---
title: "Connect Snowflake"
description: "Connect Datarelix to Snowflake: create a read-only role with warehouse grants, find your account identifier, and handle network policies and PrivateLink."
canonical: https://docs.datarelix.ai/guides/connections/snowflake/
---

# Connect Snowflake

Datarelix connects to Snowflake through a read-only query service. All queries are validated and executed inside that service — the model never sees credentials or executes raw SQL against your database.

## Prerequisites

- A Snowflake account.
- A **read-only role** with `USAGE` on the warehouse, database, and schema, plus `SELECT` on the objects you want to analyze — see [Snowflake access control](https://docs.snowflake.com/en/user-guide/security-access-control-overview).
- A [warehouse](https://docs.snowflake.com/en/user-guide/warehouses-overview) the role can use. An **XS** warehouse is usually sufficient. The warehouse must be resumable — Snowflake auto-suspends inactive warehouses; the role needs `OPERATE` privilege on the warehouse to resume it, otherwise the first query will fail with "Warehouse is suspended."
- A Snowflake user that can assume the role.
- Network reachability. If the account has a [network policy](https://docs.snowflake.com/en/user-guide/network-policies), add Datarelix's egress IPs to its allowed list, or logins are rejected. Accounts locked to **AWS/Azure PrivateLink** (a `*.privatelink.snowflakecomputing.com` URL) accept connections only over the private endpoint and aren't reachable from the hosted service.

## Auth modes

### Username & password

A Snowflake username and password authenticate the connection. The password is stored encrypted. Recommended path for service accounts.

> Key-pair and OAuth auth are planned for a later release.

**Setup — create a read-only role and user**

Connect as an accountadmin or securityadmin and run:

```sql
-- Create the role
CREATE ROLE datarelix_reader;

-- Grant warehouse access (resume + use)
GRANT USAGE ON WAREHOUSE your_warehouse TO ROLE datarelix_reader;
GRANT OPERATE ON WAREHOUSE your_warehouse TO ROLE datarelix_reader;

-- Grant database and schema access
GRANT USAGE ON DATABASE your_database TO ROLE datarelix_reader;
GRANT USAGE ON SCHEMA your_database.your_schema TO ROLE datarelix_reader;

-- Grant SELECT on existing and future tables
GRANT SELECT ON ALL TABLES IN SCHEMA your_database.your_schema TO ROLE datarelix_reader;
GRANT SELECT ON FUTURE TABLES IN SCHEMA your_database.your_schema TO ROLE datarelix_reader;

-- Create the user and assign the role
CREATE USER datarelix_reader
  PASSWORD = 'choose-a-strong-password'
  DEFAULT_ROLE = datarelix_reader
  DEFAULT_WAREHOUSE = your_warehouse;
GRANT ROLE datarelix_reader TO USER datarelix_reader;
```

The `GRANT SELECT ON FUTURE TABLES` ensures new tables added after the connection is created remain visible without a manual re-grant.

**Where to find your credentials**

| Field | Where to get it |
|-------|----------------|
| Account identifier | Snowsight UI → **Admin → Accounts** → copy the **Account** column value (preferred `orgname-account_name` form), or read it from your Snowflake web URL |
| Warehouse | Snowsight → **Admin → Warehouses** — copy the warehouse name |
| Database | Snowsight → **Data → Databases** — copy the database name |
| Role | The role you created above (e.g. `DATARELIX_READER`) |
| Schema | The schema you granted access to (e.g. `PUBLIC`) |
| Username | The user you created above |
| Password | The password you set in `CREATE USER` |

**Finding the account identifier**

Snowflake supports two [account identifier](https://docs.snowflake.com/en/user-guide/admin-account-identifier) formats. The **preferred** modern form is `orgname-account_name` (e.g. `myorg-prod1`); the **legacy** form is `<locator>[.<region>][.<cloud>]`:

| Cloud / region | Example | Notes |
|---|---|---|
| AWS US West (Oregon) | `xy12345` | No region segment — legacy exception. |
| AWS, any other region | `xy12345.us-east-2.aws` | Region + `.aws`. |
| Azure, any region | `xy12345.east-us-2.azure` | Region + `.azure`. |
| GCP, any region | `xy12345.us-central1.gcp` | Region + `.gcp`. |

Both forms work in the connection form. Find yours under **Admin → Accounts** in Snowsight or from your Snowflake web URL (`<locator>.<region>.snowflakecomputing.com`).

**What to enter**

```ini
Account identifier:  myorg-prod1          (or legacy: xy12345.us-east-1.aws)
Warehouse:           YOUR_WAREHOUSE
Database:            YOUR_DATABASE
Role:                DATARELIX_READER
Schema:              PUBLIC
Username:            datarelix_reader
Password:            ••••••••
```

---

## Scope semantics

The **Schema** field sets the connection's allowed schema. Datarelix introspects and queries only inside that schema. If left blank, the connection defaults to `PUBLIC`.

To analyze multiple schemas in the same database, create one connection per schema.

## Discovery

Fully supported. The introspector reads from `<database>.information_schema` to surface tables, columns, primary keys, and declared foreign keys.

**Foreign keys are declaration-only.** Snowflake does not enforce FK constraints on standard tables — they're informational metadata. Discovery returns an empty relationship graph if your warehouse was created without declared FKs; that's expected, not a discovery failure.

## Snowflake SQL primer

Standard SQL with a few Snowflake-specific features Datarelix is aware of:

- **Identifiers** — Unquoted identifiers fold to uppercase. Double-quote case-sensitive names.
- **Pagination** — `LIMIT n OFFSET m`.
- **Window filters** — Use `QUALIFY`, similar to `HAVING` for window functions.
- **Timestamps** — `TIMESTAMP_NTZ` (no TZ), `TIMESTAMP_LTZ` (local), `TIMESTAMP_TZ`.
- **Semi-structured data** — `VARIANT`, `OBJECT`, and `ARRAY` with `LATERAL FLATTEN` for unnesting.
- **Three-part names** — `DATABASE.SCHEMA.TABLE`.

## Limitations

- **Read-only** — the validator rejects write and DDL statements at both the AST and text-keyword layers.
- **Multi-statement queries blocked** — one `SELECT`/`WITH`/`UNION` per question. CTEs with multiple table references in a single `WITH` clause are fine.
- **System schemas blocked** — `INFORMATION_SCHEMA` queries are allowed only during discovery; `ACCOUNT_USAGE` is always blocked.
- **Statement timeout** — set per session (30 s default). Tune this if your warehouse routinely needs longer-running analytical queries.
- **Row limit** — server-side cap of 5 000 rows by default.

## Troubleshooting

| Symptom | Likely cause | Fix |
|---------|--------------|-----|
| `390100: Incorrect username or password` | Bad credentials | Test from the Snowflake web UI first. |
| `Warehouse 'X' does not exist or not authorized` | Role missing `USAGE` on warehouse | `GRANT USAGE ON WAREHOUSE X TO ROLE Y`. |
| `Warehouse is suspended` | Role missing `OPERATE` | `GRANT OPERATE ON WAREHOUSE X TO ROLE Y`. |
| `Object does not exist` on discovery | Role missing `USAGE` on database/schema | `GRANT USAGE ON DATABASE`/`SCHEMA` to the role. |
| `IP ... is not allowed to access Snowflake` | Account network policy blocks the egress IP | Add Datarelix's egress IPs to the account/user [network policy](https://docs.snowflake.com/en/user-guide/network-policies) allowed list. |
| `Statement timeout reached` | Query exceeded the session timeout | Narrow the question, add a `LIMIT`, or contact support to raise the timeout. |
| Discovery returns 0 tables | Role lacks `SELECT` on the schema's objects | `GRANT SELECT ON ALL TABLES IN SCHEMA X TO ROLE Y` + `GRANT SELECT ON FUTURE TABLES IN SCHEMA X TO ROLE Y`. |