> ## Documentation Index
> Fetch the complete documentation index at: https://help.nops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Snowflake

> Connect Snowflake usage and billing data to nOps Inform using key-pair authentication

## Overview

nOps reads **Snowflake usage and billing data** — warehouse credit consumption, query history, and organization-level spend — from Snowflake's `ACCOUNT_USAGE` and `ORGANIZATION_USAGE` system views to show cost and performance in Inform. Snowflake uses **RSA key-pair authentication**: you provide only your **account identifier**, and nOps generates a key pair and gives you the exact SQL commands to run.

You can connect **multiple** Snowflake accounts, each with its own generated key pair.

<Warning>
  Only create **one** integration from your Snowflake **organization admin account**. The `ORGANIZATION_USAGE` views return identical data across every account in the organization, so connecting more than one account causes duplicate data and inconsistent reporting.
</Warning>

## Prerequisites

* `ACCOUNTADMIN` privileges in Snowflake
* Access to your Snowflake **organization admin account** (required for `ORGANIZATION_USAGE` views)
* Ability to create databases, roles, warehouses, and service users
* nOps organization **administrator** access

<Note>
  Only **admins** and **owners** can connect, view instructions, or disconnect. **Members** see **Admin Only** on connectable cards.
</Note>

## Connect in nOps

### Where to open Snowflake

* **To connect for the first time** — go to **Settings → Integrations** and click the **Snowflake** card.
* **To manage existing connections** — open the same card or use **Settings → Account Status → Connected apps** and click the **Snowflake** chip.

### Connect steps

1. Click the **Snowflake** card.
2. Enter your **account identifier** — just the identifier, not the full URL (for example `ngb14322.us-east-1` from `ngb14322.us-east-1.snowflakecomputing.com`).
3. Click **Generate key pair**. nOps creates a 2048-bit RSA key pair for this connection and shows setup instructions.
4. Copy the generated SQL and run it in a Snowflake worksheet using `ACCOUNTADMIN`.

<Tip>
  You don't need to look up your account identifier manually. Run this in a Snowflake worksheet to get the exact value:

  ```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
  SELECT
    LOWER(CURRENT_ACCOUNT_LOCATOR()) || '.' ||
    LOWER(REPLACE(REPLACE(CURRENT_REGION(), 'AWS_', ''), '_', '-')) AS account_identifier;
  ```
</Tip>

### Default configuration

nOps uses the following defaults for every new Snowflake integration — you only provide the account identifier:

| Setting   | Default  |
| --------- | -------- |
| Database  | `nops`   |
| Schema    | `PUBLIC` |
| Warehouse | `nops`   |
| Username  | `nops`   |

## Run the setup SQL in Snowflake

After you generate the key pair, nOps shows SQL split into four steps. Run them in order as `ACCOUNTADMIN` (steps 1–2) and then as the `nops` role (steps 3–4):

1. **Initial setup** — creates the `nops` role, the `nops` warehouse, the `nops` database, and grants `IMPORTED PRIVILEGES` on the `SNOWFLAKE` database so the role can read usage views.
2. **Create the service user** — creates a `SERVICE`-type user, attaches the nOps-generated RSA public key with `ALTER USER ... SET RSA_PUBLIC_KEY=...`, and grants the `nops` role to both the service user and your current user.
3. **Create views** — creates `query_history`, `warehouse_metering_history`, and `usage_in_currency_daily` views in the `nops` database that wrap the underlying `SNOWFLAKE.ACCOUNT_USAGE` and `SNOWFLAKE.ORGANIZATION_USAGE` tables, then grants `SELECT` to the `nops` role.
4. **Verify** — runs a test query as the `nops` role to confirm the setup works.

nOps also shows a **Copy all** button to copy every step at once.

### Network configuration (optional)

If your Snowflake account restricts access with a network policy, add the nOps IP to your allowlist. `SET ALLOWED_IP_LIST` **replaces** the entire list, so include your existing IPs alongside the nOps address:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
ALTER NETWORK POLICY your_policy SET ALLOWED_IP_LIST = ('your.existing.ip.here', '52.11.169.55');
```

## Manage your connections

Administrators can **view instructions** or **remove** individual Snowflake integrations from the Snowflake modal. Removing an integration deletes the stored RSA private key from AWS Secrets Manager and stops nOps from connecting to that account. nOps does not perform a live connectivity check when you connect — verify the SQL ran successfully in Snowflake to confirm access.

## Troubleshooting

* **Invalid account identifier** — enter only the identifier (for example `ngb14322.us-east-1`), not the full `https://...snowflakecomputing.com` URL.
* **`RSA_PUBLIC_KEY` errors** — make sure you copied the full SQL block from step 2 without truncation; the key is a single long base64 string.
* **Permission errors while running the SQL** — confirm you're using `ACCOUNTADMIN` for steps 1–2, and that you're logged into the organization admin account.
* **No data after setup** — confirm the views in step 3 were created successfully and that the `nops` role has `SELECT` on them.
* **Duplicate or inconsistent data across accounts** — you likely connected more than one account in the same organization; keep only the integration created from the org admin account.

## Security

Snowflake authentication uses public key cryptography — no password is stored or transmitted. The private key is generated by nOps, stored securely in AWS Secrets Manager, and never shown after key generation completes. Only the public key is placed in your Snowflake account.