## Permissions URL: https://docs.atlan.com/apps/connectors/data-warehouses/snowflake/references/permissions > Full SQL grant reference for both Snowflake extraction methods—account usage and information schema—including permissions for optional object types Full SQL grants the Atlan service account needs to crawl Snowflake metadata. Run these after completing [Snowflake setup](https://docs.atlan.com/llms/connectors/snowflake/set-up-snowflake/llms.txt). :::warning Verify that all the assets you'd like to crawl are present in your grants by [checking the grants](https://docs.atlan.com/llms/connectors/snowflake/troubleshooting-snowflake-connectivity/llms.txt) on the user role defined for the crawler. ::: ## Choose extraction method {#choose-extraction-method} Atlan supports two methods for fetching metadata from Snowflake. Choose one and grant the corresponding permissions below. | | Account usage | Information schema | | --- | --- | --- | | **Overview** | Simplified grants but some limitations in functionality | Most comprehensive approach, more grant management required | | **Method** | Views in the `SNOWFLAKE` database that display object metadata and usage metrics for your account | System-defined views and table functions that provide extensive metadata for objects created in your account | | **Permissions** | User role and account, single grant for `SNOWFLAKE` database | User role and account, multiple grants per database | | **Data latency** | 45 minutes to 3 hours (varies by view) | None | | **Historical data retention** | 1 year | 7 days to 6 months (varies by view or table function) | | **Asset extraction** | `ACCOUNT_USAGE` schema | `INFORMATION_SCHEMA` schema | | **View lineage** | `ACCOUNT_USAGE` schema | `INFORMATION_SCHEMA` schema | | **Table lineage** | `ACCOUNT_USAGE` schema | `ACCOUNT_USAGE` schema | | **Tag import** | `ACCOUNT_USAGE` schema | `ACCOUNT_USAGE` schema | | **Usage and popularity** | `ACCOUNT_USAGE` schema | `ACCOUNT_USAGE` schema | | **Metadata extraction time** | Varies by warehouse size. For example, 8 minutes for 10 million assets (recommended for extracting a large number of assets) | Varies by warehouse size. For example, 2+ hours for 10 million assets | | **Extraction limitations** | External table location data, and primary & foreign keys | Stored Procedures | ## Grant permissions ### Account usage This method uses views in `SNOWFLAKE.ACCOUNT_USAGE` (or a copied version of this schema) to fetch metadata. :::warning If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time. ::: ### Crawl assets, generate lineage, and import tags Snowflake [stores all tag objects](https://docs.snowflake.com/en/user-guide/object-tagging#discover-tags) in the `ACCOUNT_USAGE` schema. If you've [configured the Snowflake miner](https://docs.atlan.com/llms/connectors/snowflake/mine-snowflake/llms.txt), the same permissions apply for [importing tags](https://docs.atlan.com/llms/connectors/snowflake/manage-snowflake-tags/llms.txt). Note that object tagging requires [Enterprise Edition or higher](https://docs.snowflake.com/en/user-guide/intro-editions#feature-edition-matrix). - To use the default `SNOWFLAKE` database and `ACCOUNT_USAGE` schema: ```sql USE ROLE ACCOUNTADMIN; GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE atlan_user_role; ``` `ACCOUNTADMIN` is required because only that role can access the `SNOWFLAKE` database by default. Granting `IMPORTED PRIVILEGES` lets other roles access the database, schemas, and views. - For a least-privilege alternative, grant the three Snowflake system database roles instead of `IMPORTED PRIVILEGES`: ```sql GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER TO ROLE atlan_user_role; GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE atlan_user_role; GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE atlan_user_role; ``` These three database roles combined provide the minimum access Atlan needs from the `SNOWFLAKE` database. - To use a copied or cloned version of this schema (where you can remove sensitive data): ```sql GRANT USAGE ON DATABASE "" TO ROLE atlan_user_role; GRANT USAGE ON SCHEMA "" IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL VIEWS IN DATABASE "" TO ROLE atlan_user_role; ``` Replace `` with the copied database name and `` with the copied `ACCOUNT_USAGE` schema name. These grants can't be used on the original `SNOWFLAKE` database—Snowflake doesn't support granular grants on imported databases. When using a clone, verify that the table and view definitions remain unchanged from the original. ### Crawl streams - To crawl current database streams: ```sql GRANT USAGE ON DATABASE "" TO ROLE atlan_user_role; GRANT USAGE ON ALL SCHEMAS IN DATABASE "" TO ROLE atlan_user_role; GRANT REFERENCES ON ALL TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL STREAMS IN DATABASE "" TO ROLE atlan_user_role; ``` Replace `` with the Snowflake database name. - To crawl cross-database streams (where the base table is in a different database than the stream object): ```sql GRANT USAGE ON DATABASE "" TO ROLE atlan_user_role; GRANT USAGE ON SCHEMA "." TO ROLE atlan_user_role; GRANT REFERENCES ON TABLE ".." TO ROLE DB_TEST_ROLE; ``` Replace `` with the base table's database name, `` with the base table's schema name, and `` with the base table name. - To crawl future streams: ```sql GRANT USAGE ON FUTURE SCHEMAS IN DATABASE "" TO ROLE atlan_user_role; GRANT REFERENCES ON FUTURE TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE STREAMS IN DATABASE "" TO ROLE atlan_user_role; ``` Replace `` with the Snowflake database name. ### (Optional) Preview and query existing assets ```sql GRANT USAGE ON DATABASE "" TO ROLE atlan_user_role; GRANT USAGE ON ALL SCHEMAS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL EXTERNAL TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL STREAMS IN DATABASE "" TO ROLE atlan_user_role; GRANT MONITOR ON PIPE "" TO ROLE atlan_user_role; ``` Replace `` with the database you want to preview and query in Atlan. Repeat for every database. ### (Optional) Preview and query future assets ```sql GRANT USAGE ON FUTURE SCHEMAS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE EXTERNAL TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE STREAMS IN DATABASE "" TO ROLE atlan_user_role; GRANT MONITOR ON FUTURE PIPES IN DATABASE "" TO ROLE atlan_user_role; ``` Replace `` with the database you want to preview and query in Atlan. Repeat for every database. ### Information schema This method uses views in the `INFORMATION_SCHEMA` schema in each Snowflake database to fetch metadata. :::info **Did you know?** The statements on this page apply to all schemas, tables, and views in a database. To limit access to specific objects, specify them individually instead. ::: ### Crawl existing assets :::warning Important The information schema method doesn't support crawling stored procedures because it requires `USAGE` or `OWNERSHIP` privileges on the procedures, which are high-level permissions. ::: - Grant permissions to crawl existing assets: ```sql GRANT USAGE ON DATABASE "" TO ROLE atlan_user_role; GRANT USAGE ON ALL SCHEMAS IN DATABASE "" TO ROLE atlan_user_role; GRANT REFERENCES ON ALL TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT REFERENCES ON ALL EXTERNAL TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT REFERENCES ON ALL VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT REFERENCES ON ALL MATERIALIZED VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL STREAMS IN DATABASE "" TO ROLE atlan_user_role; GRANT MONITOR ON PIPE "" TO ROLE atlan_user_role; ``` Replace `` with the database you want in Atlan. Repeat for every database. - Grant permissions to crawl functions: ```sql GRANT USAGE ON ALL FUNCTIONS IN DATABASE "" TO ROLE atlan_user_role; ``` Replace `` with the database you want in Atlan. Repeat for every database. - For secure user-defined functions (UDFs), grant `OWNERSHIP` to retrieve metadata: ```sql GRANT OWNERSHIP ON FUNCTION ..(, , ...) TO ROLE ; ``` Replace `` with the database containing the UDF, `` with the schema containing the UDF, `` with the name of the secure UDF, ``, ``, ... with the actual argument-type signature of the UDF and `` with the role that gets assigned ownership. ### Crawl future assets - To grant permissions at a database level: ```sql GRANT USAGE ON FUTURE SCHEMAS IN DATABASE "" TO ROLE atlan_user_role; GRANT REFERENCES ON FUTURE TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT REFERENCES ON FUTURE EXTERNAL TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT REFERENCES ON FUTURE VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT REFERENCES ON FUTURE MATERIALIZED VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE STREAMS IN DATABASE "" TO ROLE atlan_user_role; GRANT MONITOR ON FUTURE PIPES IN DATABASE "" TO ROLE atlan_user_role; GRANT USAGE ON FUTURE FUNCTIONS IN DATABASE "" TO ROLE atlan_user_role; ``` Replace `` with the database you want to crawl in Atlan. Repeat for every database. :::warning For any future grants defined at a schema level to a different role, the schema-level grants take precedence over database-level grants—future grants defined at a database level to the Atlan role get ignored. To learn more, refer to [Snowflake documentation](https://docs.snowflake.com/en/sql-reference/sql/grant-privilege#future-grants-on-database-or-schema-objects). ::: - To grant permissions at a schema level: ```sql GRANT REFERENCES ON FUTURE TABLES IN SCHEMA "." TO ROLE atlan_user_role; GRANT REFERENCES ON FUTURE EXTERNAL TABLES IN SCHEMA "." TO ROLE atlan_user_role; GRANT REFERENCES ON FUTURE VIEWS IN SCHEMA "." TO ROLE atlan_user_role; GRANT REFERENCES ON FUTURE MATERIALIZED VIEWS IN SCHEMA "." TO ROLE atlan_user_role; GRANT SELECT ON FUTURE STREAMS IN SCHEMA "." TO ROLE atlan_user_role; GRANT MONITOR ON FUTURE PIPES IN SCHEMA "." TO ROLE atlan_user_role; ``` Replace `` with the database and `` with the schema you want to crawl in Atlan. Repeat for every database and schema. ### Mine query history for lineage - To mine query history directly from Snowflake's internal tables: ```sql USE ROLE ACCOUNTADMIN; GRANT IMPORTED PRIVILEGES ON DATABASE snowflake TO ROLE atlan_user_role; ``` - To mine query history from a cloned or copied set of tables (where you can remove sensitive data): ```sql GRANT USAGE ON DATABASE "" TO ROLE atlan_user_role; GRANT USAGE ON SCHEMA ""."" TO ROLE atlan_user_role; GRANT SELECT ON ALL TABLES IN SCHEMA ""."" TO ROLE atlan_user_role; GRANT SELECT ON ALL VIEWS IN SCHEMA ""."" TO ROLE atlan_user_role; ``` Replace `` with the name of the cloned database and `` with the name of the cloned schema. When using a clone, verify that the table and view definitions remain unchanged from the original. ### (Optional) Preview and query existing assets ```sql GRANT USAGE ON DATABASE "" TO ROLE atlan_user_role; GRANT USAGE ON ALL SCHEMAS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL EXTERNAL TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL MATERIALIZED VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL STREAMS IN DATABASE "" TO ROLE atlan_user_role; GRANT MONITOR ON PIPE "" TO ROLE atlan_user_role; ``` Replace `` with the database you want to preview and query in Atlan. Repeat for every database. ### (Optional) Preview and query future assets ```sql GRANT USAGE ON FUTURE SCHEMAS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE EXTERNAL TABLES IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON FUTURE STREAMS IN DATABASE "" TO ROLE atlan_user_role; GRANT MONITOR ON FUTURE PIPES IN DATABASE "" TO ROLE atlan_user_role; ``` Replace `` with the database you want to preview and query in Atlan. Repeat for every database. :::warning For any future grants defined at a schema level to a different role, the schema-level grants take precedence over database-level grants. To learn more, refer to [Snowflake documentation](https://docs.snowflake.com/en/sql-reference/sql/grant-privilege#future-grants-on-database-or-schema-objects). ::: - To grant permissions at a schema level: ```sql GRANT SELECT ON FUTURE TABLES IN SCHEMA "." TO ROLE atlan_user_role; GRANT SELECT ON FUTURE EXTERNAL TABLES IN SCHEMA "." TO ROLE atlan_user_role; GRANT SELECT ON FUTURE VIEWS IN SCHEMA "." TO ROLE atlan_user_role; GRANT SELECT ON FUTURE MATERIALIZED VIEWS IN SCHEMA "." TO ROLE atlan_user_role; GRANT SELECT ON FUTURE STREAMS IN SCHEMA "." TO ROLE atlan_user_role; GRANT MONITOR ON FUTURE PIPES IN SCHEMA "." TO ROLE atlan_user_role; ``` Replace `` with the database and `` with the schema you want to preview and query in Atlan. Repeat for every database and schema. ### (Optional) Import Snowflake tags Snowflake [stores all tag objects](https://docs.snowflake.com/en/user-guide/object-tagging#discover-tags) in the `ACCOUNT_USAGE` schema. Object tagging requires [Enterprise Edition or higher](https://docs.snowflake.com/en/user-guide/intro-editions#feature-edition-matrix). To [import tags from Snowflake](https://docs.atlan.com/llms/connectors/snowflake/manage-snowflake-tags/llms.txt): - To use the default `SNOWFLAKE` database and `ACCOUNT_USAGE` schema: ```sql USE ROLE ACCOUNTADMIN; GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE atlan_user_role; ``` `ACCOUNTADMIN` is required because only that role can access the `SNOWFLAKE` database by default. - For a least-privilege alternative, grant the three Snowflake system database roles instead of `IMPORTED PRIVILEGES`: ```sql GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER TO ROLE atlan_user_role; GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE atlan_user_role; GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER TO ROLE atlan_user_role; ``` These three database roles combined provide the minimum access Atlan needs from the `SNOWFLAKE` database. - To use a copied or cloned version of this schema: ```sql GRANT USAGE ON DATABASE "" TO ROLE atlan_user_role; GRANT USAGE ON SCHEMA "" IN DATABASE "" TO ROLE atlan_user_role; GRANT SELECT ON ALL VIEWS IN DATABASE "" TO ROLE atlan_user_role; ``` Replace `` with the copied database name and `` with the copied `ACCOUNT_USAGE` schema name. These grants can't be used on the original `SNOWFLAKE` database. ### (Optional) Push updated tags to Snowflake To [push tags updated in Atlan back to Snowflake](https://docs.atlan.com/llms/connectors/snowflake/manage-snowflake-tags/llms.txt): ```sql GRANT APPLY TAG ON ACCOUNT TO ROLE ; ``` Learn more about tag privileges in [Snowflake documentation](https://docs.snowflake.com/en/user-guide/object-tagging#managing-tags). ## Optional object types These permissions are additional grants for specific Snowflake object types. Add them to whichever extraction method you've chosen. ### Crawl dynamic tables Atlan fetches metadata for dynamic tables using the `MONITOR` privilege. Refer to [Snowflake documentation](https://docs.snowflake.com/en/user-guide/dynamic-tables-privileges#privileges-to-view-a-dynamic-table-s-metadata) for details. - To crawl existing dynamic tables at a database level: ```sql GRANT MONITOR ON ALL DYNAMIC TABLES IN DATABASE "" TO ROLE atlan_user_role; ``` - To crawl existing dynamic tables at a schema level: ```sql GRANT MONITOR ON ALL DYNAMIC TABLES IN SCHEMA "." TO ROLE atlan_user_role; ``` - To crawl future dynamic tables at a database level: ```sql GRANT MONITOR ON FUTURE DYNAMIC TABLES IN DATABASE "" TO ROLE atlan_user_role; ``` - To crawl future dynamic tables at a schema level: ```sql GRANT MONITOR ON FUTURE DYNAMIC TABLES IN SCHEMA "." TO ROLE atlan_user_role; ``` Replace `` with the database and `` with the schema. Repeat for every database and schema. ### Crawl Iceberg tables :::info Atlan supports fetching metadata for [Iceberg tables](https://docs.snowflake.com/en/user-guide/tables-iceberg) only with the information schema extraction method. ::: - To crawl existing Iceberg tables: ```sql GRANT REFERENCES ON ALL ICEBERG TABLES IN DATABASE TO ROLE atlan_user_role; ``` - To crawl future Iceberg tables: ```sql GRANT REFERENCES ON FUTURE ICEBERG TABLES IN DATABASE TO ROLE atlan_user_role; ``` - To crawl Iceberg catalog metadata: ```sql GRANT USAGE ON INTEGRATION TO ROLE atlan_user_role; ``` :::warning You must first grant permissions to crawl existing Iceberg tables before this integration permission takes effect. Grant permissions to each catalog you want to crawl individually. ::: ### Crawl Snowflake stages Atlan crawls stage metadata using the `USAGE` and `READ` privileges. For more information, see the Snowflake documentation for `INFORMATION_SCHEMA.STAGES`. - To grant `USAGE` and `READ` on all existing stages at a database level: ```sql GRANT USAGE ON ALL STAGES IN DATABASE TO ROLE atlan_user_role; GRANT READ ON ALL STAGES IN DATABASE TO ROLE atlan_user_role; ``` - To grant `USAGE` and `READ` on all future stages at a database level: ```sql GRANT USAGE ON FUTURE STAGES IN DATABASE TO ROLE atlan_user_role; GRANT READ ON FUTURE STAGES IN DATABASE TO ROLE atlan_user_role; ``` Replace `` with the name of your Snowflake database. ### Crawl semantic views To crawl semantic views and their components (logical tables, dimensions, facts, and metrics): - To crawl existing semantic views: ```sql GRANT REFERENCES ON ALL SEMANTIC VIEWS IN DATABASE "" TO ROLE atlan_user_role; ``` - To crawl future semantic views: ```sql GRANT REFERENCES ON FUTURE SEMANTIC VIEWS IN DATABASE "" TO ROLE atlan_user_role; ``` Replace `` with the database you want to crawl. Repeat for every database. :::info **Did you know?** If Atlan doesn't have the required permissions to access semantic views, the crawler skips them—the workflow continues without failing. ::: If you're using the **account usage method**, no additional grants are needed—the `IMPORTED PRIVILEGES` grant on the `SNOWFLAKE` database already covers access to `SNOWFLAKE.ACCOUNT_USAGE.SEMANTIC_VIEWS` and its related views. If you're using a **cloned** version of the `ACCOUNT_USAGE` schema, add this permission to capture the full DDL for semantic view objects: ```sql GRANT REFERENCES ON ALL SEMANTIC VIEWS IN DATABASE "" TO ROLE atlan_user_role; ``` Replace `` with the name of your cloned database. ### Crawl listings and shares For the full grant reference for listings and shares, see [Permissions for Snowflake listings and shares](https://docs.atlan.com/llms/connectors/snowflake/permissions-for-snowflake-listings-and-shares/llms.txt). ## Next step [Crawl Snowflake](https://docs.atlan.com/llms/connectors/snowflake/crawl-snowflake/llms.txt): Configure and run the crawler to extract metadata from Snowflake. ---