Set up Snowflake

||Connect docs via MCP

Who can do this?

You need your Snowflake administrator to run these commands—you may not have access yourself.

Create the Snowflake user and role that Atlan uses to connect, then configure network access. For the full SQL grants Atlan needs to crawl metadata, see the Snowflake permissions reference.

Prerequisites

Before you begin:

• You need ACCOUNTADMIN access in Snowflake to run these commands.
• Choose how Atlan connects to Snowflake: Decide whether to use public IP allowlisting, Private Link, or the self-deployed agent before touching any network configuration.
• Decide which extraction method you'll use (account usage or information schema). You'll grant the corresponding permissions after completing this setup.
• If you're using a private network link, complete that setup first:
  • Set up AWS Private Network Link to Snowflake
  • Set up Azure Private Network Link to Snowflake

Create role in Snowflake

CREATE OR REPLACE ROLE atlan_user_role;
GRANT OPERATE, USAGE ON WAREHOUSE "<warehouse-name>" TO ROLE atlan_user_role;

Replace <warehouse-name> with the default warehouse to use when running the Snowflake crawler.

• OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped.
• USAGE enables Atlan to show or list metadata from Snowflake, which lets the crawler run SHOW queries.

Create user in Snowflake

Choose the authentication method you want to use for the Atlan service account:

Key-pair

See Snowflake's official guide for generating an RSA key-pair. Replace rsa_public_key with your public key and <warehouse-name> with your warehouse:

CREATE USER atlan_user rsa_public_key='MIIBIjANBgkqh...' default_role=atlan_user_role default_warehouse='<warehouse-name>' display_name='Atlan'
TYPE = 'SERVICE'

Learn more about the SERVICE type in Snowflake documentation.

info

Atlan only supports AES-encrypted PKCS#8 private keys with a non-empty passphrase—this is generally recommended as more secure. An empty passphrase results in workflow failures. DES-encrypted PKCS#8 keys fail at connection time with InvalidKeyException: IOException: DER input, Integer tag error.

When generating the key with openssl pkcs8, specify an AES cipher (for example, -v2 aes-256-cbc). To convert an existing DES-encrypted key to AES:

openssl pkcs8 -in des_encrypted_key.p8 -topk8 -v2 aes-256-cbc -out aes_encrypted_key.p8

Refer to Snowflake documentation to learn more.

GRANT ROLE atlan_user_role TO USER atlan_user;

Password

info

Snowflake recommends transitioning away from basic authentication using username and password. Use key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.

Replace <password> and <warehouse-name>:

CREATE USER atlan_user password='<password>' default_role=atlan_user_role default_warehouse='<warehouse-name>' display_name='Atlan'
TYPE = 'LEGACY_SERVICE'

Learn more about the LEGACY_SERVICE type in Snowflake documentation.

GRANT ROLE atlan_user_role TO USER atlan_user;

IdP (Okta) Private preview

This option is only available if Okta is your identity provider. Snowflake supports authenticating natively through Okta:

• Create a user in your identity provider and use federated authentication in Snowflake.
• The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled.

GRANT ROLE atlan_user_role TO USER atlan_user;

Microsoft Entra ID (OAuth) Private preview

To use the OAuth client credentials flow with Microsoft Entra ID (formerly Azure AD):

1. Follow Snowflake's documentation to:

   • Register a new application in Microsoft Entra ID
   • Collect the client ID, tenant ID, and client secret
   • Add the required API permissions

2. In Snowflake, create a security integration:

   CREATE SECURITY INTEGRATION external_oauth_azure_ad
       TYPE = external_oauth
       ENABLED = true
       EXTERNAL_OAUTH_TYPE = azure
       EXTERNAL_OAUTH_ISSUER = '<AZURE_AD_ISSUER>'
       EXTERNAL_OAUTH_JWS_KEYS_URL = '<AZURE_AD_JWS_KEY_ENDPOINT>'
       EXTERNAL_OAUTH_AUDIENCE_LIST = ('<SNOWFLAKE_APPLICATION_ID_URI>')
       EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub'
       EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name';

Replace the placeholders with values from your Azure AD app:

• <AZURE_AD_ISSUER>: your tenant's OAuth 2.0 issuer URL
• <AZURE_AD_JWS_KEY_ENDPOINT>: Azure JWKs URI
• <SNOWFLAKE_APPLICATION_ID_URI>: Application ID URI of the Azure app

3. Create a Snowflake user with a login name that exactly matches the Azure AD client object ID:

   CREATE USER oauth_svc_user
       WITH LOGIN_NAME = '<AZURE_AD_CLIENT_OBJECT_ID>'
       DEFAULT_ROLE = <ROLE>
       DEFAULT_WAREHOUSE = <WAREHOUSE>;

4. Grant the configured role to this user:

   GRANT ROLE <ROLE> TO USER oauth_svc_user;

Next step

Grant Snowflake permissions: Run the SQL grants for your chosen extraction method and any optional object types.

Choose how Atlan connects to Snowflake: Compare public IP allowlisting, Private Link, and the self-deployed agent, and pick the right connectivity method.