Snowflake

Connect Snowflake so Data Collections can read governed warehouse data. Snowflake is special-cased in the platform with a dedicated dialog and a workspace-level Snowflake Profiles tab.

Audience: IT (the enabler)

Capability profile

Read-only by design. The platform reads from Snowflake into Data Collections; query mutability defaults to read_only for new connections, and the role you connect with should be a least-privilege analyst role. Set read_write only when a workload genuinely needs to write back.

Who can connect this

Workspace admins and the active team's admin. Non-admins see a hard-block surface that names the admins who can help.

What you need

A Snowflake account identifier in the regional form xy12345.us-east-1.
A warehouse (for example ANALYTICS_WH), an optional default database and schema, and a least-privilege role (for example ANALYST). The platform refuses to save ACCOUNTADMIN.
A Snowflake OAuth security integration that issues refresh tokens. The Profiles tab generates the bootstrap SQL for you.

Profile-first setup. The Snowflake dialog defaults to "Start from a reusable workspace profile". The Profiles article walks through creating one. Reach for manual OAuth in this dialog only when a connection needs account-specific credentials that should not be shared across the workspace.

Connect Snowflake

Open the Snowflake catalog tile

On the Data Sources page's Catalog tab, click Connect on the Snowflake tile when a profile exists, or Set up profile when none is configured yet.

Pick a profile or open manual OAuth

In the Create Snowflake connection dialog, leave Start from a reusable workspace profile checked and pick a profile from Snowflake profile. To bypass profiles, uncheck the box and fill Account, Warehouse, OAuth client ID, and OAuth client secret directly.

Set defaults

Name the connection (admins see this in the Connected tab). Leave Database, Schema, and Role blank to inherit the profile's defaults, or override per connection. Pick Query mutability when running without a profile.

Authorize

Click Connect with profile or Open OAuth popup. Snowflake's authorization page appears in a popup; sign in and grant the requested scopes. The platform stores the refresh token and saves the connection.

Verify

Open the connection's drawer from the Connected tab. Click Run test to round-trip a query. The Status section shows Last sync and Last test; the Readiness tiles show schemas, relations, and profiled counts as discovery progresses.

Required Snowflake privileges

The connecting role needs at least:

USAGE on the warehouse.
USAGE on the database and any schemas the role should see.
SELECT on the tables and views in scope.
USAGE on the OAuth security integration that issues the refresh token.

Grant only what each connection needs. Profiles let you keep a single least-privilege role per environment.

Common errors

Invalid account identifier. Use the regional form xy12345.us-east-1, not the legacy xy12345 form. The dialog placeholder shows the expected shape.
ACCOUNTADMIN cannot be saved as the default role. The platform refuses to save it on a profile. Pick a less-privileged role.
OAuth client X is not authorized. The Snowflake OAuth integration is missing or its OAUTH_REDIRECT_URI does not match the platform callback. Re-run the bootstrap SQL from the Profiles tab.
Warehouse not accessible. The role lacks USAGE on the warehouse. Grant it and click Run test again.
Empty Readiness tiles after Connect. Discovery runs in phases (Structure, Profile bootstrap, Profile backlog). Watch the Status section; the badge moves from Bootstrapping to Ready when the first pass completes.