Permissions

||Connect docs via MCP

Full SQL grants the Atlan service account needs to crawl Snowflake metadata. Run these after completing Snowflake setup.

warning

Verify that all the assets you'd like to crawl are present in your grants by checking the grants on the user role defined for the crawler.

Choose extraction method

Atlan supports two methods for fetching metadata from Snowflake. Choose one and grant the corresponding permissions below.

	Account usage	Information schema
Overview	Simplified grants but some limitations in functionality	Most comprehensive approach, more grant management required
Method	Views in the SNOWFLAKE database that display object metadata and usage metrics for your account	System-defined views and table functions that provide extensive metadata for objects created in your account
Permissions	User role and account, single grant for SNOWFLAKE database	User role and account, multiple grants per database
Data latency	45 minutes to 3 hours (varies by view)	None
Historical data retention	1 year	7 days to 6 months (varies by view or table function)
Asset extraction	ACCOUNT_USAGE schema	INFORMATION_SCHEMA schema
View lineage	ACCOUNT_USAGE schema	INFORMATION_SCHEMA schema
Table lineage	ACCOUNT_USAGE schema	ACCOUNT_USAGE schema
Tag import	ACCOUNT_USAGE schema	ACCOUNT_USAGE schema
Usage and popularity	ACCOUNT_USAGE schema	ACCOUNT_USAGE schema
Metadata extraction time	Varies by warehouse size. For example, 8 minutes for 10 million assets (recommended for extracting a large number of assets)	Varies by warehouse size. For example, 2+ hours for 10 million assets
Extraction limitations	External table location data, and primary & foreign keys	Stored Procedures

Grant permissions

Account usage

This method uses views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch metadata.

warning

If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.

Crawl assets, generate lineage, and import tags

Snowflake stores all tag objects in the ACCOUNT_USAGE schema. If you've configured the Snowflake miner, the same permissions apply for importing tags. Note that object tagging requires Enterprise Edition or higher.

• To use the default SNOWFLAKE database and ACCOUNT_USAGE schema:

USE ROLE ACCOUNTADMIN;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE atlan_user_role;

ACCOUNTADMIN is required because only that role can access the SNOWFLAKE database by default. Granting IMPORTED PRIVILEGES lets other roles access the database, schemas, and views.

• For a least-privilege alternative, grant the three Snowflake system database roles instead of IMPORTED PRIVILEGES:

GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER TO ROLE atlan_user_role;
GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE atlan_user_role;
GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE atlan_user_role;

These three database roles combined provide the minimum access Atlan needs from the SNOWFLAKE database.

• To use a copied or cloned version of this schema (where you can remove sensitive data):

GRANT USAGE ON DATABASE "<copied-database>" TO ROLE atlan_user_role;
GRANT USAGE ON SCHEMA "<copied-schema>" IN DATABASE "<copied-database>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL VIEWS IN DATABASE "<copied-database>" TO ROLE atlan_user_role;

Replace <copied-database> with the copied database name and <copied-schema> with the copied ACCOUNT_USAGE schema name. These grants can't be used on the original SNOWFLAKE database—Snowflake doesn't support granular grants on imported databases. When using a clone, verify that the table and view definitions remain unchanged from the original.

Crawl streams

• To crawl current database streams:

GRANT USAGE ON DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT USAGE ON ALL SCHEMAS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON ALL TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL STREAMS IN DATABASE "<database-name>" TO ROLE atlan_user_role;

Replace <database-name> with the Snowflake database name.

• To crawl cross-database streams (where the base table is in a different database than the stream object):

GRANT USAGE ON DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT USAGE ON SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON TABLE "<database-name>.<schema-name>.<table-name>" TO ROLE DB_TEST_ROLE;

Replace <database-name> with the base table's database name, <schema-name> with the base table's schema name, and <table-name> with the base table name.

• To crawl future streams:

GRANT USAGE ON FUTURE SCHEMAS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON FUTURE TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE STREAMS IN DATABASE "<database-name>" TO ROLE atlan_user_role;

Replace <database-name> with the Snowflake database name.

(Optional) Preview and query existing assets

GRANT USAGE ON DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT USAGE ON ALL SCHEMAS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL EXTERNAL TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL STREAMS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT MONITOR ON PIPE "<pipe-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database you want to preview and query in Atlan. Repeat for every database.

(Optional) Preview and query future assets

GRANT USAGE ON FUTURE SCHEMAS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE EXTERNAL TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE STREAMS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT MONITOR ON FUTURE PIPES IN DATABASE "<database-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database you want to preview and query in Atlan. Repeat for every database.

Information schema

This method uses views in the INFORMATION_SCHEMA schema in each Snowflake database to fetch metadata.

Did you know?

The statements on this page apply to all schemas, tables, and views in a database. To limit access to specific objects, specify them individually instead.

Crawl existing assets

Important

The information schema method doesn't support crawling stored procedures because it requires USAGE or OWNERSHIP privileges on the procedures, which are high-level permissions.

• Grant permissions to crawl existing assets:

GRANT USAGE ON DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT USAGE ON ALL SCHEMAS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON ALL TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON ALL EXTERNAL TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON ALL VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON ALL MATERIALIZED VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL STREAMS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT MONITOR ON PIPE "<pipe-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database you want in Atlan. Repeat for every database.

• Grant permissions to crawl functions:

GRANT USAGE ON ALL FUNCTIONS IN DATABASE "<database-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database you want in Atlan. Repeat for every database.

• For secure user-defined functions (UDFs), grant OWNERSHIP to retrieve metadata:

GRANT OWNERSHIP ON FUNCTION <schema_name>.<udf_name> TO ROLE <role_name>;

Replace <schema_name> with the schema containing the UDF, <udf_name> with the name of the secure UDF, and <role_name> with the role that gets assigned ownership.

Crawl future assets

• To grant permissions at a database level:

GRANT USAGE ON FUTURE SCHEMAS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON FUTURE TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON FUTURE EXTERNAL TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON FUTURE VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON FUTURE MATERIALIZED VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE STREAMS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT MONITOR ON FUTURE PIPES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT USAGE ON FUTURE FUNCTIONS IN DATABASE "<database-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database you want to crawl in Atlan. Repeat for every database.

warning

For any future grants defined at a schema level to a different role, the schema-level grants take precedence over database-level grants—future grants defined at a database level to the Atlan role get ignored. To learn more, refer to Snowflake documentation.

• To grant permissions at a schema level:

GRANT REFERENCES ON FUTURE TABLES IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON FUTURE EXTERNAL TABLES IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON FUTURE VIEWS IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT REFERENCES ON FUTURE MATERIALIZED VIEWS IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE STREAMS IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT MONITOR ON FUTURE PIPES IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database and <schema-name> with the schema you want to crawl in Atlan. Repeat for every database and schema.

Mine query history for lineage

• To mine query history directly from Snowflake's internal tables:

USE ROLE ACCOUNTADMIN;
GRANT IMPORTED PRIVILEGES ON DATABASE snowflake TO ROLE atlan_user_role;

• To mine query history from a cloned or copied set of tables (where you can remove sensitive data):

GRANT USAGE ON DATABASE "<cloned-database>" TO ROLE atlan_user_role;
GRANT USAGE ON SCHEMA "<cloned-database>"."<cloned-account-usage-schema>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL TABLES IN SCHEMA "<cloned-database>"."<cloned-account-usage-schema>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL VIEWS IN SCHEMA "<cloned-database>"."<cloned-account-usage-schema>" TO ROLE atlan_user_role;

Replace <cloned-database> with the name of the cloned database and <cloned-account-usage-schema> with the name of the cloned schema. When using a clone, verify that the table and view definitions remain unchanged from the original.

(Optional) Preview and query existing assets

GRANT USAGE ON DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT USAGE ON ALL SCHEMAS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL EXTERNAL TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL STREAMS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT MONITOR ON PIPE "<pipe-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database you want to preview and query in Atlan. Repeat for every database.

(Optional) Preview and query future assets

GRANT USAGE ON FUTURE SCHEMAS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE EXTERNAL TABLES IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE STREAMS IN DATABASE "<database-name>" TO ROLE atlan_user_role;
GRANT MONITOR ON FUTURE PIPES IN DATABASE "<database-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database you want to preview and query in Atlan. Repeat for every database.

warning

For any future grants defined at a schema level to a different role, the schema-level grants take precedence over database-level grants. To learn more, refer to Snowflake documentation.

• To grant permissions at a schema level:

GRANT SELECT ON FUTURE TABLES IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE EXTERNAL TABLES IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE VIEWS IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT SELECT ON FUTURE STREAMS IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;
GRANT MONITOR ON FUTURE PIPES IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database and <schema-name> with the schema you want to preview and query in Atlan. Repeat for every database and schema.

(Optional) Import Snowflake tags

Snowflake stores all tag objects in the ACCOUNT_USAGE schema. Object tagging requires Enterprise Edition or higher.

To import tags from Snowflake:

• To use the default SNOWFLAKE database and ACCOUNT_USAGE schema:

USE ROLE ACCOUNTADMIN;
GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE atlan_user_role;

ACCOUNTADMIN is required because only that role can access the SNOWFLAKE database by default.

• For a least-privilege alternative, grant the three Snowflake system database roles instead of IMPORTED PRIVILEGES:

GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER TO ROLE atlan_user_role;
GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE atlan_user_role;
GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE atlan_user_role;

These three database roles combined provide the minimum access Atlan needs from the SNOWFLAKE database.

• To use a copied or cloned version of this schema:

GRANT USAGE ON DATABASE "<copied-database>" TO ROLE atlan_user_role;
GRANT USAGE ON SCHEMA "<copied-schema>" IN DATABASE "<copied-database>" TO ROLE atlan_user_role;
GRANT SELECT ON ALL VIEWS IN DATABASE "<copied-database>" TO ROLE atlan_user_role;

Replace <copied-database> with the copied database name and <copied-schema> with the copied ACCOUNT_USAGE schema name. These grants can't be used on the original SNOWFLAKE database.

(Optional) Push updated tags to Snowflake

To push tags updated in Atlan back to Snowflake:

GRANT APPLY TAG ON ACCOUNT TO ROLE <role-name>;

Learn more about tag privileges in Snowflake documentation.

Optional object types

These permissions are additional grants for specific Snowflake object types. Add them to whichever extraction method you've chosen.

Crawl dynamic tables

Atlan fetches metadata for dynamic tables using the MONITOR privilege. Refer to Snowflake documentation for details.

• To crawl existing dynamic tables at a database level:

GRANT MONITOR ON ALL DYNAMIC TABLES IN DATABASE "<DATABASE_NAME>" TO ROLE atlan_user_role;

• To crawl existing dynamic tables at a schema level:

GRANT MONITOR ON ALL DYNAMIC TABLES IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;

• To crawl future dynamic tables at a database level:

GRANT MONITOR ON FUTURE DYNAMIC TABLES IN DATABASE "<DATABASE_NAME>" TO ROLE atlan_user_role;

• To crawl future dynamic tables at a schema level:

GRANT MONITOR ON FUTURE DYNAMIC TABLES IN SCHEMA "<database-name>.<schema-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database and <schema-name> with the schema. Repeat for every database and schema.

Crawl Iceberg tables

info

Atlan supports fetching metadata for Iceberg tables only with the information schema extraction method.

• To crawl existing Iceberg tables:

GRANT REFERENCES ON ALL ICEBERG TABLES IN DATABASE <database-name> TO ROLE atlan_user_role;

• To crawl future Iceberg tables:

GRANT REFERENCES ON FUTURE ICEBERG TABLES IN DATABASE <database-name> TO ROLE atlan_user_role;

• To crawl Iceberg catalog metadata:

GRANT USAGE ON INTEGRATION <integration-name> TO ROLE atlan_user_role;

warning

You must first grant permissions to crawl existing Iceberg tables before this integration permission takes effect. Grant permissions to each catalog you want to crawl individually.

Crawl Snowflake stages

Atlan crawls stage metadata using the USAGE and READ privileges. For more information, see the Snowflake documentation for INFORMATION_SCHEMA.STAGES.

• To grant USAGE and READ on all existing stages at a database level:

GRANT USAGE ON ALL STAGES IN DATABASE <database_name> TO ROLE atlan_user_role;
GRANT READ ON ALL STAGES IN DATABASE <database_name> TO ROLE atlan_user_role;

• To grant USAGE and READ on all future stages at a database level:

GRANT USAGE ON FUTURE STAGES IN DATABASE <database_name> TO ROLE atlan_user_role;
GRANT READ ON FUTURE STAGES IN DATABASE <database_name> TO ROLE atlan_user_role;

Replace <database_name> with the name of your Snowflake database.

Crawl semantic views

To crawl semantic views and their components (logical tables, dimensions, facts, and metrics):

• To crawl existing semantic views:

GRANT REFERENCES ON ALL SEMANTIC_VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;

• To crawl future semantic views:

GRANT REFERENCES ON FUTURE SEMANTIC_VIEWS IN DATABASE "<database-name>" TO ROLE atlan_user_role;

Replace <database-name> with the database you want to crawl. Repeat for every database.

Did you know?

If Atlan doesn't have the required permissions to access semantic views, the crawler skips them—the workflow continues without failing.

If you're using the account usage method, no additional grants are needed—the IMPORTED PRIVILEGES grant on the SNOWFLAKE database already covers access to SNOWFLAKE.ACCOUNT_USAGE.SEMANTIC_VIEWS and its related views.

If you're using a cloned version of the ACCOUNT_USAGE schema, add this permission to capture the full DDL for semantic view objects:

GRANT REFERENCES ON ALL SEMANTIC_VIEWS IN DATABASE "<copied-database>" TO ROLE atlan_user_role;

Replace <copied-database> with the name of your cloned database.

Crawl listings and shares Private Preview

For the full grant reference for listings and shares, see Permissions for Snowflake listings and shares.

Next step

Crawl Snowflake: Configure and run the crawler to extract metadata from Snowflake.