# Snowflake Euno's Snowflake integration connects to Snowflake metadata, query history, and access history to discover warehouse resources, usage, lineage, semantic views, and Snowflake shares. Euno's Snowflake integration supports auto-discovery of: * Snowflake Views and Tables * [Snowflake Table Activity and Tableau Usage](https://docs.euno.ai/guides/usage) * Hex Usage and Lineage Tracking ## Prerequisites / Requirements Before setting up the source, make sure you have: * A Snowflake user and role for Euno. * A Snowflake warehouse the role can use for metadata queries. * Access to Snowflake account usage views needed for the features you enable. * A private key for key-pair authentication, or credentials generated by Euno during setup. ## Stage 1: Configure Snowflake ### Step 1: Required Snowflake Permissions In order to integrate with Euno, create a custom role in Snowflake with the permissions listed below. In the code snippet below, we create a user `euno_user`, with a role `euno_role`. Euno discovers Snowflake resources by issuing SQL queries on Snowflake's [system database](https://docs.snowflake.com/en/sql-reference/snowflake-db) and [information schema](https://docs.snowflake.com/en/sql-reference/info-schema). The Snowflake role requires the Snowflake USAGE grant on a Snowflake warehouse. In the code snippet below, we use the warehouse `euno_dwh`. The RSA\_PUBLIC\_KEY is generated by the source integration (see step 2). ```sql CREATE OR ALTER ROLE euno_role; CREATE USER euno_user DEFAULT_ROLE='euno_role' RSA_PUBLIC_KEY= 'MIIBIjA...'; GRANT ROLE euno_role TO USER euno_user; GRANT USAGE ON WAREHOUSE euno_dwh TO ROLE euno_role; GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER TO ROLE euno_role; GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE euno_role; GRANT DATABASE ROLE SNOWFLAKE.USAGE_VIEWER TO ROLE euno_role; ``` {% hint style="success" %} These grants do not provide the `euno_role` with access to your data, only to the metadata. To read more about these grants, see: * [`usage` privilege on Snowflake Warehouses](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#virtual-warehouse-privileges) * [`object_viewer` , `governance_viewer` and `usage_viewer` database roles](https://docs.snowflake.com/en/sql-reference/snowflake-db-roles) * [`references` privilege on Snowflake views](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#view-privileges) {% endhint %} In some environments, users may prefer to grant the Euno integration access to read the metadata of views defined in specific databases, rather than to all the databases in the Snowflake account. For more information, see [Control which views metadata Euno has access to](#control-which-views-metadata-euno-has-access-to). In some environments, users may prefer to limit the rows or columns in the Snowflake query history that Euno integration has access to. For more information, see [Using a non-default query history view](#using-a-non-default-query-history-view). ## Stage 2: Configure New Snowflake Source in Euno ### Step 1: Access the Sources Page 1. Go to the **Sources** page. 2. Click **Add New Source** and select **Snowflake** from the list. ### Step 2: General Configuration Asterisk (\*) means a mandatory field. | Configuration | Description | | --------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Name**\* | Enter a name for your Snowflake source (for example, `Snowflake - Data Warehouse`). | | **Host**\* | The Snowflake host associated with your Snowflake account, such as `mycompany.eu-central-1.snowflakecomputing.com` or `org-account.us-west-2.snowflakecomputing.com`. | | **User**\* | The Snowflake user to use for the integration. | | **Private Key**\* | The RSA private key used to authenticate to Snowflake. This value is stored securely and marked as a secret. You can provide your own private key or use one generated by Euno by clicking **Generate Credentials**. | | **Passphrase** | The passphrase used to decrypt the private key. This value is stored securely and marked as a secret. Leave it blank if the private key is not encrypted. | | **Generate Credentials** | Automatically generate an RSA key pair and passphrase. The public key will be shown in a modal for you to paste into your Snowflake user; the private key and passphrase will be filled into the form and stored securely. This is convenient for quick testing or POCs, but for production we recommend supplying keys generated and managed according to your security policies. | | **Role** | The Snowflake role to use. If the Snowflake user has a default role, you can keep this blank. | | **Warehouse** | The Snowflake warehouse to use for queries. If the Snowflake user has a default warehouse, you can keep this blank. | | **Query history table**\* | By default, Euno uses `snowflake.account_usage.query_history` to access Snowflake query history. If you prefer to use a different table or view, enter it here. See [Using a non-default query history view](#using-a-non-default-query-history-view). | | **Cost per credit (USD)** | The credit price paid to Snowflake. This is used to calculate table activity costs. | | **Storage cost per TB (USD)** | The monthly storage rate in USD per terabyte, used to estimate storage costs for Snowflake tables. | | **Observe warehouse information** | Enable this option to observe Snowflake warehouse information on the `snowflake_account` resource. | ### Step 3: Schedule 1. Toggle Schedule to activate updates. 2. Configure: 1. **Weekly**: Select the days and times for updates. 2. **Hourly**: Set the interval in hours (e.g., every 12 hours). ### Step 4: Resource Cleanup To keep your data relevant and free of outdated resources, Euno provides automatic **resource cleanup** options. These settings determine when a resource should be removed if it is no longer detected by a source integration. For a detailed explanation on Euno's cleanup strategies, see: [Resource Sponsorship in Euno](https://docs.euno.ai/reference/resource-sponsorship-and-cleanup-in-euno). * **Immediate Cleanup**: Remove resources not detected in the most recent successful source integration run. * **No Cleanup**: Keep all resources indefinitely, even if they are no longer detected. ### Step 5: Advanced Settings Click on the '**Advanced**' section to display these additional configurations. | Configuration | Description | | ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Skip SSL verification** | Skip SSL verification. This is used in cases where Euno accesses Snowflake through a proxy. We recommend leaving this unchecked. | | **Auto discover views & tables metadata** | Enable auto-discovery of Snowflake views and tables metadata. | | **Auto discover materialized views refresh history** | Enable discovery of Snowflake materialized view refresh history. This feature is only available for Snowflake Enterprise edition. | | **Use Snowflake system database to collect views metadata** | Use `snowflake.account_usage.views` to discover Snowflake views. If you prefer not to grant metadata access for all databases, see [Control which views metadata Euno has access to](#control-which-views-metadata-euno-has-access-to). | | **Auto discover Hex usage** | Discover Hex projects that query Snowflake and extract Snowflake lineage for those projects. For more information, see [Hex Usage & Lineage Tracking](#hex-usage-and-lineage-tracking). | | **Auto discover Sigma usage** | Discover Sigma workbook, element, and data model usage from Snowflake query history. | | **Override Host URI** | Overrides the base URI used for generating resource URIs for databases, schemas, tables, views, semantic views, and columns. By default, Euno uses the host provided in the integration. | | **Database mapping** | Map Snowflake database names to alternative names in Euno. | | **Schema Pattern** | Use regular expressions to include or exclude specific `database.schema` combinations, such as `MY_DB\.PUBLIC`. | | **Observe Inbound Snowflake Shares** | Observe inbound Snowflake shares. This requires the `IMPORT SHARE` privilege. | | **Outbound Shares** | Configure outbound shares manually by share name and database name. | | **Extract column-level lineage from query history** | Extract column-level lineage from Snowflake `access_history`. | | **Extract column-level read usage** | Extract per-column read usage metrics from Snowflake `access_history`. This requires Snowflake Enterprise edition. | For Snowflake shares related configuration, see [Observing Snowflake Shares](/sources/data-warehouses/snowflake-integration/observing-snowflake-shares-and-cross-snowflake-account.md). #### Run report warning: database missing from metadata crawl If a database appears in access/query history but not in the metadata crawl, Euno can observe its tables by reference only. Table-level lineage may still appear, but field-level lineage will be missing. To fix this, either: * grant the Snowflake role used by Euno metadata visibility for the affected database * update the Snowflake integration settings so the database is included in the metadata crawl ### Step 6: Save Configuration Click **Test & Save** to complete the setup. ## What Euno Discovers * Snowflake account, databases, and schemas * Snowflake tables, views, materialized views, temporary tables, and columns * Snowflake semantic views, metrics, and dimensions * Snowflake inbound and outbound shares * Usage, cost, storage, lineage, and optional column usage metrics * Hex projects and lineage detected from Snowflake query history *** #### Using a non-default query history view By default, Euno uses the system view `snowflake.account_usage.query_history` to discover the query history. You might prefer, for security reasons, to limit the rows or columns that Euno integration has access to. In that case, you can manually create a Snowflake view to expose a subset of the query history. In order for Euno to use this non-default Snowflake view, the following columns, available in `snowflake.account_usage.query_history`, must be exposed by the view: * query\_tag * total\_elapsed\_time * bytes\_scanned * start\_time * end\_time * query\_type Make sure you grant Euno permissions to SELECT on this view. Below is an example of creating such a view, and excluding records that were initiated by the user `PRIVATE_USER` ```sql CREATE OR REPLACE VIEW user.public.query_history_for_euno AS ( SELECT query_tag, total_elapsed_time, start_time, end_time, bytes_scanned, query_type FROM snowflake.account_usage.query_history WHERE user_name != 'PRIVATE_USER' ); GRANT SELECT ON VIEW user.public.query_history_for_euno TO ROLE euno_role; ``` #### Control which views metadata Euno has access to By default, the Euno integration uses the system view `snowflake.account_usage.views` to discover all Snowflake views defined in the snowflake account. In some environments, users may prefer to grant the Euno integration access to read the metadata of views defined in specific databases, rather than to all the databases in the Snowflake account. To set up Euno this way, follow these steps: 1. Grant the Snowflake role used by Euno access to the metadata of views defined in the needed database. For example, to grant the Snowflake role `euno_role` access to the metadata of views defined in the database `example_database`, execute: ```sql GRANT USAGE ON DATABASE example_database TO ROLE euno_role; GRANT USAGE ON ALL SCHEMAS IN DATABASE example_database TO ROLE euno_role; GRANT REFERENCES ON ALL VIEWS IN DATABASE example_database TO ROLE euno_role; GRANT USAGE ON FUTURE SCHEMAS IN DATABASE example_database TO ROLE euno_role; GRANT REFERENCES ON FUTURE VIEWS IN DATABASE example_database TO ROLE euno_role; ``` {% hint style="success" %} These privileges do not provide the `euno_role` with access to the data in these views, only to the metadata. To read more about these privileges, see: * [`usage` privilege on Snowflake databases](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#database-privileges) * [`usage` privilege on Snowflake schema](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#schema-privileges) * [`references` privilege on Snowflake views](https://docs.snowflake.com/en/user-guide/security-access-control-privileges#view-privileges) {% endhint %} 2. Uncheck the box "Use Snowflake system database to query for Snowflake views" in the integration configuration. #### Granting Euno access to the definitions of Snowflake Semantic Views In order to get the complete definition of Snowflake Semantic Views, Euno requires the `REFERENCES` and `USAGE` privileges. This is a database-level permission, so it needs to be granted in each database where semantic views are defined. 
-- For every relevant database
GRANT REFERENCES ON ALL SEMANTIC VIEWS IN DATABASE <database_name> TO ROLE euno_role;
GRANT REFERENCES ON FUTURE SEMANTIC VIEWS IN DATABASE <database_name> TO ROLE euno_role;
GRANT USAGE ON DATABASE <database_name> TO ROLE euno_role;
GRANT USAGE ON ALL SCHEMAS IN DATABASE <database_name> TO ROLE euno_role;
GRANT USAGE ON FUTURE SCHEMAS IN DATABASE <database_name> TO ROLE euno_role;
If your setup has semantic views spanning multiple databases, you can consider using the following SQL script to grant these permissions in every database. This script will iterate over all the available databases (ignoring applications, imported databases and personal databases), and grant the above permissions in each one to `EUNO_ROLE`. Make sure you change the role name in the script.
```sql DECLARE v_db STRING; c1 CURSOR FOR ( SELECT DATABASE_NAME FROM INFORMATION_SCHEMA.DATABASES WHERE DATABASE_NAME NOT IN ('SNOWFLAKE', 'SNOWFLAKE_SAMPLE_DATA') ); BEGIN FOR rec IN c1 DO v_db := rec.DATABASE_NAME; BEGIN -- Existing semantic views EXECUTE IMMEDIATE 'GRANT REFERENCES ON ALL SEMANTIC VIEWS IN DATABASE ' || v_db || ' TO ROLE EUNO_ROLE'; -- Future semantic views EXECUTE IMMEDIATE 'GRANT REFERENCES ON FUTURE SEMANTIC VIEWS IN DATABASE ' || v_db || ' TO ROLE EUNO_ROLE'; -- Usage EXECUTE IMMEDIATE 'GRANT USAGE ON DATABASE ' || v_db || ' TO ROLE EUNO_ROLE'; EXECUTE IMMEDIATE 'GRANT USAGE ON ALL SCHEMAS IN DATABASE ' || v_db || ' TO ROLE EUNO_ROLE'; EXECUTE IMMEDIATE 'GRANT USAGE ON FUTURE SCHEMAS IN DATABASE ' || v_db || ' TO ROLE EUNO_ROLE'; EXCEPTION WHEN OTHER THEN -- Skip unsupported databases types IF (SQLERRM LIKE '%imported database%' OR SQLERRM LIKE '%IMPORTED PRIVILEGES%' OR SQLERRM LIKE '%personal database%' OR SQLERRM LIKE '%APPLICATION%' OR SQLERRM LIKE '%Operation not supported%') THEN NULL; ELSE -- Re-raise other errors RAISE; END IF; END; END FOR; END; ``` #### Hex Usage & Lineage Tracking When "Discover Hex usage" is enabled, the Snowflake integration automatically observes lineage data from Hex queries executed against Snowflake. **What is observed:** * **Hex Projects**: Discovery of Hex projects that execute queries against Snowflake * **Project Lineage**: Which Snowflake tables and columns are accessed by each Hex project **How it works:** Hex embeds metadata in SQL query comments when executing queries against Snowflake. This metadata includes: * Project ID and name * User email * Cell ID (for tracking specific notebook cells) The Snowflake integration parses these comments from the query history and correlates them with table access information to provide comprehensive lineage tracking of Hex activities. **Requirements:** * Hex queries must include metadata comments (this is automatic for standard Hex usage) * The Snowflake role must have access to `snowflake.account_usage.query_history` and `snowflake.account_usage.access_history` * The integration must have permissions to read query history data * The Snowflake instance needs to allow connections from Euno's public IP address in `35.224.29.172` This feature helps organizations understand which Hex analytics projects are accessing their Snowflake resources and track data lineage from Hex to Snowflake tables. --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.euno.ai/sources/data-warehouses/snowflake-integration.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.