Troubleshooting Snowflake connectivity

||Connect docs via MCP

Resolve common Snowflake connectivity issues when integrating Snowflake with Atlan.

Quick index

You see	Most likely cause	Jump to
"The user doesn't have USAGE and OPERATE grants on a warehouse"	Missing warehouse grants for the Atlan role	Missing warehouse grants
"The user doesn't have authorized access to the SNOWFLAKE.ACCOUNT_USAGE database"	Missing imported privileges or database roles	Missing authorized access to SNOWFLAKE.ACCOUNT_USAGE schema
"The user doesn't have usage grants to the databases … and schemas …"	Missing usage grants	Missing usage grants on databases or schemas
"Atlan's current location or network isn't recognized by Snowflake's security settings"	Atlan IP missing from your network policy	Atlan IP not allowlisted
"The username or the password provided … is incorrect"	Wrong credentials	Incorrect credentials
"The role specified in your connection configuration doesn't exist … or your user account doesn't have grant to use this role"	Missing or unauthorized role	Missing or unauthorized role
"The user account … has been locked temporarily"	Too many incorrect login attempts	User account locked
"The warehouse specified in your connection configuration doesn't exist … or your user account doesn't have grant to use this warehouse"	Missing or unauthorized warehouse	Missing or unauthorized warehouse
"The configured user doesn't have usage grants to any database or schema"	No access to non-system databases or schemas	Missing access to non-system databases or schemas
UnknownHostException / "Name or service not known"	Hostname underscore vs hyphen, or DNS	Name or service not known
Auth OK, small crawls OK - large crawl fails with JDBC "communication error," HTTP 404, or broken pipe	Stage-storage traffic blocked	Large crawls fail while test connection passes
"IP not on the list of allowed addresses" / network policy error - sometimes only at certain hours	Wrong or partial allowlist entry	Network policy rejections
Connection times out; endpoint was recently created	Endpoint still pending approval	Endpoint stuck in pending
Worked for months, broke overnight, nothing changed on your side	Egress IP rotation or policy edit	It worked for months, then broke overnight

Missing warehouse grants

Error

The user doesn't have USAGE and OPERATE grants on a warehouse.

Solution

1. Grant warehouse access to the role:

   GRANT OPERATE, USAGE ON WAREHOUSE "<warehouse>" TO ROLE atlan_user_role;

2. Then, confirm that you grant the role to the new user:

   GRANT ROLE atlan_user_role TO USER atlan_user;

---

Missing authorized access to SNOWFLAKE.ACCOUNT_USAGE schema

Error

The user doesn't have authorized access to the SNOWFLAKE.ACCOUNT_USAGE database

Solution

1. Reach out to your account admin to grant imported privileges on the Snowflake database to the role:

   USE ROLE ACCOUNTADMIN;
   GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE atlan_user_role;

   Alternatively, to follow the principle of least privilege, grant only the specific Snowflake database roles that Atlan needs:

   GRANT DATABASE ROLE SNOWFLAKE.OBJECT_VIEWER     TO ROLE atlan_user_role;
   GRANT DATABASE ROLE SNOWFLAKE.GOVERNANCE_VIEWER TO ROLE atlan_user_role;
   GRANT DATABASE ROLE SNOWFLAKE.SECURITY_VIEWER   TO ROLE atlan_user_role;

2. If using a copied database, you'll need to grant the following permissions:

   GRANT USAGE ON DATABASE "<copied-database>" TO ROLE atlan_user_role;
   GRANT USAGE ON SCHEMA "<copied-schema>" IN DATABASE "<copied-database>" TO ROLE atlan_user_role;
   GRANT REFERENCES ON ALL VIEWS IN DATABASE "<copied-database>" TO ROLE atlan_user_role;

---

Missing usage grants on databases or schemas

Error

The user doesn't have usage grants to the databases $missingDatabases and schemas $missingSchemas.

Solution

1. Grant missing permissions listed here for information schema extraction method.

---

Atlan IP not allowlisted

Error

Atlan's current location or network isn't recognized by Snowflake's security settings. This can happen if Atlan's IP address isn't on the list of allowed addresses in Snowflake's network policies.

Solution

1. If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist. GCP tenants can self-serve from that page; AWS and Azure tenants contact Atlan support to obtain their tenant-specific IPs.

---

Incorrect credentials

Error

The username or the password provided to connect to the Snowflake account is incorrect.

Solution

1. Sign into the Snowflake account for the specified host and verify that the username and password are correct.
2. You can also create a new user, if required, by following the steps here.

---

Missing or unauthorized role

Error

The role specified in your connection configuration doesn't exist in Snowflake or your user account doesn't have grant to use this role.

Solution

1. If the role doesn't exist or is missing the required grants, create a role and then grant the role to the user.

---

User account locked

Error

The user account you're using to connect to Snowflake has been locked temporarily because of multiple incorrect login attempts.

Solution

Wait for the user account to unlock or create a different user account to continue.

---

Missing or unauthorized warehouse

Error

The warehouse specified in your connection configuration doesn't exist in Snowflake or your user account doesn't have grant to use this warehouse.

Solution

1. Confirm that the warehouse name is configured correctly.
2. Update the warehouse name in the configuration if your account is using a different warehouse. Create a role and then grant the role to the user for the updated warehouse.

---

Missing access to non-system databases or schemas

Error

The configured user doesn't have usage grants to any database or schema. or The configured user doesn't have usage grants to any non-system database or schema.

Solution

1. This pertains to the information schema method of fetching metadata. Confirm that the user has authorized access to the databases and schemas to be crawled.
2. Grant the requisite permissions as outlined here.

---

Why am I getting "name or service not known" error when connecting via PrivateLink?

Error

java.net.UnknownHostException or "Name or service not known"

You may see this error when connecting to Snowflake over PrivateLink if all of the following are true:

• You are using Snowflake JDBC driver version 3.13.25 or newer
• Your Snowflake account name contains an underscore (_)
• You are connecting via PrivateLink

What's happening?

• The newer Snowflake JDBC driver automatically replaces underscores (_) with hyphens (-) in the hostname.
• For normal (non-PrivateLink) connections, this works because Snowflake accepts both formats.
• For PrivateLink connections, the DNS endpoint only recognizes the original hostname with underscores.
• Because of this mismatch, the hostname can't be resolved and the connection fails.

Solution

1. Update your Snowflake hostname to use hyphens (-) instead of underscores (_).
2. Retry the connection.

Other DNS checks

• Wrong field value. The host field must contain the endpoint DNS name Atlan support returned - not your public Snowflake URL. Compare character-by-character with the value on your ticket.
• Verify resolution. The endpoint DNS resolves only inside Atlan's network - nslookup from your laptop failing is expected and not a fault. To verify the private path end-to-end, use Test connection in Atlan; ask support to run a resolution check from the tenant if it fails.

For more details, refer to the Snowflake JDBC driver 3.13.25 behavior change documentation.

---

Large crawls fail while test connection passes

Error

Test connection and preflight pass. Small crawls succeed. Large crawls or miner runs fail with JDBC "communication error," HTTP status 404, or broken pipe errors.

net.snowflake.client.jdbc.SnowflakeSQLException: JDBC driver encountered
communication error. Message: Error encountered when downloading a result
chunk: HTTP status: 404
-- or: Max retry reached for the download of chunk#0 ... blob.core.windows.net
-- or: java.net.SocketException: Broken pipe ... sfc-prod3-customer-stage.s3...

What's happening?

Snowflake stages large results in its own cloud storage and returns temporary download links. This traffic doesn't use the private link - it goes to *.blob.core.windows.net (Azure-hosted Snowflake) or sfc-*-customer-stage.s3.*.amazonaws.com (AWS-hosted). If that path is blocked, only large results fail.

Solution

1. Azure: complete the internal stage access step in the Azure private network link guide.
2. AWS: confirm nothing on the egress path blocks the stage hostnames.

The query itself succeeded - this is purely a download problem, and it's not a permissions issue.

---

Network policy rejections

Error

"Atlan's current location or network isn't recognized by Snowflake's security settings", or failures that occur only at consistent times of day.

Check yourself

Where do Atlan's connections actually arrive from?

SELECT client_ip, COUNT(*) FROM snowflake.account_usage.login_history
WHERE user_name = 'ATLAN_SERVICE_USER' GROUP BY 1 ORDER BY 2 DESC;

Then compare with the Atlan Network Details page:

• Private link: the policy must contain the private CIDRs (10.x ranges), and the entire published block. Time-of-day failures indicate a partial block (for example a /17 allowlisted where the published range is a /16).
• Public connectivity: the policy must contain the public egress IPs for your tenant's region.
• Check policies attached to the user and the account.

---

Endpoint stuck in pending

Error

Connection times out on a newly created private link.

Check yourself

On the Snowflake side, run:

SELECT SYSTEM$GET_PRIVATELINK_AUTHORIZED_ENDPOINTS();

If Atlan's endpoint is missing: the AUTHORIZE command hasn't run, ran with a mistyped Resource ID, or ran with an expired token. Fix in that order - a fresh token comes from your support ticket in minutes.

---

It worked for months, then broke overnight

Error

Connectivity worked for months, broke overnight, and nothing changed on your side.

Solution

1. Check the Atlan Network Details changelog - did a published value change? (Atlan announces 30 days ahead by email to tenant admins; check spam/distribution lists.)
2. Ask your Snowflake admin whether a network policy was edited - compare SHOW NETWORK POLICIES; output with the published values.
3. Run the login-history check from the network policy rejections section earlier to see the rejected source IP, then map it to the tables on the Atlan Network Details page.

---

Opening ticket that gets solved fast

If you still need support, include these five things - they usually turn a multi-day exchange into one reply:

• Your Atlan tenant URL and the failing workflow run link
• Connectivity method (public / AWS PrivateLink / Azure Private Link) and, for private link, the endpoint DNS in use
• The exact error text from the workflow logs
• Output of the login-history query (last 24 h)
• Whether it ever worked, and if so when it stopped