## Set up Snowflake

URL: https://docs.atlan.com/apps/connectors/data-warehouses/snowflake/how-tos/set-up-snowflake

> Create a Snowflake user, role, and permissions so Atlan can connect and crawl your Snowflake metadata

Atlan connects to Snowflake with a dedicated user and role to crawl metadata and build lineage.

:::warning Who can do this?
You need your Snowflake administrator to run these commands—you may not have access yourself.
:::

Create the Snowflake user and role that Atlan uses to connect, then configure network access. For the full SQL grants Atlan needs to crawl metadata, see the [Snowflake permissions reference](https://docs.atlan.com/llms/connectors/snowflake/permissions/llms.txt).

## Prerequisites

Before you begin:

- You need `ACCOUNTADMIN` access in Snowflake to run these commands.
- [Choose how Atlan connects to Snowflake](https://docs.atlan.com/llms/connectors/snowflake/choose-how-atlan-connects-to-snowflake/llms.txt): Decide whether to use public IP allowlisting, Private Link, or the self-deployed agent before touching any network configuration.
- Decide which [extraction method](https://docs.atlan.com/llms/connectors/snowflake/permissions/llms.txt) you'll use (account usage or information schema). You'll grant the corresponding permissions after completing this setup.
- If you're using a private network link, complete that setup first:
 - [Set up AWS Private Network Link to Snowflake](https://docs.atlan.com/llms/connectors/snowflake/set-up-an-aws-private-network-link-to-snowflake/llms.txt)
 - [Set up Azure Private Network Link to Snowflake](https://docs.atlan.com/llms/connectors/snowflake/set-up-an-azure-private-network-link-to-snowflake/llms.txt)

## Create role in Snowflake

```sql
CREATE OR REPLACE ROLE atlan_user_role;
GRANT OPERATE, USAGE ON WAREHOUSE "<warehouse-name>" TO ROLE atlan_user_role;
```

Replace `<warehouse-name>` with the default warehouse to use when [running the Snowflake crawler](https://docs.atlan.com/llms/connectors/snowflake/crawl-snowflake/llms.txt).

- `OPERATE` enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped.
- `USAGE` enables Atlan to show or list metadata from Snowflake, which lets the crawler run `SHOW` queries.

## Create user in Snowflake {#create-user}

Choose the authentication method you want to use for the Atlan service account:

### Key-pair

See [Snowflake's official guide](https://docs.snowflake.com/en/user-guide/key-pair-auth.html) for generating an RSA key-pair. Replace `rsa_public_key` with your public key and `<warehouse-name>` with your warehouse:

```sql
CREATE USER atlan_user rsa_public_key='MIIBIjANBgkqh...' default_role=atlan_user_role default_warehouse='<warehouse-name>' display_name='Atlan'
TYPE = 'SERVICE'
```

Learn more about the `SERVICE` type in [Snowflake documentation](https://docs.snowflake.com/en/sql-reference/sql/create-user#optional-object-properties-objectproperties).

:::info
Atlan only supports **AES-encrypted PKCS#8 private keys** with a non-empty passphrase—this is generally recommended as more secure. An empty passphrase results in workflow failures. DES-encrypted PKCS#8 keys fail at connection time with `InvalidKeyException: IOException: DER input, Integer tag error`.

When generating the key with `openssl pkcs8`, specify an AES cipher (for example, `-v2 aes-256-cbc`). To convert an existing DES-encrypted key to AES:

```bash
openssl pkcs8 -in des_encrypted_key.p8 -topk8 -v2 aes-256-cbc -out aes_encrypted_key.p8
```

Refer to [Snowflake documentation](https://docs.snowflake.com/en/user-guide/key-pair-auth) to learn more.
:::

```sql
GRANT ROLE atlan_user_role TO USER atlan_user;
```

### Password

:::info
Snowflake recommends transitioning away from basic authentication using username and password. Use key-pair authentication for enhanced security. For any existing Snowflake workflows, you can [modify the crawler configuration](https://docs.atlan.com/llms/catalog/connector-capabilities/manage-connectivity/llms.txt) to update the authentication method.
:::

Replace `<password>` and `<warehouse-name>`:

```sql
CREATE USER atlan_user password='<password>' default_role=atlan_user_role default_warehouse='<warehouse-name>' display_name='Atlan'
TYPE = 'LEGACY_SERVICE'
```

Learn more about the `LEGACY_SERVICE` type in [Snowflake documentation](https://docs.snowflake.com/en/sql-reference/sql/create-user#optional-object-properties-objectproperties).

```sql
GRANT ROLE atlan_user_role TO USER atlan_user;
```

IdP (Okta) </>}>

This option is only available if Okta is your identity provider. Snowflake supports [authenticating natively through Okta](https://docs.snowflake.com/en/user-guide/admin-security-fed-auth-use#native-sso-okta-only):

- Create a user in your identity provider and [use federated authentication in Snowflake](https://docs.snowflake.com/en/user-guide/admin-security-fed-auth-use.html#managing-snowflake-user-passwords).
- The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled.

```sql
GRANT ROLE atlan_user_role TO USER atlan_user;
```

Microsoft Entra ID (OAuth) </>}>

To use the OAuth client credentials flow with Microsoft Entra ID (formerly Azure AD):

1. Follow [Snowflake's documentation](https://community.snowflake.com/s/article/Create-External-OAuth-Token-Using-Azure-AD-For-The-OAuth-Client-Itself) to:
 - Register a new application in Microsoft Entra ID
 - Collect the `client ID`, `tenant ID`, and `client secret`
 - Add the required API permissions

2. In Snowflake, create a security integration:

 ```sql
 CREATE SECURITY INTEGRATION external_oauth_azure_ad
 TYPE = external_oauth
 ENABLED = true
 EXTERNAL_OAUTH_TYPE = azure
 EXTERNAL_OAUTH_ISSUER = ''
 EXTERNAL_OAUTH_JWS_KEYS_URL = ''
 EXTERNAL_OAUTH_AUDIENCE_LIST = ('')
 EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub'
 EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name';
 ```

Replace the placeholders with values from your Azure AD app:
 - ``: your tenant's OAuth 2.0 issuer URL
 - ``: Azure JWKs URI
 - ``: Application ID URI of the Azure app

3. Create a Snowflake user with a login name that exactly matches the Azure AD client object ID:

 ```sql
 CREATE USER oauth_svc_user
 WITH LOGIN_NAME = ''
 DEFAULT_ROLE = 
 DEFAULT_WAREHOUSE = ;
 ```

4. Grant the configured role to this user:

 ```sql
 GRANT ROLE TO USER oauth_svc_user;
 ```

## Next step

[Grant Snowflake permissions](https://docs.atlan.com/llms/connectors/snowflake/permissions/llms.txt): Run the SQL grants for your chosen extraction method and any optional object types.

[Choose how Atlan connects to Snowflake](https://docs.atlan.com/llms/connectors/snowflake/choose-how-atlan-connects-to-snowflake/llms.txt): Compare public IP allowlisting, Private Link, and the self-deployed agent, and pick the right connectivity method.

---