## Set up Snowflake

URL: https://docs.atlan.com/product/capabilities/governance/data-quality/snowflake/how-tos/set-up-snowflake

> Configure Snowflake to enable data quality monitoring through Atlan.

# Set up Snowflake

This guide walks through configuring Snowflake to work with Atlan's data quality studio by creating the required roles, setting up database objects, and granting the necessary privileges.

## System requirements

Before setting up the integration, make sure you meet the following requirements:

- Snowflake Enterprise or Business Critical edition
- Dedicated Snowflake warehouse for running DQ-related queries

## Before you begin

Data Quality Studio is a paid feature that requires access. You can request access by following the steps below so the team can enable it for you, while you continue setting up Snowflake.

![Enable Data Quality](https://docs.atlan.com/img/product-capabilities/governance/data-quality-studio/request-data-quality-access.png)

1. In your Atlan workspace, click **Settings** from the left menu.

 If you are using the **Old UI (Classic)**, navigate to **Admin** > **Labs** in Atlan.

2. Turn on the **Data Quality** toggle
3. Click **Request Access** when the popup appears

After you request access, the Atlan team reviews and grants access, after which you can proceed to [enable Data Quality for Snowflake](https://docs.atlan.com/llms/governance/data-quality/enable-data-quality/llms.txt).

## Prerequisites

Before you begin, complete the following steps:

- Obtain `ACCOUNTADMIN` role or equivalent administrative privileges in Snowflake
- Identify your dedicated warehouse name for DQ operations
- Have access to create a new Snowflake user for Atlan
- Review [Data Quality permissions](https://docs.atlan.com/llms/governance/data-quality/data-quality-permissions/llms.txt) to understand required privileges

## Set variables

Set the following variables to configure your data quality environment. If you want to enable data quality for multiple Atlan connections on the same Snowflake account, rerun this setup with different values for the variables. A dedicated database is required for each Atlan connection.

- Set primary variables with your environment-specific values:

 ```sql
 -- Replace with your Atlan user name
 SET ATLAN_USER_NAME = '<atlan_user_name>';

 -- Database for DQ objects (customize if needed)
 SET ATLAN_DQ_DATABASE = 'ATLAN_DQ';

 -- Replace with your DQ warehouse name
 SET ATLAN_DQ_WAREHOUSE = '<warehouse-name>';

 -- Admin role for setup (not granted to Atlan user)
 SET DQ_ADMIN_ROLE = 'DQ_ADMIN';

 -- Service role for Atlan operations
 SET ATLAN_DQ_SERVICE_ROLE = 'ATLAN_DQ_SERVICE_ROLE';
 ```

- Set the derived variables that generate the required schema and procedure identifiers without modifying their default values.

 ```sql
 -- Do not modify the variables below:
 SET _SHARED_SCHEMA = (SELECT $ATLAN_DQ_DATABASE || '.SHARED');
 SET _DMFS_SCHEMA = (SELECT $ATLAN_DQ_DATABASE || '.DMFS');
 SET _META_SCHEMA = (SELECT $ATLAN_DQ_DATABASE || '.META');
 SET _STORE_SCHEMA = (SELECT $ATLAN_DQ_DATABASE || '.STORE');
 SET _CORE_SCHEMA = (SELECT $ATLAN_DQ_DATABASE || '.CORE');
 SET _MANAGE_DMF_PROCEDURE = (SELECT $ATLAN_DQ_DATABASE || '.SHARED.MANAGE_DMF');
 ```

## Create roles

Create two roles for the integration:

 ```sql
 -- Create DQ Admin Role
 CREATE ROLE IF NOT EXISTS IDENTIFIER($DQ_ADMIN_ROLE);
 GRANT OPERATE, USAGE ON WAREHOUSE IDENTIFIER($ATLAN_DQ_WAREHOUSE) TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);

 -- Create Atlan Service Role 
 CREATE ROLE IF NOT EXISTS IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT OPERATE, USAGE ON WAREHOUSE IDENTIFIER($ATLAN_DQ_WAREHOUSE) TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 ```

## Create user

Create a dedicated Snowflake user for Atlan following your organization's standards, then grant the service role:

 ```sql
 CREATE USER IF NOT EXISTS IDENTIFIER($ATLAN_USER_NAME);
 GRANT ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE) TO USER IDENTIFIER($ATLAN_USER_NAME);
 ```

## Set up database objects

Create the database, schemas, and stored procedure required for Atlan data quality operations.

1. Create the required database structure:

 ```sql
 -- Create database (customizable via ATLAN_DQ_DATABASE)
 CREATE DATABASE IF NOT EXISTS IDENTIFIER($ATLAN_DQ_DATABASE);

 -- Create schemas
 CREATE SCHEMA IF NOT EXISTS IDENTIFIER($_SHARED_SCHEMA);
 CREATE SCHEMA IF NOT EXISTS IDENTIFIER($_DMFS_SCHEMA);
 CREATE SCHEMA IF NOT EXISTS IDENTIFIER($_META_SCHEMA);
 CREATE SCHEMA IF NOT EXISTS IDENTIFIER($_STORE_SCHEMA);
 CREATE SCHEMA IF NOT EXISTS IDENTIFIER($_CORE_SCHEMA);
 ```

 The database set in `ATLAN_DQ_DATABASE` serves as a container for all objects related to Atlan Data Quality. The `SHARED` schema provides a separate namespace for shared procedures and functions, while the `DMFS` schema is required for custom Data Metric Functions (DMFs).

2. Create stored procedure for DMF management:
 > *View procedure code — see full content on the documentation site.*

3. Transfer ownership to `dq_admin` role: 

 ```sql
 GRANT OWNERSHIP ON DATABASE IDENTIFIER($ATLAN_DQ_DATABASE) TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
 GRANT OWNERSHIP ON SCHEMA IDENTIFIER($_SHARED_SCHEMA) TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
 GRANT OWNERSHIP ON SCHEMA IDENTIFIER($_DMFS_SCHEMA) TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
 GRANT OWNERSHIP ON PROCEDURE IDENTIFIER($_MANAGE_DMF_PROCEDURE)(
 STRING, STRING, STRING, STRING, STRING, STRING, STRING, STRING, BOOLEAN
 ) TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
 ```

## Grant privileges

Grant the necessary permissions to enable data quality operations and maintain proper access control.

:::info Updated permission model
The permission model for data quality has been simplified. The `DQ_ADMIN` role now requires only **SELECT access** on your tables to **evaluate** data quality rules, instead of table owner role grants. This reduces privilege requirements for rule evaluation through Snowflake's `EXECUTE AS ROLE` feature. Existing setups with table owner role grants continue to work.
:::

:::caution Ownership still required to attach DMFs
SELECT alone is sufficient to **evaluate** data quality rules, but **attaching** a Data Metric Function (DMF) to a table or view requires `DQ_ADMIN` to either **own the object** or have the **object's owner role granted** to it. Atlan's `MANAGE_DMF` procedure runs `ALTER VIEW … ADD DATA METRIC FUNCTION … EXECUTE AS ROLE`, and Snowflake rejects this with error `510165` ("EXECUTE AS ROLE not activated") when the role doesn't own the object. In Atlan this surfaces as the generic "Something went wrong while configuring connection settings."

If you hit this error, identify the object's owner with:

```sql
SHOW GRANTS ON VIEW <database-name>.<schema-name>.<view-name>;
-- Or for a table:
SHOW GRANTS ON TABLE <database-name>.<schema-name>.<table-name>;
```

Look for the `OWNERSHIP` privilege row to find the owning role, then apply **one** of the following remediations.

**Option 1 (recommended): Transfer ownership to `DQ_ADMIN` while preserving existing grants.**

```sql
GRANT OWNERSHIP ON VIEW <database-name>.<schema-name>.<view-name>
 TO ROLE IDENTIFIER($DQ_ADMIN_ROLE) COPY CURRENT GRANTS;
```

**Option 2: Grant the existing owner role to `DQ_ADMIN`** so it can act as the owner for `EXECUTE AS ROLE`.

```sql
GRANT ROLE <owner_role> TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
```

Apply this to every table or view you intend to attach DMFs to. The SELECT grants in the steps below remain required for rule evaluation.
:::

1. System privileges: Grant Snowflake system-level permissions to enable data metric functions and monitoring capabilities.

 ```sql
 -- For DQ Admin Role
 GRANT DATABASE ROLE SNOWFLAKE.DATA_METRIC_USER TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);

 -- For Atlan Service Role
 GRANT APPLICATION ROLE SNOWFLAKE.DATA_QUALITY_MONITORING_VIEWER TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT DATABASE ROLE SNOWFLAKE.DATA_METRIC_USER TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT EXECUTE TASK ON ACCOUNT TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT EXECUTE MANAGED TASK ON ACCOUNT TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 ```

2. Database access: Grant Atlan's service role access to the created objects:

 ```sql
 GRANT USAGE ON DATABASE IDENTIFIER($ATLAN_DQ_DATABASE) TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT USAGE ON SCHEMA IDENTIFIER($_SHARED_SCHEMA) TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT USAGE ON SCHEMA IDENTIFIER($_DMFS_SCHEMA) TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT USAGE ON FUTURE FUNCTIONS IN SCHEMA IDENTIFIER($_DMFS_SCHEMA) TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT USAGE ON PROCEDURE IDENTIFIER($_MANAGE_DMF_PROCEDURE)(
 STRING, STRING, STRING, STRING, STRING, STRING, STRING, STRING, BOOLEAN
 ) TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT CREATE SCHEMA ON DATABASE IDENTIFIER($ATLAN_DQ_DATABASE) TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT CREATE TABLE ON SCHEMA IDENTIFIER($_META_SCHEMA) TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT CREATE TABLE ON SCHEMA IDENTIFIER($_STORE_SCHEMA) TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT CREATE TABLE, CREATE STREAM, CREATE FUNCTION, CREATE PROCEDURE, CREATE TASK ON SCHEMA IDENTIFIER($_CORE_SCHEMA) TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 ```

3. **Data access for DQ_ADMIN**: Grant SELECT access on your customer databases to enable data quality monitoring. Replace `<database-name>` with your database names:

 ```sql
 -- Grant database and schema access
 GRANT USAGE ON DATABASE <database-name> TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
 GRANT USAGE ON ALL SCHEMAS IN DATABASE <database-name> TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);

 -- Grant SELECT on tables and views
 GRANT SELECT ON ALL TABLES IN DATABASE <database-name> TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
 GRANT SELECT ON ALL VIEWS IN DATABASE <database-name> TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);

 -- Set up future grants for new objects
 GRANT USAGE ON FUTURE SCHEMAS IN DATABASE <database-name> TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
 GRANT SELECT ON FUTURE TABLES IN DATABASE <database-name> TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
 GRANT SELECT ON FUTURE VIEWS IN DATABASE <database-name> TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);

 -- Grant Snowflake system privileges
 GRANT DATABASE ROLE SNOWFLAKE.DATA_METRIC_USER TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
 GRANT EXECUTE DATA METRIC FUNCTION ON ACCOUNT TO ROLE IDENTIFIER($DQ_ADMIN_ROLE);
 ```

4. **Reference access to tables and views**: Grant access to the service role to reference objects. This doesn't grants access to the actual data inside the objects. 
 * **Database and schema usage**: Enables Atlan to discover and reference objects.
 ```sql
 GRANT USAGE ON DATABASE <database-name> TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT USAGE ON ALL SCHEMAS IN DATABASE <database-name> TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 ```
 - Replace `<database-name>` and `<schema-name>` with your own object names.
 * **Table and view reference access**: Required to attach and execute rules on these objects.
 ```sql
 GRANT REFERENCES ON ALL TABLES IN DATABASE <database-name> TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT REFERENCES ON ALL VIEWS IN DATABASE <database-name> TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 ```
 - Replace `<database-name>` and `<schema-name>` with your own object names.
 * **Dynamic table monitoring** (if you use Dynamic Tables):
 ```sql
 GRANT MONITOR ON ALL DYNAMIC TABLES IN DATABASE <database-name> TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 ```
 - Replace `<database-name>` with your own object name.

 * **Set up future grants** to retain grants when objects are recreated and apply them to new objects automatically. If you define future grants at both database and schema levels, schema-level grants take precedence. For more information, see the Snowflake documentation about [considerations for future grants](https://docs.snowflake.com/en/sql-reference/sql/grant-privilege#considerations).
 ```sql
 GRANT USAGE ON FUTURE SCHEMAS IN DATABASE <database-name> TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT REFERENCES ON FUTURE TABLES IN DATABASE <database-name> TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT REFERENCES ON FUTURE VIEWS IN DATABASE <database-name> TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 GRANT MONITOR ON FUTURE DYNAMIC TABLES IN DATABASE <database-name> TO ROLE IDENTIFIER($ATLAN_DQ_SERVICE_ROLE);
 ```
 - Replace `<database-name>` and `<schema-name>` with your own object names.

 > *If you use schema-level future grants, grant the following to the service role: — see full content on the documentation site.*

## Next steps

* [Enable data quality on connection](https://docs.atlan.com/llms/governance/data-quality/enable-data-quality/llms.txt) - Configure your Snowflake connection for data quality monitoring

## Need help

If you have questions or need assistance with setting up Snowflake for data quality, reach out to Atlan Support by [submitting a support request](https://docs.atlan.com/support/submit-request).

## See also

* [Data quality permissions](https://docs.atlan.com/llms/governance/data-quality/data-quality-permissions/llms.txt) - Understand the required permissions and roles for data quality operations
* [Configure alerts for data quality rules](https://docs.atlan.com/llms/governance/data-quality/configure-alerts/llms.txt) - Set up real-time notifications for rule failures

---