Snowflake

Before you start

You need a Snowflake admin role that can create users, roles, and grants. You also need the RSA public key Querio will use for key-pair authentication.

1. Create a service user

What: Create a non-human Snowflake user for Querio.

CREATE USER QUERIO_SVC
  LOGIN_NAME = QUERIO_SVC
  TYPE = SERVICE
  DEFAULT_ROLE = QUERIO_ROLE
  DEFAULT_WAREHOUSE = QUERIO_WH
  DEFAULT_NAMESPACE = MY_DATABASE.PUBLIC
  COMMENT = 'Service user for Querio integration';

2. Create a least-privilege role

What: Give Querio only the permissions it needs.

CREATE ROLE IF NOT EXISTS QUERIO_ROLE;

GRANT USAGE ON WAREHOUSE QUERIO_WH TO ROLE QUERIO_ROLE;
GRANT USAGE ON DATABASE MY_DATABASE TO ROLE QUERIO_ROLE;
GRANT USAGE ON SCHEMA MY_DATABASE.PUBLIC TO ROLE QUERIO_ROLE;

GRANT SELECT ON ALL TABLES IN SCHEMA MY_DATABASE.PUBLIC TO ROLE QUERIO_ROLE;
GRANT SELECT ON ALL VIEWS IN SCHEMA MY_DATABASE.PUBLIC TO ROLE QUERIO_ROLE;
GRANT SELECT ON FUTURE TABLES IN SCHEMA MY_DATABASE.PUBLIC TO ROLE QUERIO_ROLE;
GRANT SELECT ON FUTURE VIEWS IN SCHEMA MY_DATABASE.PUBLIC TO ROLE QUERIO_ROLE;

GRANT ROLE QUERIO_ROLE TO USER QUERIO_SVC;

Scope these grants to the databases and schemas Querio should read.

3. Add the RSA public key

What: Register Querio's public key on the service user:

ALTER USER QUERIO_SVC SET RSA_PUBLIC_KEY='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA5yD1chg+jgPL2wEpGB6nqYOTyu2Hm4cmKpHrPQ7/K9wDq6G1Fm2SL0QG3pBygwK8s3xM60xZW2WiTAmiT47uJfczdMBeYsfarzvMWmcuhsp8EADsz2gWKpi7W70acox6PUJi9g0JlWP9SH7xlV7DuRCExWuXiT78NRg/lCgTutPO4qPqYpf+Gfck5isU/BiZfKChSZVw19XaL4luFZ/F4rwQBG3BU9fCQdLmOxkdifCI1N6HO/9rqMvCaAWH3xGfCTEm5spaOXzVh0wZ42d5ZB4RYANkD8qHv64VYN7UV9k+DzQS9BGauvutAiJcHUtp0VIRJDpm4rdqdwFp7q9FtwIDAQAB';
DESC USER QUERIO_SVC;

If the connection fails with JWT_TOKEN_INVALID_PUBLIC_KEY_FINGERPRINT_MISMATCH, add the following public key as well:

ALTER USER QUERIO_SVC SET RSA_PUBLIC_KEY_2='MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArWiyRRx9weZ4ZfKRr8/foAzcOtaAFE2ib3A3mrO++kIObhW59exmPQT4uPaY7oCUqlLadOCQhOcb55DRi4OrkynYtxPVL0fyZJJNWMNJOlkuQ8Wq8p5mCkSDFLY8zcLYwFB71KBgxtLC7xBUheh/jw6ybEwqg6nY3Ehw98g/SUPiiTQOhfA4eGiFP2JHr6TR2BYoHyZEw2IV9IgTLZDd+G3g0BXtRFO3OPsxqcMyedMM7QGJPEVpFbKDFR4TkV6TRnK/dH6Nlv8IkmoZtcbNP4Zx1Xg5ZOIOf5qkKqyKkNhDdXjpN5uhV3BtVSGGk5k+ngjcx6NSyQgEpxqIE1ELiQIDAQAB';

Provide the account, user, warehouse, database, and schema to Querio.

{
  "account": "orgname-account_name",
  "user": "QUERIO_SVC",
  "warehouse": "QUERIO_WH",
  "database": "MY_DATABASE",
  "schema": "PUBLIC"
}

Before you start

1. Create a service user

2. Create a least-privilege role

3. Add the RSA public key

4. Share the connection metadata

On this page