A quota of 10 covers 10 hours of running time a month. When the quota is used up, the warehouse suspends and analysis queries fail until the next month or until an admin raises it.

2. Create a read-only role

   USE ROLE ACCOUNTADMIN;
   
   CREATE ROLE IF NOT EXISTS CT_READONLY;
   GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER      TO ROLE CT_READONLY;
   GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER     TO ROLE CT_READONLY;
   GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE CT_READONLY;
   GRANT MONITOR USAGE ON ACCOUNT                  TO ROLE CT_READONLY;
   GRANT USAGE ON WAREHOUSE CT_WH                  TO ROLE CT_READONLY;
   
3. Create a service user

   A SERVICE user has no password, MFA, or SSO, so the token is its only way in:

   CREATE USER IF NOT EXISTS SVC_CLOUDTHINKER
     TYPE = SERVICE
     DEFAULT_ROLE = CT_READONLY
     DEFAULT_WAREHOUSE = CT_WH
     COMMENT = 'CloudThinker connection';
   GRANT ROLE CT_READONLY TO USER SVC_CLOUDTHINKER;
   
4. Attach a network policy

   Snowflake refuses token sign-in until the user has a network policy. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us. Put them in ALLOWED_IP_LIST:

   CREATE NETWORK POLICY IF NOT EXISTS CT_POLICY ALLOWED_IP_LIST = ('<cloudthinker-egress-ip-1>', '<cloudthinker-egress-ip-2>');
   ALTER USER SVC_CLOUDTHINKER SET NETWORK_POLICY = CT_POLICY;
   

   On a throwaway test account only, ('0.0.0.0/0') lets you try the connection before you have the list. Never leave it on a production account.

5. Create a programmatic access token

   ALTER USER SVC_CLOUDTHINKER ADD PROGRAMMATIC ACCESS TOKEN CT_TOKEN
     ROLE_RESTRICTION = 'CT_READONLY'
     DAYS_TO_EXPIRY = 90;
   

   Copy the value in the token_secret column of the result. Snowflake shows it only once, and it stops working on the expiry day. DAYS_TO_EXPIRY goes up to 365 unless your account sets a lower limit. CloudThinker doesn’t warn before the token expires, so set a calendar reminder a week before then to rotate it. To check expiry dates later, run SHOW USER PROGRAMMATIC ACCESS TOKENS FOR USER SVC_CLOUDTHINKER; and read the expires_at column.

6. Add the connection in CloudThinker

   Click More → Workspace settings → Connections, search for Snowflake on the Builtin Connections tab and click Connect. Fill in the fields from Connection details, and click Connect.

   Success state: Snowflake shows a Connected status, and the message names what the token resolved to, for example Connected to MYORG-MYACCOUNT (AWS_US_WEST_2), role CT_READONLY, warehouse CT_WH.

---

Connection details

Field	Required	Description	Default
Account identifier	Yes	MYORG-MYACCOUNT. Not the full URL. See below for how to find it
Programmatic access token	Yes	The token from Setup step 5. Not an account password
Role	No	Role the connection uses. Must be inside the token’s ROLE_RESTRICTION	User’s default role
Warehouse	No	Warehouse billed for the credits this connection uses	User’s default warehouse

To find the Account identifier, open the account selector at the bottom of the Snowsight left menu and click View account details. Or run:

SELECT CURRENT_ORGANIZATION_NAME() || '-' || CURRENT_ACCOUNT_NAME();

An identifier written with an underscore (MYORG_MYACCOUNT) also works.

---

Required permissions

Grant	What it unlocks
SNOWFLAKE.USAGE_VIEWER	Credit metering and storage history
SNOWFLAKE.OBJECT_VIEWER	Database, schema, and table inventory
SNOWFLAKE.GOVERNANCE_VIEWER	QUERY_HISTORY, which slow-query and error answers need
MONITOR USAGE ON ACCOUNT	Account-level usage views
USAGE ON WAREHOUSE	Compute to run the analysis queries

GOVERNANCE_VIEWER is the grant people miss. Without it, credit and storage answers work but every slow-query and error answer fails. Keep the token’s ROLE_RESTRICTION on this read-only role so the connection can’t reach anything else.

---

Agent capabilities

Capability	Description
Account discovery	Identity, warehouses, databases, and which ACCOUNT_USAGE views the role can read
Credit analysis	Metered credits per warehouse and per day, over a stated window (30 days by default)
Query health	Slowest queries, recurring error types, and queries that spill to remote storage
Storage review	Largest tables, time travel and failsafe overhead, and per-database growth
Inventory	Schemas, roles, and this connection’s own grants
Warehouse control	With Allow writes on: suspend or resume one named warehouse

CloudThinker reports Snowflake spend in credits, never in money. The price per credit isn’t readable through this connection.

Verify the connection

List my Snowflake warehouses and which ACCOUNT_USAGE views this connection can read

Success state: CloudThinker lists your warehouses and marks each ACCOUNT_USAGE view as readable or blocked, with the GRANT that fixes a blocked one.

Example prompts

Which Snowflake warehouses burned the most credits in the last 30 days?
Show the slowest Snowflake queries this week and any errors that keep recurring
Where are time travel and failsafe adding the most storage?

---

Write access

Allow writes is off on new Snowflake connections.

Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.

With the switch on, AI can approve a warehouse suspend with no person involved. For a production account, choose Manual before you turn writes on, so a person approves every change — that is the control that works today. Once CloudThinker turns on Rule enforcement for your workspace, an Ask first Rule can narrow the wait to the Snowflake connection alone: in a chat, type /create-policy Ask first for every write on the Snowflake connection, then accept it under Approvals → Rules → Needs review. The Cassandra guide walks through checking the proposal.

Write means exactly two actions, not arbitrary SQL:

• Suspend or resume one named warehouse.
• Keep measured findings in a CT_FINDINGS table, when you ask CloudThinker to. On the first save, it creates the table in the one schema where the role has CREATE TABLE. If the role can write to several schemas, it asks you which one. You can also name it in your prompt, for example MONITORING.ALERTS.

CT_FINDINGS has six columns: RECORDED_AT_UTC, CATEGORY, SEVERITY, SUBJECT, DETAIL, and SOURCE. Saving a finding and pruning old ones are both writes, so each goes through approvals. Nothing is pruned automatically: rows stay until you ask CloudThinker to remove those older than a number of days, or delete them yourself.

Resizing a warehouse, changing a resource monitor, or lowering DATA_RETENTION_TIME_IN_DAYS is still handed to you as a statement to run in Snowsight.

Allow writes only lets CloudThinker ask. The role still needs the grants, and with a read-only token Snowflake denies every write. To turn writes on:

1. Create a write role and token

   Replace DEV_WH with the warehouses the agent may suspend, and MONITORING.ALERTS with the schema for CT_FINDINGS. Grant OPERATE only on warehouses the agent may suspend, never a shared production warehouse:

   USE ROLE ACCOUNTADMIN;
   
   CREATE ROLE IF NOT EXISTS CT_READWRITE;
   GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER      TO ROLE CT_READWRITE;
   GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER     TO ROLE CT_READWRITE;
   GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE CT_READWRITE;
   GRANT MONITOR USAGE ON ACCOUNT                  TO ROLE CT_READWRITE;
   GRANT USAGE ON WAREHOUSE CT_WH                  TO ROLE CT_READWRITE;
   
   GRANT USAGE, OPERATE, MONITOR ON WAREHOUSE DEV_WH     TO ROLE CT_READWRITE;
   GRANT USAGE ON DATABASE MONITORING                    TO ROLE CT_READWRITE;
   GRANT USAGE, CREATE TABLE ON SCHEMA MONITORING.ALERTS TO ROLE CT_READWRITE;
   
   GRANT ROLE CT_READWRITE TO USER SVC_CLOUDTHINKER;
   ALTER USER SVC_CLOUDTHINKER ADD PROGRAMMATIC ACCESS TOKEN CT_TOKEN_RW
     ROLE_RESTRICTION = 'CT_READWRITE'
     DAYS_TO_EXPIRY = 90;
   

   Copy the value in the token_secret column.

2. Update the connection

   Open More → Workspace settings → Connections, select Snowflake, click the pencil icon on the account’s row, and in Edit Instance click Replace…. Paste the new token into Programmatic access token, set Role to CT_READWRITE, and click Save and test.

3. Turn on Allow writes

   Close Edit Instance. On the Snowflake connection’s detail panel, turn on the Allow writes switch.

4. Remove the read-only token

   Once Save and test passes, the old token is unused. Run ALTER USER SVC_CLOUDTHINKER REMOVE PROGRAMMATIC ACCESS TOKEN CT_TOKEN;.

To go back to read-only:

1. Turn off Allow writes

   On the Snowflake connection’s detail panel, turn off the Allow writes switch. CloudThinker stops proposing writes at once.

2. Swap back to a read-only token

   Create a new read-only token:

   ALTER USER SVC_CLOUDTHINKER ADD PROGRAMMATIC ACCESS TOKEN CT_TOKEN_RO
     ROLE_RESTRICTION = 'CT_READONLY'
     DAYS_TO_EXPIRY = 90;
   

   Open More → Workspace settings → Connections, select Snowflake, click the pencil icon on the account’s row, and in Edit Instance click Replace…. Paste it into Programmatic access token, set Role to CT_READONLY, and click Save and test.

3. Remove the write token and role

   ALTER USER SVC_CLOUDTHINKER REMOVE PROGRAMMATIC ACCESS TOKEN CT_TOKEN_RW;
   REVOKE ROLE CT_READWRITE FROM USER SVC_CLOUDTHINKER;
   DROP ROLE CT_READWRITE;
   

Two or more Snowflake connections in one workspace turn writes off for all of them, because an approved write can’t name which account it targets.

A suspend can’t be made conditional. A query can start between CloudThinker’s busy check and the suspend, and lose its compute.

---

Rotate the token

1. Create the new token

   Keep the old token until the swap is done. For a read-only connection:

   ALTER USER SVC_CLOUDTHINKER ADD PROGRAMMATIC ACCESS TOKEN CT_TOKEN_2
     ROLE_RESTRICTION = 'CT_READONLY'
     DAYS_TO_EXPIRY = 90;
   

   If writes are on:

   ALTER USER SVC_CLOUDTHINKER ADD PROGRAMMATIC ACCESS TOKEN CT_TOKEN_RW_2
     ROLE_RESTRICTION = 'CT_READWRITE'
     DAYS_TO_EXPIRY = 90;
   

   Copy the value in the token_secret column.

2. Replace it in CloudThinker

   Open More → Workspace settings → Connections, select Snowflake, click the pencil icon on the account’s row, and in Edit Instance click Replace…. Paste the new token and click Save and test.

   Success state: the test passes and the connection stays Connected. If it fails, CloudThinker keeps the previous token.

3. Remove the old token

   Run ALTER USER SVC_CLOUDTHINKER REMOVE PROGRAMMATIC ACCESS TOKEN <old_token_name>;, for example CT_TOKEN or CT_TOKEN_RW.

---

Troubleshooting

Authentication fails at once (390403)

The service user has no network policy. Run ALTER USER SVC_CLOUDTHINKER SET NETWORK_POLICY = CT_POLICY;.

It worked yesterday and fails today (390318)

The token expired or was revoked. Create a new one (Setup step 5) and rotate it into the connection.

Object does not exist or not authorized (002003)

The role is missing a database role. Run the verify prompt: CloudThinker lists every ACCOUNT_USAGE view it can’t read and the exact GRANT for each.

Connected, but every query fails (090073)

A resource monitor is over quota, or the warehouse is suspended and can’t resume. No GRANT fixes this. An account admin raises or resets the resource monitor. The status stays Connected because the token is valid and the test needs no compute.

No active warehouse selected (000606)

The service user has no DEFAULT_WAREHOUSE and the connection has none. Set Warehouse, or give the user a default.

Role not authorized (090105)

The role is outside the token’s ROLE_RESTRICTION. Use a role the token allows, or clear Role to use the user’s default.

A section comes back empty

Not an error. ACCOUNT_USAGE lags by up to a few hours and keeps 365 days of history, so a short window on a quiet account can return no rows.

---

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Dedicated service user: a TYPE = SERVICE user has no password, MFA, or SSO, so the token is the only way in and its activity is easy to audit.
• Restrict and expire the token: ROLE_RESTRICTION caps what the connection can reach, and DAYS_TO_EXPIRY forces rotation.

---

Related

Databricks Connection

Connect Databricks for job, cluster, and catalog analysis

Approvals

Decide which writes run on their own and which wait for you

Connections overview

How credentials and write controls work across connections