Snowflake
Euno's Snowflake integration connects to Snowflake metadata, query history, access history, and governance metadata to discover warehouse resources, usage, lineage, sensitive data classification, masking policies, semantic views, and Snowflake shares.
Euno's Snowflake integration supports auto-discovery of:
Snowflake Views and Tables
Snowflake sensitive data classification and masking policy metadata
Hex Usage and Lineage Tracking
Prerequisites / Requirements
Before setting up the source, make sure you have:
A Snowflake user and role for Euno.
A Snowflake warehouse the role can use for metadata queries.
Access to Snowflake account usage views needed for the features you enable.
A private key for key-pair authentication, or credentials generated by Euno during setup.
Stage 1: Configure Snowflake
Step 1: Required Snowflake Permissions
In order to integrate with Euno, create a custom role in Snowflake with the permissions listed below. In the code snippet below, we create a user euno_user, with a role euno_role.
Euno discovers Snowflake resources by issuing SQL queries on Snowflake's system database and information schema. The Snowflake role requires the Snowflake USAGE grant on a Snowflake warehouse. In the code snippet below, we use the warehouse euno_dwh. The RSA_PUBLIC_KEY is generated by the source integration (see step 2).
These grants do not provide the euno_role with access to your data, only to the metadata. To read more about these grants, see:
The SNOWFLAKE.GOVERNANCE_VIEWER database role lets Euno observe Snowflake classification tags, object tags, and masking-policy metadata. If that metadata is unavailable, Euno can still discover core Snowflake resources, but sensitive-data fields may remain empty and object tags are not ingested (the run report notes the missing grant).
In some environments, users may prefer to grant the Euno integration access to read the metadata of views defined in specific databases, rather than to all the databases in the Snowflake account. For more information, see Control which views metadata Euno has access to.
In some environments, users may prefer to limit the rows or columns in the Snowflake query history that Euno integration has access to. For more information, see Using a non-default query history view.
Stage 2: Configure New Snowflake Source in Euno
Step 1: Access the Sources Page
Go to the Sources page.
Click Add New Source and select Snowflake from the list.
Step 2: General Configuration
Asterisk (*) means a mandatory field.
Name*
Enter a name for your Snowflake source (for example, Snowflake - Data Warehouse).
Host*
The Snowflake host associated with your Snowflake account, such as mycompany.eu-central-1.snowflakecomputing.com or org-account.us-west-2.snowflakecomputing.com.
User*
The Snowflake user to use for the integration.
Private Key*
The RSA private key used to authenticate to Snowflake. This value is stored securely and marked as a secret. You can provide your own private key or use one generated by Euno by clicking Generate Credentials.
Passphrase
The passphrase used to decrypt the private key. This value is stored securely and marked as a secret. Leave it blank if the private key is not encrypted.
Generate Credentials
Automatically generate an RSA key pair and passphrase. The public key will be shown in a modal for you to paste into your Snowflake user; the private key and passphrase will be filled into the form and stored securely. This is convenient for quick testing or POCs, but for production we recommend supplying keys generated and managed according to your security policies.
Role
The Snowflake role to use. If the Snowflake user has a default role, you can keep this blank.
Warehouse
The Snowflake warehouse to use for queries. If the Snowflake user has a default warehouse, you can keep this blank.
Query history table*
By default, Euno uses snowflake.account_usage.query_history to access Snowflake query history. If you prefer to use a different table or view, enter it here. See Using a non-default query history view.
Cost per credit (USD)
The credit price paid to Snowflake. This is used to calculate table activity costs.
Storage cost per TB (USD)
The monthly storage rate in USD per terabyte, used to estimate storage costs for Snowflake tables.
Observe warehouse information
Enable this option to observe Snowflake warehouse information on the snowflake_account resource.
Step 3: Schedule
Toggle Schedule to activate updates.
Configure:
Weekly: Select the days and times for updates.
Hourly: Set the interval in hours (e.g., every 12 hours).
Step 4: Resource Cleanup
To keep your data relevant and free of outdated resources, Euno provides automatic resource cleanup options. These settings determine when a resource should be removed if it is no longer detected by a source integration. For a detailed explanation on Euno's cleanup strategies, see: Resource Sponsorship in Euno.
Immediate Cleanup: Remove resources not detected in the most recent successful source integration run.
No Cleanup: Keep all resources indefinitely, even if they are no longer detected.
Step 5: Advanced Settings
Click on the 'Advanced' section to display these additional configurations.
Local agent
Route all Snowflake connector traffic through the selected local agent. The agent host must be able to resolve and reach the Snowflake account, OCSP, and result-download endpoints. If the selected agent is offline or routing fails, Euno does not fall back to a direct connection.
User from agent
Fetch the Snowflake user from a secret handle exposed by the selected agent instead of storing an inline value.
Private Key from agent
Fetch the RSA private key from a secret handle. The key is decrypted and passed to the Snowflake connector in memory; Euno does not write the resolved key to a temporary file.
Passphrase from agent
Fetch the private-key passphrase from a secret handle. Leave both the inline value and handle empty for an unencrypted key.
Skip SSL verification
Skip SSL verification. This is used in cases where Euno accesses Snowflake through a proxy. We recommend leaving this unchecked.
Auto discover views & tables metadata
Enable auto-discovery of Snowflake views and tables metadata.
Auto discover materialized views refresh history
Enable discovery of Snowflake materialized view refresh history. This feature is only available for Snowflake Enterprise edition.
Use Snowflake system database to collect views metadata
Use snowflake.account_usage.views to discover Snowflake views. If you prefer not to grant metadata access for all databases, see Control which views metadata Euno has access to.
Auto discover Hex usage
Discover Hex projects that query Snowflake and extract Snowflake lineage for those projects. For more information, see Hex Usage & Lineage Tracking.
Auto discover Sigma usage
Discover Sigma workbook, element, and data model usage from Snowflake query history.
Override Host URI
Overrides the base URI used for generating resource URIs for databases, schemas, tables, views, semantic views, and columns. By default, Euno uses the host provided in the integration.
Database mapping
Map Snowflake database names to alternative names in Euno.
Schema Pattern
Use regular expressions to include or exclude specific database.schema combinations, such as MY_DB\.PUBLIC.
Observe Inbound Snowflake Shares
Observe inbound Snowflake shares. This requires the IMPORT SHARE privilege.
Outbound Shares
Configure outbound shares manually by share name and database name.
Extract column-level lineage from query history
Extract column-level lineage from Snowflake access_history.
Extract column-level read usage
Extract per-column read usage metrics from Snowflake access_history. This requires Snowflake Enterprise edition.
For Snowflake shares related configuration, see Observing Snowflake Shares.
Local agent and secret handles
Selecting a local agent routes Snowflake authentication, metadata queries, query and access history, OCSP checks, and result downloads through that agent. The agent resolves Snowflake-managed hostnames from its own network.
You can keep the user, private key, and optional passphrase in the agent's configured vault and select their handles under Advanced. Inline credentials remain supported when no handles are selected. See Local Agents for deployment and vault configuration.
If a crawl loses its proxy connection and Euno confirms that the selected agent disconnected, the failed run names the agent and asks you to ensure it is running and registered. Restore the agent's connection, then run the source again. If Euno cannot confirm the agent's status, the run keeps the original integration failure message.
Run report warning: database missing from metadata crawl
If a database appears in access/query history but not in the metadata crawl, Euno can observe its tables by reference only. Table-level lineage may still appear, but field-level lineage will be missing.
To fix this, either:
grant the Snowflake role used by Euno metadata visibility for the affected database
update the Snowflake integration settings so the database is included in the metadata crawl
Step 6: Save Configuration
Click Test & Save to complete the setup.
What Euno Discovers
Snowflake account, databases, and schemas
Snowflake tables, views, materialized views, temporary tables, and columns
Snowflake sensitive data classification tags, privacy categories, and masking policies
Snowflake object tags on databases, schemas, tables, views, and columns
Snowflake semantic views, metrics, and dimensions
Snowflake inbound and outbound shares
Usage, cost, storage, lineage, and optional column usage metrics
Hex projects and lineage detected from Snowflake query history
Sensitive data classification and masking metadata
Euno observes Snowflake classification tags, including semantic and privacy categories, and masking policies attached directly to columns or through tag-based masking. These values can appear on table and column resources, in the Data Model's Sensitive Data tab, Data Model table columns, and Snowflake filters.
For semi-structured columns, Euno also indicates when Snowflake reports classified paths. If Snowflake governance metadata is unavailable during a run, these fields may remain empty while the rest of the Snowflake crawl succeeds.
Snowflake object tags
Euno observes Snowflake object tags on the account, databases, schemas, tables, views, materialized views, and columns, including propagated and inherited tags. Each assignment appears in the resource's Tags as name=value, where the tag name is the lowercased fully qualified tag (for example governance.tags.cost_center=finance) and the value keeps its Snowflake casing. When direct, propagated, and inherited assignments conflict, Euno follows Snowflake's precedence. Snowflake's built-in classification tags (SNOWFLAKE.CORE.*) are excluded here — they appear in the sensitive-data fields described above. Warehouse tags are not currently ingested because warehouse information is stored on the Snowflake account rather than modeled as a standalone Euno resource.
Snowflake returns tag assignments only for objects the Euno role can access, so tags on objects the role has no grants on will not appear even though the objects themselves are discovered through the account-usage metadata. If tags are missing on specific objects, verify the Euno role's grants on those objects. Because a missing result can mean either "untagged" or "not visible to this role," Euno does not erase existing object tags based only on missing tag-reference rows; a removed assignment may remain until Euno can verify the deletion through a complete source.
Snowflake permits quoted tag identifiers whose dots or letter casing can collapse to the same lowercased fully qualified name shown in Euno. If Euno detects two distinct tags that would have the same displayed name, it rejects that run's object-tag snapshot and reports the collision instead of attaching an ambiguous value or replacing previously observed tags.
Using a non-default query history view
By default, Euno uses the system view snowflake.account_usage.query_history to discover the query history.
You might prefer, for security reasons, to limit the rows or columns that Euno integration has access to.
In that case, you can manually create a Snowflake view to expose a subset of the query history. In order for Euno to use this non-default Snowflake view, the following columns, available in snowflake.account_usage.query_history, must be exposed by the view:
query_tag
total_elapsed_time
bytes_scanned
start_time
end_time
query_type
Make sure you grant Euno permissions to SELECT on this view. Below is an example of creating such a view, and excluding records that were initiated by the user PRIVATE_USER
Control which views metadata Euno has access to
By default, the Euno integration uses the system view snowflake.account_usage.views to discover all Snowflake views defined in the snowflake account.
In some environments, users may prefer to grant the Euno integration access to read the metadata of views defined in specific databases, rather than to all the databases in the Snowflake account.
To set up Euno this way, follow these steps:
Grant the Snowflake role used by Euno access to the metadata of views defined in the needed database. For example, to grant the Snowflake role
euno_roleaccess to the metadata of views defined in the databaseexample_database, execute:
These privileges do not provide the euno_role with access to the data in these views, only to the metadata. To read more about these privileges, see:
Uncheck the box "Use Snowflake system database to query for Snowflake views" in the integration configuration.
Granting Euno access to the definitions of Snowflake Semantic Views
In order to get the complete definition of Snowflake Semantic Views, Euno requires the REFERENCES and USAGE privileges. This is a database-level permission, so it needs to be granted in each database where semantic views are defined.
If your setup has semantic views spanning multiple databases, you can consider using the following SQL script to grant these permissions in every database. This script will iterate over all the available databases (ignoring applications, imported databases and personal databases), and grant the above permissions in each one to EUNO_ROLE. Make sure you change the role name in the script.
Hex Usage & Lineage Tracking
When "Discover Hex usage" is enabled, the Snowflake integration automatically observes lineage data from Hex queries executed against Snowflake.
What is observed:
Hex Projects: Discovery of Hex projects that execute queries against Snowflake
Project Lineage: Which Snowflake tables and columns are accessed by each Hex project
How it works:
Hex embeds metadata in SQL query comments when executing queries against Snowflake. This metadata includes:
Project ID and name
User email
Cell ID (for tracking specific notebook cells)
The Snowflake integration parses these comments from the query history and correlates them with table access information to provide comprehensive lineage tracking of Hex activities.
Requirements:
Hex queries must include metadata comments (this is automatic for standard Hex usage)
The Snowflake role must have access to
snowflake.account_usage.query_historyandsnowflake.account_usage.access_historyThe integration must have permissions to read query history data
The Snowflake instance needs to allow connections from each of Euno's public IP addresses:
35.224.29.172,44.218.99.77, and3.214.77.39
This feature helps organizations understand which Hex analytics projects are accessing their Snowflake resources and track data lineage from Hex to Snowflake tables.
Last updated