M↓ View as Markdown ↗

Snowflake¶

Connect a Snowflake database to Actian AI Analyst so you can build Models on its tables and let your AI Analysts query them.

Availability

Who can do this: members with the Edit capability in the active Workspace. If your organization turns on Restrict connection management, you also need the Manage organization capability.
Plan: available unless your organization's plan excludes the Snowflake connector.
Deployment: Actian SaaS and self-managed deployments, unless the deployment's operator has turned the Snowflake connector off.

To connect Snowflake:

Create a dedicated role and user in Snowflake.
Grant the role read-only access to your data.
Set up authentication for the user.
Allow AI Analyst through your network policy, if you use one.
Set up the connection in AI Analyst.

Read-only access depends on the role

Snowflake has no read-only session mode that AI Analyst can switch on, so AI Analyst cannot enforce read-only access itself. Read-only protection depends on the grants of the role the queries run as. Give that role only read privileges: USAGE on the warehouse, database and schemas, and SELECT on the tables and views. The only exception is IMPORTED PRIVILEGES for shared databases (see step 2). Enter the role in the Role field when you set up the connection. If you leave Role blank, Snowflake uses the user's default role. See Read-only access.

1. Create a role and user in Snowflake¶

Create a technical user and role for AI Analyst. Replace the placeholder names with your own values.

-- Create the role
CREATE ROLE analyst_role;

-- Create a service user (no password sign-in)
CREATE USER analyst_user
  TYPE = SERVICE
  DEFAULT_WAREHOUSE = example_wh   -- an existing warehouse
  DEFAULT_ROLE = analyst_role;

-- Link the role to the user
GRANT ROLE analyst_role TO USER analyst_user;

-- Allow the role to use the warehouse
GRANT USAGE ON WAREHOUSE example_wh TO ROLE analyst_role;

Tip

You can use a shared warehouse to save on compute costs. A small size (such as XS) is typically enough.

2. Grant read-only access to your data¶

AI Analyst only needs access to the schemas or tables you want to expose, typically reporting or analytics tables.

-- Replace these with your actual names
SET db_name = 'example_db';
SET schema_name = 'example_schema';
SET db_schema_name = $db_name || '.' || $schema_name;

-- Grant access to data objects
GRANT USAGE ON DATABASE IDENTIFIER($db_name) TO ROLE analyst_role;
GRANT USAGE ON SCHEMA IDENTIFIER($db_schema_name) TO ROLE analyst_role;

GRANT SELECT ON ALL TABLES IN SCHEMA IDENTIFIER($db_schema_name) TO ROLE analyst_role;
GRANT SELECT ON FUTURE TABLES IN SCHEMA IDENTIFIER($db_schema_name) TO ROLE analyst_role;

GRANT SELECT ON ALL VIEWS IN SCHEMA IDENTIFIER($db_schema_name) TO ROLE analyst_role;
GRANT SELECT ON FUTURE VIEWS IN SCHEMA IDENTIFIER($db_schema_name) TO ROLE analyst_role;

GRANT SELECT ON ALL MATERIALIZED VIEWS IN SCHEMA IDENTIFIER($db_schema_name) TO ROLE analyst_role;
GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN SCHEMA IDENTIFIER($db_schema_name) TO ROLE analyst_role;

This gives the role read-only access to the whole schema, including present and future tables, views and materialized views.

If you use a shared database (for example, from a data provider or the Snowflake Marketplace), also grant:

GRANT IMPORTED PRIVILEGES ON DATABASE shared_external_db TO ROLE analyst_role;

Note

A Snowflake connection covers one database. To expose tables from another database, add a separate connection for it.

AI Analyst does not read foreign keys from Snowflake. You define how tables join on your Models instead. See Relationships.

3. Set up authentication¶

AI Analyst runs queries without a person present (for example, for scheduled work), so it supports only authentication methods that work unattended:

Method in AI Analyst	Use it when
Key pair (RSA) (default)	You can register an RSA public key on the Snowflake user. Recommended for most setups.
Programmatic access token	You prefer a token that you generate for the user in Snowflake.
OAuth client credentials	You authenticate through an OAuth client that can issue tokens for Snowflake. Enter your identity provider's token endpoint, or leave it blank to use Snowflake's own.
Workload identity federation	AI Analyst runs in your own cloud account and Snowflake trusts that cloud identity.

Password sign-in is not supported

Password sign-in is not supported, because Snowflake is phasing out single-factor passwords for service users. Password with MFA, browser-based single sign-on and the OAuth authorization-code flow are not supported either, because each needs a person present when AI Analyst connects.

Key pair (RSA)Programmatic access tokenOAuth client credentialsWorkload identity federation

Generate a key pair on your computer, for example with OpenSSL:

# Private key (PKCS#8). Omit -nocrypt to protect it with a passphrase.
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8 -nocrypt

# Matching public key
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

Register the public key on the Snowflake user. Paste the contents of rsa_key.pub without the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines:
```
ALTER USER analyst_user SET RSA_PUBLIC_KEY = '<public_key>';
```
Keep the private key (rsa_key.p8) safe. You paste it into AI Analyst in step 5.

Generate a programmatic access token for analyst_user in Snowflake, and restrict it to analyst_role if you can. Copy the token when Snowflake shows it. Snowflake's own requirements for programmatic access tokens apply (for example, network policy rules and expiry), so check Snowflake's documentation.

When the token expires, generate a new one and update the connection's credentials. See Manage connections.

Set up an OAuth client that can issue tokens for Snowflake using the client credentials grant, and note its client ID and client secret. If you use an external identity provider, note its token endpoint too.

In AI Analyst, Scope is optional. Leave it blank to derive the scope from the role.

With this method, AI Analyst authenticates as the cloud identity of the environment it runs on, so there is no secret to store. It is mainly relevant to self-managed deployments on AWS, Azure or Google Cloud: configure the Snowflake user to trust the workload identity of your installation, following Snowflake's documentation.

On Actian SaaS, the identity to trust is not shown in the product. Ask your Actian contact before you choose this method.

4. Allow network access¶

If you use Snowflake network policies, allow the IP addresses that AI Analyst connects from:

Actian SaaS: when your deployment publishes its addresses, the Setup help panel next to the connection form lists them under Which IPs to allow.
Self-managed deployment: AI Analyst connects from your own installation's network. Allow its outbound addresses, or ask whoever operates your installation.

If no addresses are listed, or you allowed an address from an earlier version of these docs, see Network access.

5. Set up the connection in AI Analyst¶

In Studio, open Connections and click the plus button (Add connection).
Under Warehouses, select Snowflake.
Under Connection details, enter a Name and, optionally, a Description. Select Private to this Workspace if only the current Workspace should use the connection. See Connections and Workspaces.

Under Credentials, fill in:

Account: your Snowflake account identifier, such as xy12345-xy12345. Do not enter the full URL.
Warehouse: the warehouse the role can use, such as example_wh.
Database: the database to query, such as example_db.

Authentication: the method you set up in step 3, and its fields:

Authentication	Fields
Key pair (RSA)	Username (`analyst_user`), Private key (paste the full contents of the private key file, including the `BEGIN` and `END` lines), Private key passphrase (only if the key is encrypted)
Programmatic access token	Username (`analyst_user`), Access token
OAuth client credentials	OAuth client ID, OAuth client secret, Token endpoint (optional; leave blank to use Snowflake's own), Scope (optional)
Workload identity federation	Cloud provider: `AWS`, `AZURE` or `GCP` (default), the cloud this deployment runs on

Role (optional, recommended): the role to activate for every query, such as analyst_role. Leave it blank to use the user's default role.

Click Test connection.
When the test succeeds, select the Schemas to expose for browsing and model authoring.
Click Save connection.

Note

Save connection stays unavailable until the test passes. A successful test is valid for five minutes, and changing a connection field resets it. If either happens, test again.
Snowflake has no Paste a connection string option, because key pairs and tokens do not fit in a one-line connection string.
Secret values (the private key, passphrase, token and client secret) are encrypted at rest and never shown again after you save.

Query limits¶

AI Analyst sets a statement timeout on each Snowflake session, so a long-running query is cancelled instead of running on. The timeout is 30 seconds unless the feature running the query sets its own limit. See Query limits.

Troubleshooting¶

When a test fails, the form shows a short summary, such as Authentication failed or Could not reach the warehouse. Expand it to see the error that the warehouse returned.

Symptom	Likely cause	What to do
The test fails with an authentication error	Wrong username, private key, passphrase, token or OAuth client details, or the public key is not registered on the user.	Check the values for the method you chose. For a key pair, check that `RSA_PUBLIC_KEY` on the user matches your private key.
The test fails with a network error or times out	The account identifier is wrong, or a network policy blocks AI Analyst.	Check Account (identifier only, no URL). Review step 4.
The test fails with a permission error, or tables are missing	The role is missing `USAGE` or `SELECT` grants, or a different role is active.	Rerun the grants in step 2 and enter the role in Role.
No schemas to select after a successful test	The role has no `USAGE` on schemas in the database.	Grant `USAGE` on the schemas, then test again.

For connections that already exist, see Manage connections and Data source health monitoring.

Next steps¶

Create Models on the tables you want to analyze (see Creating models) and add them to an AI Analyst (see Models).