Snowflake

Euno's Snowflake integration connects to Snowflake metadata, query history, and access history to discover warehouse resources, usage, lineage, semantic views, and Snowflake shares.

Euno's Snowflake integration supports auto-discovery of:

• Snowflake Views and Tables

• Snowflake Table Activity and Tableau Usage

• Hex Usage and Lineage Tracking

Prerequisites / Requirements

Before setting up the source, make sure you have:

• A Snowflake user and role for Euno.

• A Snowflake warehouse the role can use for metadata queries.

• Access to Snowflake account usage views needed for the features you enable.

• A private key for key-pair authentication, or credentials generated by Euno during setup.

Stage 1: Configure Snowflake

Step 1: Required Snowflake Permissions

In order to integrate with Euno, create a custom role in Snowflake with the permissions listed below. In the code snippet below, we create a user euno_user, with a role euno_role.

Euno discovers Snowflake resources by issuing SQL queries on Snowflake's system database and information schema. The Snowflake role requires the Snowflake USAGE grant on a Snowflake warehouse. In the code snippet below, we use the warehouse euno_dwh. The RSA_PUBLIC_KEY is generated by the source integration (see step 2).

CREATE OR ALTER ROLE euno_role;
CREATE USER euno_user
    DEFAULT_ROLE='euno_role'
    RSA_PUBLIC_KEY= 'MIIBIjA...';
GRANT ROLE euno_role TO USER euno_user;
GRANT USAGE ON WAREHOUSE euno_dwh TO ROLE euno_role;
GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER TO ROLE euno_role;
GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE euno_role;
GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER TO ROLE euno_role;

These grants do not provide the euno_role with access to your data, only to the metadata. To read more about these grants, see:

• usage privilege on Snowflake Warehouses

• object_viewer , governance_viewer and usage_viewer database roles

• references privilege on Snowflake views

In some environments, users may prefer to grant the Euno integration access to read the metadata of views defined in specific databases, rather than to all the databases in the Snowflake account. For more information, see Control which views metadata Euno has access to.

In some environments, users may prefer to limit the rows or columns in the Snowflake query history that Euno integration has access to. For more information, see Using a non-default query history view.

Stage 2: Configure New Snowflake Source in Euno

Step 1: Access the Sources Page

1. Go to the Sources page.

2. Click Add New Source and select Snowflake from the list.

Step 2: General Configuration

Asterisk (*) means a mandatory field.

Configuration	Description
Name*	Enter a name for your Snowflake source (for example, Snowflake - Data Warehouse).
Host*	The Snowflake host associated with your Snowflake account, such as mycompany.eu-central-1.snowflakecomputing.com or org-account.us-west-2.snowflakecomputing.com.
User*	The Snowflake user to use for the integration.
Private Key*	The RSA private key used to authenticate to Snowflake. This value is stored securely and marked as a secret. You can provide your own private key or use one generated by Euno by clicking Generate Credentials.
Passphrase	The passphrase used to decrypt the private key. This value is stored securely and marked as a secret. Leave it blank if the private key is not encrypted.
Generate Credentials	Automatically generate an RSA key pair and passphrase. The public key will be shown in a modal for you to paste into your Snowflake user; the private key and passphrase will be filled into the form and stored securely. This is convenient for quick testing or POCs, but for production we recommend supplying keys generated and managed according to your security policies.
Role	The Snowflake role to use. If the Snowflake user has a default role, you can keep this blank.
Warehouse	The Snowflake warehouse to use for queries. If the Snowflake user has a default warehouse, you can keep this blank.
Query history table*	By default, Euno uses snowflake.account_usage.query_history to access Snowflake query history. If you prefer to use a different table or view, enter it here. See Using a non-default query history view.
Cost per credit (USD)	The credit price paid to Snowflake. This is used to calculate table activity costs.
Storage cost per TB (USD)	The monthly storage rate in USD per terabyte, used to estimate storage costs for Snowflake tables.
Observe warehouse information	Enable this option to observe Snowflake warehouse information on the snowflake_account resource.

Step 3: Schedule

1. Toggle Schedule to activate updates.

2. Configure:

   1. Weekly: Select the days and times for updates.

   2. Hourly: Set the interval in hours (e.g., every 12 hours).

Step 4: Resource Cleanup

To keep your data relevant and free of outdated resources, Euno provides automatic resource cleanup options. These settings determine when a resource should be removed if it is no longer detected by a source integration. For a detailed explanation on Euno's cleanup strategies, see: Resource Sponsorship in Euno.

• Immediate Cleanup: Remove resources not detected in the most recent successful source integration run.

• No Cleanup: Keep all resources indefinitely, even if they are no longer detected.

Step 5: Advanced Settings

Click on the 'Advanced' section to display these additional configurations.

Configuration	Description
Skip SSL verification	Skip SSL verification. This is used in cases where Euno accesses Snowflake through a proxy. We recommend leaving this unchecked.
Auto discover views & tables metadata	Enable auto-discovery of Snowflake views and tables metadata.
Auto discover materialized views refresh history	Enable discovery of Snowflake materialized view refresh history. This feature is only available for Snowflake Enterprise edition.
Use Snowflake system database to collect views metadata	Use snowflake.account_usage.views to discover Snowflake views. If you prefer not to grant metadata access for all databases, see Control which views metadata Euno has access to.
Auto discover Hex usage	Discover Hex projects that query Snowflake and extract Snowflake lineage for those projects. For more information, see Hex Usage & Lineage Tracking.
Auto discover Sigma usage	Discover Sigma workbook, element, and data model usage from Snowflake query history.
Override Host URI	Overrides the base URI used for generating resource URIs for databases, schemas, tables, views, semantic views, and columns. By default, Euno uses the host provided in the integration.
Database mapping	Map Snowflake database names to alternative names in Euno.
Schema Pattern	Use regular expressions to include or exclude specific database.schema combinations, such as MY_DB\.PUBLIC.
Observe Inbound Snowflake Shares	Observe inbound Snowflake shares. This requires the IMPORT SHARE privilege.
Outbound Shares	Configure outbound shares manually by share name and database name.
Extract column-level lineage from query history	Extract column-level lineage from Snowflake access_history.
Extract column-level read usage	Extract per-column read usage metrics from Snowflake access_history. This requires Snowflake Enterprise edition.

For Snowflake shares related configuration, see Observing Snowflake Shares.

Run report warning: database missing from metadata crawl

If a database appears in access/query history but not in the metadata crawl, Euno can observe its tables by reference only. Table-level lineage may still appear, but field-level lineage will be missing.

To fix this, either:

• grant the Snowflake role used by Euno metadata visibility for the affected database

• update the Snowflake integration settings so the database is included in the metadata crawl

Step 6: Save Configuration

Click Test & Save to complete the setup.

What Euno Discovers

• Snowflake account, databases, and schemas

• Snowflake tables, views, materialized views, temporary tables, and columns

• Snowflake semantic views, metrics, and dimensions

• Snowflake inbound and outbound shares

• Usage, cost, storage, lineage, and optional column usage metrics

• Hex projects and lineage detected from Snowflake query history

---

Using a non-default query history view

By default, Euno uses the system view snowflake.account_usage.query_history to discover the query history.

You might prefer, for security reasons, to limit the rows or columns that Euno integration has access to.

In that case, you can manually create a Snowflake view to expose a subset of the query history. In order for Euno to use this non-default Snowflake view, the following columns, available in snowflake.account_usage.query_history, must be exposed by the view:

• query_tag

• total_elapsed_time

• bytes_scanned

• start_time

• end_time

• query_type

Make sure you grant Euno permissions to SELECT on this view. Below is an example of creating such a view, and excluding records that were initiated by the user PRIVATE_USER

CREATE OR REPLACE VIEW user.public.query_history_for_euno AS (
  SELECT query_tag, total_elapsed_time, start_time, end_time, bytes_scanned, query_type
  FROM snowflake.account_usage.query_history
  WHERE user_name != 'PRIVATE_USER'
);

GRANT SELECT ON VIEW user.public.query_history_for_euno TO ROLE euno_role;

Control which views metadata Euno has access to

By default, the Euno integration uses the system view snowflake.account_usage.views to discover all Snowflake views defined in the snowflake account.

In some environments, users may prefer to grant the Euno integration access to read the metadata of views defined in specific databases, rather than to all the databases in the Snowflake account.

To set up Euno this way, follow these steps:

1. Grant the Snowflake role used by Euno access to the metadata of views defined in the needed database. For example, to grant the Snowflake role euno_role access to the metadata of views defined in the database example_database, execute:

GRANT USAGE ON DATABASE example_database TO ROLE euno_role;
GRANT USAGE ON ALL SCHEMAS IN DATABASE example_database TO ROLE euno_role;
GRANT REFERENCES ON ALL VIEWS IN DATABASE example_database TO ROLE euno_role;
GRANT USAGE ON FUTURE SCHEMAS IN DATABASE example_database TO ROLE euno_role;
GRANT REFERENCES ON FUTURE VIEWS IN DATABASE example_database TO ROLE euno_role;

These privileges do not provide the euno_role with access to the data in these views, only to the metadata. To read more about these privileges, see:

• usage privilege on Snowflake databases

• usage privilege on Snowflake schema

• references privilege on Snowflake views

1. Uncheck the box "Use Snowflake system database to query for Snowflake views" in the integration configuration.

Granting Euno access to the definitions of Snowflake Semantic Views

In order to get the complete definition of Snowflake Semantic Views, Euno requires the REFERENCES and USAGE privileges. This is a database-level permission, so it needs to be granted in each database where semantic views are defined.

-- For every relevant database
GRANT REFERENCES ON ALL SEMANTIC VIEWS IN DATABASE <database_name> TO ROLE euno_role;
GRANT REFERENCES ON FUTURE SEMANTIC VIEWS IN DATABASE <database_name> TO ROLE euno_role;
GRANT USAGE ON DATABASE <database_name> TO ROLE euno_role;
GRANT USAGE ON ALL SCHEMAS IN DATABASE <database_name> TO ROLE euno_role;
GRANT USAGE ON FUTURE SCHEMAS IN DATABASE <database_name> TO ROLE euno_role;

If your setup has semantic views spanning multiple databases, you can consider using the following SQL script to grant these permissions in every database. This script will iterate over all the available databases (ignoring applications, imported databases and personal databases), and grant the above permissions in each one to EUNO_ROLE. Make sure you change the role name in the script.

DECLARE
  v_db STRING;
  c1 CURSOR FOR (
    SELECT DATABASE_NAME
    FROM INFORMATION_SCHEMA.DATABASES
    WHERE DATABASE_NAME NOT IN ('SNOWFLAKE', 'SNOWFLAKE_SAMPLE_DATA')
  );
BEGIN
  FOR rec IN c1 DO
    v_db := rec.DATABASE_NAME;

    BEGIN
      -- Existing semantic views
      EXECUTE IMMEDIATE
        'GRANT REFERENCES ON ALL SEMANTIC VIEWS IN DATABASE ' || v_db ||
        ' TO ROLE EUNO_ROLE';

      -- Future semantic views
      EXECUTE IMMEDIATE
        'GRANT REFERENCES ON FUTURE SEMANTIC VIEWS IN DATABASE ' || v_db ||
        ' TO ROLE EUNO_ROLE';
      -- Usage
      EXECUTE IMMEDIATE
        'GRANT USAGE ON DATABASE ' || v_db ||
        ' TO ROLE EUNO_ROLE';
      EXECUTE IMMEDIATE
        'GRANT USAGE ON ALL SCHEMAS IN DATABASE ' || v_db ||
        ' TO ROLE EUNO_ROLE';
      EXECUTE IMMEDIATE
        'GRANT USAGE ON FUTURE SCHEMAS IN DATABASE ' || v_db ||
        ' TO ROLE EUNO_ROLE';
    EXCEPTION
      WHEN OTHER THEN
        -- Skip unsupported databases types
        IF (SQLERRM LIKE '%imported database%' OR
            SQLERRM LIKE '%IMPORTED PRIVILEGES%' OR
            SQLERRM LIKE '%personal database%' OR
            SQLERRM LIKE '%APPLICATION%' OR
            SQLERRM LIKE '%Operation not supported%') THEN
          NULL;
        ELSE
          -- Re-raise other errors
          RAISE;
        END IF;
    END;
  END FOR;
END;

Hex Usage & Lineage Tracking

When "Discover Hex usage" is enabled, the Snowflake integration automatically observes lineage data from Hex queries executed against Snowflake.

What is observed:

• Hex Projects: Discovery of Hex projects that execute queries against Snowflake

• Project Lineage: Which Snowflake tables and columns are accessed by each Hex project

How it works:

Hex embeds metadata in SQL query comments when executing queries against Snowflake. This metadata includes:

• Project ID and name

• User email

• Cell ID (for tracking specific notebook cells)

The Snowflake integration parses these comments from the query history and correlates them with table access information to provide comprehensive lineage tracking of Hex activities.

Requirements:

• Hex queries must include metadata comments (this is automatic for standard Hex usage)

• The Snowflake role must have access to snowflake.account_usage.query_history and snowflake.account_usage.access_history

• The integration must have permissions to read query history data

• The Snowflake instance needs to allow connections from Euno's public IP address in 35.224.29.172

This feature helps organizations understand which Hex analytics projects are accessing their Snowflake resources and track data lineage from Hex to Snowflake tables.