Set up Snowflake | Atlan Documentation

Grant USAGE and READ privileges on all future stages at the database level: Grant USAGE and READ privileges on all future stages at the database level: Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Allowlist the Atlan IP If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist.


Set up Snowflake | Atlan Documentation

Please raise a support ticket from within Atlan, or submit a request. (If you aren't using the IP allowlist in your Snowflake instance, you can skip this step.) Create user and role in Snowflake Choose metadata fetching method Grant permissions for account usage method Grant permissions for information schema method Allowlist the Atlan IP


Set up Snowflake | Atlan Documentation

You need your Snowflake administrator to run these commands - you may not have access yourself. Create user and role in Snowflake Create a role and user in Snowflake using the following commands: Create role Create a role in Snowflake using the following commands: Replace with the default warehouse to use when running the Snowflake crawler.


Set up Snowflake | Atlan Documentation

Atlan requires the following privileges to: OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped. USAGE enables Atlan to show or list metadata from Snowflake.


Set up Snowflake | Atlan Documentation

This in turn enables the Snowflake crawler to run the SHOW query. Create a user Create a separate user to integrate into Atlan, using one of the following 3 options: See Snowflake's official guide for details on generating an RSA key-pair.


Set up Snowflake | Atlan Documentation

To create a user with a key-pair, replace the value for rsa_public_key with the public key and run the following: Learn more about the SERVICE type property in Snowflake documentation. Atlan only supports encrypted private keys with a non-empty passphrase - generally recommended as more secure.


Set up Snowflake | Atlan Documentation

An empty passphrase results in workflow failures. To generate an encrypted private key, omit the -nocrypt option.


Set up Snowflake | Atlan Documentation

Refer to Snowflake documentation to learn more. Snowflake recommends transitioning away from basic authentication using username and password.


Set up Snowflake | Atlan Documentation

Change to key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.


Set up Snowflake | Atlan Documentation

To create a user with a password, replace and run the following: Learn more about the LEGACY_SERVICE type property in Snowflake documentation. This method is currently only available if Okta is your IdP (Snowflake supports) authenticating natively through Okta : Create a user in your identity provider (IdP) and use federated authentication in Snowflake.


Set up Snowflake | Atlan Documentation

The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled. Grant role to user To grant the atlan_user_role to the new user: Configure OAuth (client credentials flow) with Microsoft Entra ID To configure OAuth authentication using Microsoft Entra ID (formerly Azure AD) with the client credentials flow: Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions In Snowflake, create a security integration using the following: CREATE SECURITY INTEGRATION external_oauth_azure_ad TYPE = external_oauth ENABLED = true EXTERNAL_OAUTH_TYPE = azure EXTERNAL_OAUTH_ISSUER = '\ ' EXTERNAL_OAUTH_JWS_KEYS_URL = '\ ' EXTERNAL_OAUTH_AUDIENCE_LIST = ( '\ ' ) EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub' EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name' ; Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app In Snowflake, create a security integration using the following: Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: CREATE USER oauth_svc_user WITH LOGIN_NAME = '\ ' -- Use Azure client OBJECT ID DEFAULT_ROLE = \ DEFAULT_WAREHOUSE = \ ; Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: Grant the configured role to this user: GRANT ROLE \ TO USER oauth_svc_user ; Grant the configured role to this user: Choose metadata fetching method Atlan supports two methods for fetching metadata from Snowflake - account usage and information schema.


Set up Snowflake | Atlan Documentation

You should choose one of these two methods to set up Snowflake: Grant permissions for account usage method If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.


Set up Snowflake | Atlan Documentation

This method uses the views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch the metadata from Snowflake into Atlan. You can be more granular with permissions using this method, but there are limitations with this approach.


Set up Snowflake | Atlan Documentation

To crawl assets, generate lineage, and import tags If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

If you're using the account usage method to crawl metadata in Atlan or you have configured the Snowflake miner , you need to grant the same permissions to import tags as required for crawling Snowflake assets. Note that object tagging in Snowflake currently requires Enterprise Edition or higher.


Set up Snowflake | Atlan Documentation

To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name. Replace with the copied Snowflake ACCOUNT_USAGE schema name.


Set up Snowflake | Atlan Documentation

The grants for the copied version can't be used on the original SNOWFLAKE database. This is because Snowflake produces an error that granular grants can't be given to imported databases.


Set up Snowflake | Atlan Documentation

When using a cloned or copied version, verify that the table or view definition remains unchanged as in your SNOWFLAKE database. If the format is different.


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. To crawl streams To crawl streams, provide the following permissions: To crawl current streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the Snowflake database name. To crawl future streams: To crawl future streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

(Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions.


Set up Snowflake | Atlan Documentation

Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead. Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. Grant permissions for information schema method This method uses views in the INFORMATION_SCHEMA schema in Snowflake databases to fetch metadata.


Set up Snowflake | Atlan Documentation

You still need to grant specific permissions to enable Atlan to crawl metadata, preview data, and query data with this method. To crawl existing assets Grant these permissions to crawl assets that already exist in Snowflake.


Set up Snowflake | Atlan Documentation

If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Grant permissions to crawl existing assets: Replace with the database you want to be available in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to integrate into Atlan.) Grant permissions to crawl functions: Replace with the database you want to be available in Atlan. (Repeat the statements for every database you wish to integrate into Atlan.) For secure user-defined functions (UDFs), grant OWNERSHIP permissions to retrieve metadata: Replace the placeholders with the appropriate values: : The name of the schema that contains the user-defined function (UDF).


Set up Snowflake | Atlan Documentation

: The name of the secure UDF that requires ownership permissions. : The role that gets assigned ownership of the secure UDF.


Set up Snowflake | Atlan Documentation

The statements given on this page apply to all schemas, tables, and views in a database in Snowflake. If you want to limit access to only certain objects, you can instead specify the exact objects individually as well.


Set up Snowflake | Atlan Documentation

To crawl future assets To crawl assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

To grant permissions at a database level: Replace with the database you want to crawl in Atlan. (Repeat the statements for every database you want to integrate into Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to integrate into Atlan.) To mine query history for lineage To also mine Snowflake's query history (for lineage), add these permissions. You can use either option: To mine query history direct from Snowflake's internal tables: To mine query history from a cloned or copied set of tables, where you can also remove any sensitive data: Replace with the name of the cloned database, and with the name of the cloned schema containing account usage details.


Set up Snowflake | Atlan Documentation


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. (Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you want to preview and query in Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. (Optional) To import Snowflake tags Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

Note that object tagging in Snowflake currently requires Enterprise Edition or higher. To import tags from Snowflake , grant these permissions: To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the copied Snowflake ACCOUNT_USAGE schema name. The grants for the copied version can't be used on the original SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

This is because Snowflake produces an error that granular grants can't be given to imported databases. (Optional) To push updated tags to Snowflake To push tags updated for assets in Atlan to Snowflake , grant these permissions: You can learn more about tag privileges from Snowflake documentation.


Set up Snowflake | Atlan Documentation

(Optional) To crawl dynamic tables Atlan currently supports fetching metadata for dynamic tables using the MONITOR privilege. Refer to Snowflake documentation to learn more.


Set up Snowflake | Atlan Documentation

To crawl existing dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: To crawl future dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan. (Repeat the statements for every database and schema you want to integrate into Atlan.) (Optional) To crawl Iceberg tables Atlan currently supports fetching metadata for Iceberg tables only for the information schema extraction method.


Set up Snowflake | Atlan Documentation

To crawl Iceberg tables from Snowflake, grant the following permissions: To crawl existing Iceberg tables in Snowflake: To crawl future Iceberg tables in Snowflake: To crawl Iceberg catalog metadata for Iceberg tables in Snowflake: You must first grant permissions to crawl existing Iceberg tables for this permission to work on catalogs. You must also grant permissions to all the catalogs you want to crawl in Atlan individually.


Set up Snowflake | Atlan Documentation

(Optional) To crawl Snowflake stages Atlan supports crawling metadata for Snowflake stages using the USAGE and READ privileges. For more information, see the Snowflake documentation for INFORMATION_SCHEMA.STAGES.


Set up Snowflake | Atlan Documentation

To crawl stages from Snowflake: Grant USAGE and READ privileges on all existing stages at the database level: Replace with the name of your Snowflake database Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Replace with the role you've granted Atlan to use for crawling.


Set up Snowflake | Atlan Documentation

Grant USAGE and READ privileges on all future stages at the database level: Grant USAGE and READ privileges on all future stages at the database level: Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Allowlist the Atlan IP If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist.


Set up Snowflake | Atlan Documentation

Please raise a support ticket from within Atlan, or submit a request. (If you aren't using the IP allowlist in your Snowflake instance, you can skip this step.) Create user and role in Snowflake Choose metadata fetching method Grant permissions for account usage method Grant permissions for information schema method Allowlist the Atlan IP


Set up Snowflake | Atlan Documentation

You need your Snowflake administrator to run these commands - you may not have access yourself. Create user and role in Snowflake Create a role and user in Snowflake using the following commands: Create role Create a role in Snowflake using the following commands: Replace with the default warehouse to use when running the Snowflake crawler.


Set up Snowflake | Atlan Documentation

Atlan requires the following privileges to: OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped. USAGE enables Atlan to show or list metadata from Snowflake.


Set up Snowflake | Atlan Documentation

This in turn enables the Snowflake crawler to run the SHOW query. Create a user Create a separate user to integrate into Atlan, using one of the following 3 options: See Snowflake's official guide for details on generating an RSA key-pair.


Set up Snowflake | Atlan Documentation

To create a user with a key-pair, replace the value for rsa_public_key with the public key and run the following: Learn more about the SERVICE type property in Snowflake documentation. Atlan only supports encrypted private keys with a non-empty passphrase - generally recommended as more secure.


Set up Snowflake | Atlan Documentation

An empty passphrase results in workflow failures. To generate an encrypted private key, omit the -nocrypt option.


Set up Snowflake | Atlan Documentation

Refer to Snowflake documentation to learn more. Snowflake recommends transitioning away from basic authentication using username and password.


Set up Snowflake | Atlan Documentation

Change to key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.


Set up Snowflake | Atlan Documentation

To create a user with a password, replace and run the following: Learn more about the LEGACY_SERVICE type property in Snowflake documentation. This method is currently only available if Okta is your IdP (Snowflake supports) authenticating natively through Okta : Create a user in your identity provider (IdP) and use federated authentication in Snowflake.


Set up Snowflake | Atlan Documentation

The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled. Grant role to user To grant the atlan_user_role to the new user: Configure OAuth (client credentials flow) with Microsoft Entra ID To configure OAuth authentication using Microsoft Entra ID (formerly Azure AD) with the client credentials flow: Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions In Snowflake, create a security integration using the following: CREATE SECURITY INTEGRATION external_oauth_azure_ad TYPE = external_oauth ENABLED = true EXTERNAL_OAUTH_TYPE = azure EXTERNAL_OAUTH_ISSUER = '\ ' EXTERNAL_OAUTH_JWS_KEYS_URL = '\ ' EXTERNAL_OAUTH_AUDIENCE_LIST = ( '\ ' ) EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub' EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name' ; Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app In Snowflake, create a security integration using the following: Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: CREATE USER oauth_svc_user WITH LOGIN_NAME = '\ ' -- Use Azure client OBJECT ID DEFAULT_ROLE = \ DEFAULT_WAREHOUSE = \ ; Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: Grant the configured role to this user: GRANT ROLE \ TO USER oauth_svc_user ; Grant the configured role to this user: Choose metadata fetching method Atlan supports two methods for fetching metadata from Snowflake - account usage and information schema.


Set up Snowflake | Atlan Documentation

You should choose one of these two methods to set up Snowflake: Grant permissions for account usage method If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.


Set up Snowflake | Atlan Documentation

This method uses the views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch the metadata from Snowflake into Atlan. You can be more granular with permissions using this method, but there are limitations with this approach.


Set up Snowflake | Atlan Documentation

To crawl assets, generate lineage, and import tags If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

If you're using the account usage method to crawl metadata in Atlan or you have configured the Snowflake miner , you need to grant the same permissions to import tags as required for crawling Snowflake assets. Note that object tagging in Snowflake currently requires Enterprise Edition or higher.


Set up Snowflake | Atlan Documentation

To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name. Replace with the copied Snowflake ACCOUNT_USAGE schema name.


Set up Snowflake | Atlan Documentation

The grants for the copied version can't be used on the original SNOWFLAKE database. This is because Snowflake produces an error that granular grants can't be given to imported databases.


Set up Snowflake | Atlan Documentation

When using a cloned or copied version, verify that the table or view definition remains unchanged as in your SNOWFLAKE database. If the format is different.


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. To crawl streams To crawl streams, provide the following permissions: To crawl current streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the Snowflake database name. To crawl future streams: To crawl future streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

(Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions.


Set up Snowflake | Atlan Documentation

Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead. Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. Grant permissions for information schema method This method uses views in the INFORMATION_SCHEMA schema in Snowflake databases to fetch metadata.


Set up Snowflake | Atlan Documentation

You still need to grant specific permissions to enable Atlan to crawl metadata, preview data, and query data with this method. To crawl existing assets Grant these permissions to crawl assets that already exist in Snowflake.


Set up Snowflake | Atlan Documentation

If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Grant permissions to crawl existing assets: Replace with the database you want to be available in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to integrate into Atlan.) Grant permissions to crawl functions: Replace with the database you want to be available in Atlan. (Repeat the statements for every database you wish to integrate into Atlan.) For secure user-defined functions (UDFs), grant OWNERSHIP permissions to retrieve metadata: Replace the placeholders with the appropriate values: : The name of the schema that contains the user-defined function (UDF).


Set up Snowflake | Atlan Documentation

: The name of the secure UDF that requires ownership permissions. : The role that gets assigned ownership of the secure UDF.


Set up Snowflake | Atlan Documentation

The statements given on this page apply to all schemas, tables, and views in a database in Snowflake. If you want to limit access to only certain objects, you can instead specify the exact objects individually as well.


Set up Snowflake | Atlan Documentation

To crawl future assets To crawl assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

To grant permissions at a database level: Replace with the database you want to crawl in Atlan. (Repeat the statements for every database you want to integrate into Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to integrate into Atlan.) To mine query history for lineage To also mine Snowflake's query history (for lineage), add these permissions. You can use either option: To mine query history direct from Snowflake's internal tables: To mine query history from a cloned or copied set of tables, where you can also remove any sensitive data: Replace with the name of the cloned database, and with the name of the cloned schema containing account usage details.


Set up Snowflake | Atlan Documentation


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. (Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you want to preview and query in Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. (Optional) To import Snowflake tags Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

Note that object tagging in Snowflake currently requires Enterprise Edition or higher. To import tags from Snowflake , grant these permissions: To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the copied Snowflake ACCOUNT_USAGE schema name. The grants for the copied version can't be used on the original SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

This is because Snowflake produces an error that granular grants can't be given to imported databases. (Optional) To push updated tags to Snowflake To push tags updated for assets in Atlan to Snowflake , grant these permissions: You can learn more about tag privileges from Snowflake documentation.


Set up Snowflake | Atlan Documentation

(Optional) To crawl dynamic tables Atlan currently supports fetching metadata for dynamic tables using the MONITOR privilege. Refer to Snowflake documentation to learn more.


Set up Snowflake | Atlan Documentation

To crawl existing dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: To crawl future dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan. (Repeat the statements for every database and schema you want to integrate into Atlan.) (Optional) To crawl Iceberg tables Atlan currently supports fetching metadata for Iceberg tables only for the information schema extraction method.


Set up Snowflake | Atlan Documentation

To crawl Iceberg tables from Snowflake, grant the following permissions: To crawl existing Iceberg tables in Snowflake: To crawl future Iceberg tables in Snowflake: To crawl Iceberg catalog metadata for Iceberg tables in Snowflake: You must first grant permissions to crawl existing Iceberg tables for this permission to work on catalogs. You must also grant permissions to all the catalogs you want to crawl in Atlan individually.


Set up Snowflake | Atlan Documentation

(Optional) To crawl Snowflake stages Atlan supports crawling metadata for Snowflake stages using the USAGE and READ privileges. For more information, see the Snowflake documentation for INFORMATION_SCHEMA.STAGES.


Set up Snowflake | Atlan Documentation

To crawl stages from Snowflake: Grant USAGE and READ privileges on all existing stages at the database level: Replace with the name of your Snowflake database Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Replace with the role you've granted Atlan to use for crawling.


Set up Snowflake | Atlan Documentation

Grant USAGE and READ privileges on all future stages at the database level: Grant USAGE and READ privileges on all future stages at the database level: Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Allowlist the Atlan IP If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist.


Set up Snowflake | Atlan Documentation

Please raise a support ticket from within Atlan, or submit a request. (If you aren't using the IP allowlist in your Snowflake instance, you can skip this step.) Create user and role in Snowflake Choose metadata fetching method Grant permissions for account usage method Grant permissions for information schema method Allowlist the Atlan IP


Manage connectivity | Atlan Documentation

Once you've scheduled or run a workflow you can modify its configuration at any time. The configuration that can be modified may vary by workflow but the general steps remain consistent.


Modify connectivity To modify the configuration of an existing workflow, complete the following steps. On the left of any screen, navigate to Workflow.


Under Monitor select an existing workflow tile. (You may need to expand the run history or filter first.) From the Workflow Run History table, click on the previous run of the workflow you want to modify.


In the upper left of the screen, change to the Config tab. Modify the parts of the workflow configuration you require: Under Credential , use the Edit Credentials button to change the credentials for the source.


danger If you're updating the connection credentials, you may also need to update the metadata filters before running the updated workflow. Atlan currently does not detect changes to your connection settings and update the metadata filters automatically.


Under Connection settings , use the Edit button to change the connection details: Modify whether or not querying or data previews are allowed for the source. Modify the query row limit to enable exporting large query results via email.


Modify the query timeout limit - expandable up to 60 minutes. Under Connection Admins , click the pencil icon to add or remove connection admins.


danger If you do not specify any user or group, nobody will be able to manage the connection - not even admins. Under Metadata , use the selectors to modify which metadata to include and exclude.


To check for any permissions or other configuration issues before running the workflow, click Preflight checks. Under Credential , use the Edit Credentials button to change the credentials for the source.


Under Credential , use the Edit Credentials button to change the credentials for the source. If you're updating the connection credentials, you may also need to update the metadata filters before running the updated workflow.


Atlan currently does not detect changes to your connection settings and update the metadata filters automatically. Under Connection settings , use the Edit button to change the connection details: Modify whether or not querying or data previews are allowed for the source.


Modify the query row limit to enable exporting large query results via email. Modify the query timeout limit - expandable up to 60 minutes.


danger If you do not specify any user or group, nobody will be able to manage the connection - not even admins. Under Connection Admins , click the pencil icon to add or remove connection admins.


If you do not specify any user or group, nobody will be able to manage the connection - not even admins. Under Metadata , use the selectors to modify which metadata to include and exclude.


Under Metadata , use the selectors to modify which metadata to include and exclude. To check for any permissions or other configuration issues before running the workflow, click Preflight checks.


To check for any permissions or other configuration issues before running the workflow, click Preflight checks. Once you've made your updates, click the Update button to save the changes.


You can optionally run the workflow with the new configuration immediately. You will need to confirm your changes by clicking the Yes button.


Note that some workflow changes may take a few minutes to come into effect. You can optionally run the workflow with the new configuration immediately.


You will need to confirm your changes by clicking the Yes button. Note that some workflow changes may take a few minutes to come into effect.


That's it - next time you run the workflow, or it runs on its schedule, it will use your changes! ð If you modify the Metadata portion, any previously crawled metadata that is now excluded will be archived on the next workflow run.


Set up Snowflake | Atlan Documentation

You need your Snowflake administrator to run these commands - you may not have access yourself. Create user and role in Snowflake Create a role and user in Snowflake using the following commands: Create role Create a role in Snowflake using the following commands: Replace with the default warehouse to use when running the Snowflake crawler.


Set up Snowflake | Atlan Documentation

Atlan requires the following privileges to: OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped. USAGE enables Atlan to show or list metadata from Snowflake.


Set up Snowflake | Atlan Documentation

This in turn enables the Snowflake crawler to run the SHOW query. Create a user Create a separate user to integrate into Atlan, using one of the following 3 options: See Snowflake's official guide for details on generating an RSA key-pair.


Set up Snowflake | Atlan Documentation

To create a user with a key-pair, replace the value for rsa_public_key with the public key and run the following: Learn more about the SERVICE type property in Snowflake documentation. Atlan only supports encrypted private keys with a non-empty passphrase - generally recommended as more secure.


Set up Snowflake | Atlan Documentation

An empty passphrase results in workflow failures. To generate an encrypted private key, omit the -nocrypt option.


Set up Snowflake | Atlan Documentation

Refer to Snowflake documentation to learn more. Snowflake recommends transitioning away from basic authentication using username and password.


Set up Snowflake | Atlan Documentation

Change to key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.


Set up Snowflake | Atlan Documentation

To create a user with a password, replace and run the following: Learn more about the LEGACY_SERVICE type property in Snowflake documentation. This method is currently only available if Okta is your IdP (Snowflake supports) authenticating natively through Okta : Create a user in your identity provider (IdP) and use federated authentication in Snowflake.


Set up Snowflake | Atlan Documentation

The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled. Grant role to user To grant the atlan_user_role to the new user: Configure OAuth (client credentials flow) with Microsoft Entra ID To configure OAuth authentication using Microsoft Entra ID (formerly Azure AD) with the client credentials flow: Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions In Snowflake, create a security integration using the following: CREATE SECURITY INTEGRATION external_oauth_azure_ad TYPE = external_oauth ENABLED = true EXTERNAL_OAUTH_TYPE = azure EXTERNAL_OAUTH_ISSUER = '\ ' EXTERNAL_OAUTH_JWS_KEYS_URL = '\ ' EXTERNAL_OAUTH_AUDIENCE_LIST = ( '\ ' ) EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub' EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name' ; Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app In Snowflake, create a security integration using the following: Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: CREATE USER oauth_svc_user WITH LOGIN_NAME = '\ ' -- Use Azure client OBJECT ID DEFAULT_ROLE = \ DEFAULT_WAREHOUSE = \ ; Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: Grant the configured role to this user: GRANT ROLE \ TO USER oauth_svc_user ; Grant the configured role to this user: Choose metadata fetching method Atlan supports two methods for fetching metadata from Snowflake - account usage and information schema.


Set up Snowflake | Atlan Documentation

You should choose one of these two methods to set up Snowflake: Grant permissions for account usage method If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.


Set up Snowflake | Atlan Documentation

This method uses the views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch the metadata from Snowflake into Atlan. You can be more granular with permissions using this method, but there are limitations with this approach.


Set up Snowflake | Atlan Documentation

To crawl assets, generate lineage, and import tags If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

If you're using the account usage method to crawl metadata in Atlan or you have configured the Snowflake miner , you need to grant the same permissions to import tags as required for crawling Snowflake assets. Note that object tagging in Snowflake currently requires Enterprise Edition or higher.


Set up Snowflake | Atlan Documentation

To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name. Replace with the copied Snowflake ACCOUNT_USAGE schema name.


Set up Snowflake | Atlan Documentation

The grants for the copied version can't be used on the original SNOWFLAKE database. This is because Snowflake produces an error that granular grants can't be given to imported databases.


Set up Snowflake | Atlan Documentation

When using a cloned or copied version, verify that the table or view definition remains unchanged as in your SNOWFLAKE database. If the format is different.


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. To crawl streams To crawl streams, provide the following permissions: To crawl current streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the Snowflake database name. To crawl future streams: To crawl future streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

(Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions.


Set up Snowflake | Atlan Documentation

Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead. Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. Grant permissions for information schema method This method uses views in the INFORMATION_SCHEMA schema in Snowflake databases to fetch metadata.


Set up Snowflake | Atlan Documentation

You still need to grant specific permissions to enable Atlan to crawl metadata, preview data, and query data with this method. To crawl existing assets Grant these permissions to crawl assets that already exist in Snowflake.


Set up Snowflake | Atlan Documentation

If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Grant permissions to crawl existing assets: Replace with the database you want to be available in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to integrate into Atlan.) Grant permissions to crawl functions: Replace with the database you want to be available in Atlan. (Repeat the statements for every database you wish to integrate into Atlan.) For secure user-defined functions (UDFs), grant OWNERSHIP permissions to retrieve metadata: Replace the placeholders with the appropriate values: : The name of the schema that contains the user-defined function (UDF).


Set up Snowflake | Atlan Documentation

: The name of the secure UDF that requires ownership permissions. : The role that gets assigned ownership of the secure UDF.


Set up Snowflake | Atlan Documentation

The statements given on this page apply to all schemas, tables, and views in a database in Snowflake. If you want to limit access to only certain objects, you can instead specify the exact objects individually as well.


Set up Snowflake | Atlan Documentation

To crawl future assets To crawl assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

To grant permissions at a database level: Replace with the database you want to crawl in Atlan. (Repeat the statements for every database you want to integrate into Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to integrate into Atlan.) To mine query history for lineage To also mine Snowflake's query history (for lineage), add these permissions. You can use either option: To mine query history direct from Snowflake's internal tables: To mine query history from a cloned or copied set of tables, where you can also remove any sensitive data: Replace with the name of the cloned database, and with the name of the cloned schema containing account usage details.


Set up Snowflake | Atlan Documentation


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. (Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you want to preview and query in Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. (Optional) To import Snowflake tags Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

Note that object tagging in Snowflake currently requires Enterprise Edition or higher. To import tags from Snowflake , grant these permissions: To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the copied Snowflake ACCOUNT_USAGE schema name. The grants for the copied version can't be used on the original SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

This is because Snowflake produces an error that granular grants can't be given to imported databases. (Optional) To push updated tags to Snowflake To push tags updated for assets in Atlan to Snowflake , grant these permissions: You can learn more about tag privileges from Snowflake documentation.


Set up Snowflake | Atlan Documentation

(Optional) To crawl dynamic tables Atlan currently supports fetching metadata for dynamic tables using the MONITOR privilege. Refer to Snowflake documentation to learn more.


Set up Snowflake | Atlan Documentation

To crawl existing dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: To crawl future dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan. (Repeat the statements for every database and schema you want to integrate into Atlan.) (Optional) To crawl Iceberg tables Atlan currently supports fetching metadata for Iceberg tables only for the information schema extraction method.


Set up Snowflake | Atlan Documentation

To crawl Iceberg tables from Snowflake, grant the following permissions: To crawl existing Iceberg tables in Snowflake: To crawl future Iceberg tables in Snowflake: To crawl Iceberg catalog metadata for Iceberg tables in Snowflake: You must first grant permissions to crawl existing Iceberg tables for this permission to work on catalogs. You must also grant permissions to all the catalogs you want to crawl in Atlan individually.


Set up Snowflake | Atlan Documentation

(Optional) To crawl Snowflake stages Atlan supports crawling metadata for Snowflake stages using the USAGE and READ privileges. For more information, see the Snowflake documentation for INFORMATION_SCHEMA.STAGES.


Set up Snowflake | Atlan Documentation

To crawl stages from Snowflake: Grant USAGE and READ privileges on all existing stages at the database level: Replace with the name of your Snowflake database Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Replace with the role you've granted Atlan to use for crawling.


Set up Snowflake | Atlan Documentation

Grant USAGE and READ privileges on all future stages at the database level: Grant USAGE and READ privileges on all future stages at the database level: Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Allowlist the Atlan IP If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist.


Set up Snowflake | Atlan Documentation

Please raise a support ticket from within Atlan, or submit a request. (If you aren't using the IP allowlist in your Snowflake instance, you can skip this step.) Create user and role in Snowflake Choose metadata fetching method Grant permissions for account usage method Grant permissions for information schema method Allowlist the Atlan IP


Set up Snowflake | Atlan Documentation

You need your Snowflake administrator to run these commands - you may not have access yourself. Create user and role in Snowflake Create a role and user in Snowflake using the following commands: Create role Create a role in Snowflake using the following commands: Replace with the default warehouse to use when running the Snowflake crawler.


Set up Snowflake | Atlan Documentation

Atlan requires the following privileges to: OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped. USAGE enables Atlan to show or list metadata from Snowflake.


Set up Snowflake | Atlan Documentation

This in turn enables the Snowflake crawler to run the SHOW query. Create a user Create a separate user to integrate into Atlan, using one of the following 3 options: See Snowflake's official guide for details on generating an RSA key-pair.


Set up Snowflake | Atlan Documentation

To create a user with a key-pair, replace the value for rsa_public_key with the public key and run the following: Learn more about the SERVICE type property in Snowflake documentation. Atlan only supports encrypted private keys with a non-empty passphrase - generally recommended as more secure.


Set up Snowflake | Atlan Documentation

An empty passphrase results in workflow failures. To generate an encrypted private key, omit the -nocrypt option.


Set up Snowflake | Atlan Documentation

Refer to Snowflake documentation to learn more. Snowflake recommends transitioning away from basic authentication using username and password.


Set up Snowflake | Atlan Documentation

Change to key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.


Set up Snowflake | Atlan Documentation

To create a user with a password, replace and run the following: Learn more about the LEGACY_SERVICE type property in Snowflake documentation. This method is currently only available if Okta is your IdP (Snowflake supports) authenticating natively through Okta : Create a user in your identity provider (IdP) and use federated authentication in Snowflake.


Set up Snowflake | Atlan Documentation

The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled. Grant role to user To grant the atlan_user_role to the new user: Configure OAuth (client credentials flow) with Microsoft Entra ID To configure OAuth authentication using Microsoft Entra ID (formerly Azure AD) with the client credentials flow: Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions In Snowflake, create a security integration using the following: CREATE SECURITY INTEGRATION external_oauth_azure_ad TYPE = external_oauth ENABLED = true EXTERNAL_OAUTH_TYPE = azure EXTERNAL_OAUTH_ISSUER = '\ ' EXTERNAL_OAUTH_JWS_KEYS_URL = '\ ' EXTERNAL_OAUTH_AUDIENCE_LIST = ( '\ ' ) EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub' EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name' ; Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app In Snowflake, create a security integration using the following: Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: CREATE USER oauth_svc_user WITH LOGIN_NAME = '\ ' -- Use Azure client OBJECT ID DEFAULT_ROLE = \ DEFAULT_WAREHOUSE = \ ; Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: Grant the configured role to this user: GRANT ROLE \ TO USER oauth_svc_user ; Grant the configured role to this user: Choose metadata fetching method Atlan supports two methods for fetching metadata from Snowflake - account usage and information schema.


Set up Snowflake | Atlan Documentation

You should choose one of these two methods to set up Snowflake: Grant permissions for account usage method If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.


Set up Snowflake | Atlan Documentation

This method uses the views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch the metadata from Snowflake into Atlan. You can be more granular with permissions using this method, but there are limitations with this approach.


Set up Snowflake | Atlan Documentation

To crawl assets, generate lineage, and import tags If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

If you're using the account usage method to crawl metadata in Atlan or you have configured the Snowflake miner , you need to grant the same permissions to import tags as required for crawling Snowflake assets. Note that object tagging in Snowflake currently requires Enterprise Edition or higher.


Set up Snowflake | Atlan Documentation

To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name. Replace with the copied Snowflake ACCOUNT_USAGE schema name.


Set up Snowflake | Atlan Documentation

The grants for the copied version can't be used on the original SNOWFLAKE database. This is because Snowflake produces an error that granular grants can't be given to imported databases.


Set up Snowflake | Atlan Documentation

When using a cloned or copied version, verify that the table or view definition remains unchanged as in your SNOWFLAKE database. If the format is different.


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. To crawl streams To crawl streams, provide the following permissions: To crawl current streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the Snowflake database name. To crawl future streams: To crawl future streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

(Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions.


Set up Snowflake | Atlan Documentation

Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead. Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. Grant permissions for information schema method This method uses views in the INFORMATION_SCHEMA schema in Snowflake databases to fetch metadata.


Set up Snowflake | Atlan Documentation

You still need to grant specific permissions to enable Atlan to crawl metadata, preview data, and query data with this method. To crawl existing assets Grant these permissions to crawl assets that already exist in Snowflake.


Set up Snowflake | Atlan Documentation

If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Grant permissions to crawl existing assets: Replace with the database you want to be available in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to integrate into Atlan.) Grant permissions to crawl functions: Replace with the database you want to be available in Atlan. (Repeat the statements for every database you wish to integrate into Atlan.) For secure user-defined functions (UDFs), grant OWNERSHIP permissions to retrieve metadata: Replace the placeholders with the appropriate values: : The name of the schema that contains the user-defined function (UDF).


Set up Snowflake | Atlan Documentation

: The name of the secure UDF that requires ownership permissions. : The role that gets assigned ownership of the secure UDF.


Set up Snowflake | Atlan Documentation

The statements given on this page apply to all schemas, tables, and views in a database in Snowflake. If you want to limit access to only certain objects, you can instead specify the exact objects individually as well.


Set up Snowflake | Atlan Documentation

To crawl future assets To crawl assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

To grant permissions at a database level: Replace with the database you want to crawl in Atlan. (Repeat the statements for every database you want to integrate into Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to integrate into Atlan.) To mine query history for lineage To also mine Snowflake's query history (for lineage), add these permissions. You can use either option: To mine query history direct from Snowflake's internal tables: To mine query history from a cloned or copied set of tables, where you can also remove any sensitive data: Replace with the name of the cloned database, and with the name of the cloned schema containing account usage details.


Set up Snowflake | Atlan Documentation


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. (Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you want to preview and query in Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. (Optional) To import Snowflake tags Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

Note that object tagging in Snowflake currently requires Enterprise Edition or higher. To import tags from Snowflake , grant these permissions: To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the copied Snowflake ACCOUNT_USAGE schema name. The grants for the copied version can't be used on the original SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

This is because Snowflake produces an error that granular grants can't be given to imported databases. (Optional) To push updated tags to Snowflake To push tags updated for assets in Atlan to Snowflake , grant these permissions: You can learn more about tag privileges from Snowflake documentation.


Set up Snowflake | Atlan Documentation

(Optional) To crawl dynamic tables Atlan currently supports fetching metadata for dynamic tables using the MONITOR privilege. Refer to Snowflake documentation to learn more.


Set up Snowflake | Atlan Documentation

To crawl existing dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: To crawl future dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan. (Repeat the statements for every database and schema you want to integrate into Atlan.) (Optional) To crawl Iceberg tables Atlan currently supports fetching metadata for Iceberg tables only for the information schema extraction method.


Set up Snowflake | Atlan Documentation

To crawl Iceberg tables from Snowflake, grant the following permissions: To crawl existing Iceberg tables in Snowflake: To crawl future Iceberg tables in Snowflake: To crawl Iceberg catalog metadata for Iceberg tables in Snowflake: You must first grant permissions to crawl existing Iceberg tables for this permission to work on catalogs. You must also grant permissions to all the catalogs you want to crawl in Atlan individually.


Set up Snowflake | Atlan Documentation

(Optional) To crawl Snowflake stages Atlan supports crawling metadata for Snowflake stages using the USAGE and READ privileges. For more information, see the Snowflake documentation for INFORMATION_SCHEMA.STAGES.


Set up Snowflake | Atlan Documentation

To crawl stages from Snowflake: Grant USAGE and READ privileges on all existing stages at the database level: Replace with the name of your Snowflake database Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Replace with the role you've granted Atlan to use for crawling.


Set up Snowflake | Atlan Documentation

Grant USAGE and READ privileges on all future stages at the database level: Grant USAGE and READ privileges on all future stages at the database level: Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Allowlist the Atlan IP If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist.


Set up Snowflake | Atlan Documentation

Please raise a support ticket from within Atlan, or submit a request. (If you aren't using the IP allowlist in your Snowflake instance, you can skip this step.) Create user and role in Snowflake Choose metadata fetching method Grant permissions for account usage method Grant permissions for information schema method Allowlist the Atlan IP


Set up Snowflake | Atlan Documentation

You need your Snowflake administrator to run these commands - you may not have access yourself. Create user and role in Snowflake Create a role and user in Snowflake using the following commands: Create role Create a role in Snowflake using the following commands: Replace with the default warehouse to use when running the Snowflake crawler.


Set up Snowflake | Atlan Documentation

Atlan requires the following privileges to: OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped. USAGE enables Atlan to show or list metadata from Snowflake.


Set up Snowflake | Atlan Documentation

This in turn enables the Snowflake crawler to run the SHOW query. Create a user Create a separate user to integrate into Atlan, using one of the following 3 options: See Snowflake's official guide for details on generating an RSA key-pair.


Set up Snowflake | Atlan Documentation

To create a user with a key-pair, replace the value for rsa_public_key with the public key and run the following: Learn more about the SERVICE type property in Snowflake documentation. Atlan only supports encrypted private keys with a non-empty passphrase - generally recommended as more secure.


Set up Snowflake | Atlan Documentation

An empty passphrase results in workflow failures. To generate an encrypted private key, omit the -nocrypt option.


Set up Snowflake | Atlan Documentation

Refer to Snowflake documentation to learn more. Snowflake recommends transitioning away from basic authentication using username and password.


Set up Snowflake | Atlan Documentation

Change to key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.


Set up Snowflake | Atlan Documentation

To create a user with a password, replace and run the following: Learn more about the LEGACY_SERVICE type property in Snowflake documentation. This method is currently only available if Okta is your IdP (Snowflake supports) authenticating natively through Okta : Create a user in your identity provider (IdP) and use federated authentication in Snowflake.


Set up Snowflake | Atlan Documentation

The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled. Grant role to user To grant the atlan_user_role to the new user: Configure OAuth (client credentials flow) with Microsoft Entra ID To configure OAuth authentication using Microsoft Entra ID (formerly Azure AD) with the client credentials flow: Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions In Snowflake, create a security integration using the following: CREATE SECURITY INTEGRATION external_oauth_azure_ad TYPE = external_oauth ENABLED = true EXTERNAL_OAUTH_TYPE = azure EXTERNAL_OAUTH_ISSUER = '\ ' EXTERNAL_OAUTH_JWS_KEYS_URL = '\ ' EXTERNAL_OAUTH_AUDIENCE_LIST = ( '\ ' ) EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub' EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name' ; Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app In Snowflake, create a security integration using the following: Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: CREATE USER oauth_svc_user WITH LOGIN_NAME = '\ ' -- Use Azure client OBJECT ID DEFAULT_ROLE = \ DEFAULT_WAREHOUSE = \ ; Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: Grant the configured role to this user: GRANT ROLE \ TO USER oauth_svc_user ; Grant the configured role to this user: Choose metadata fetching method Atlan supports two methods for fetching metadata from Snowflake - account usage and information schema.


Set up Snowflake | Atlan Documentation

You should choose one of these two methods to set up Snowflake: Grant permissions for account usage method If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.


Set up Snowflake | Atlan Documentation

This method uses the views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch the metadata from Snowflake into Atlan. You can be more granular with permissions using this method, but there are limitations with this approach.


Set up Snowflake | Atlan Documentation

To crawl assets, generate lineage, and import tags If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

If you're using the account usage method to crawl metadata in Atlan or you have configured the Snowflake miner , you need to grant the same permissions to import tags as required for crawling Snowflake assets. Note that object tagging in Snowflake currently requires Enterprise Edition or higher.


Set up Snowflake | Atlan Documentation

To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name. Replace with the copied Snowflake ACCOUNT_USAGE schema name.


Set up Snowflake | Atlan Documentation

The grants for the copied version can't be used on the original SNOWFLAKE database. This is because Snowflake produces an error that granular grants can't be given to imported databases.


Set up Snowflake | Atlan Documentation

When using a cloned or copied version, verify that the table or view definition remains unchanged as in your SNOWFLAKE database. If the format is different.


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. To crawl streams To crawl streams, provide the following permissions: To crawl current streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the Snowflake database name. To crawl future streams: To crawl future streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

(Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions.


Set up Snowflake | Atlan Documentation

Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead. Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. Grant permissions for information schema method This method uses views in the INFORMATION_SCHEMA schema in Snowflake databases to fetch metadata.


Set up Snowflake | Atlan Documentation

You still need to grant specific permissions to enable Atlan to crawl metadata, preview data, and query data with this method. To crawl existing assets Grant these permissions to crawl assets that already exist in Snowflake.


Set up Snowflake | Atlan Documentation

If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Grant permissions to crawl existing assets: Replace with the database you want to be available in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to integrate into Atlan.) Grant permissions to crawl functions: Replace with the database you want to be available in Atlan. (Repeat the statements for every database you wish to integrate into Atlan.) For secure user-defined functions (UDFs), grant OWNERSHIP permissions to retrieve metadata: Replace the placeholders with the appropriate values: : The name of the schema that contains the user-defined function (UDF).


Set up Snowflake | Atlan Documentation

: The name of the secure UDF that requires ownership permissions. : The role that gets assigned ownership of the secure UDF.


Set up Snowflake | Atlan Documentation

The statements given on this page apply to all schemas, tables, and views in a database in Snowflake. If you want to limit access to only certain objects, you can instead specify the exact objects individually as well.


Set up Snowflake | Atlan Documentation

To crawl future assets To crawl assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

To grant permissions at a database level: Replace with the database you want to crawl in Atlan. (Repeat the statements for every database you want to integrate into Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to integrate into Atlan.) To mine query history for lineage To also mine Snowflake's query history (for lineage), add these permissions. You can use either option: To mine query history direct from Snowflake's internal tables: To mine query history from a cloned or copied set of tables, where you can also remove any sensitive data: Replace with the name of the cloned database, and with the name of the cloned schema containing account usage details.


Set up Snowflake | Atlan Documentation


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. (Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you want to preview and query in Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. (Optional) To import Snowflake tags Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

Note that object tagging in Snowflake currently requires Enterprise Edition or higher. To import tags from Snowflake , grant these permissions: To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the copied Snowflake ACCOUNT_USAGE schema name. The grants for the copied version can't be used on the original SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

This is because Snowflake produces an error that granular grants can't be given to imported databases. (Optional) To push updated tags to Snowflake To push tags updated for assets in Atlan to Snowflake , grant these permissions: You can learn more about tag privileges from Snowflake documentation.


Set up Snowflake | Atlan Documentation

(Optional) To crawl dynamic tables Atlan currently supports fetching metadata for dynamic tables using the MONITOR privilege. Refer to Snowflake documentation to learn more.


Set up Snowflake | Atlan Documentation

To crawl existing dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: To crawl future dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan. (Repeat the statements for every database and schema you want to integrate into Atlan.) (Optional) To crawl Iceberg tables Atlan currently supports fetching metadata for Iceberg tables only for the information schema extraction method.


Set up Snowflake | Atlan Documentation

To crawl Iceberg tables from Snowflake, grant the following permissions: To crawl existing Iceberg tables in Snowflake: To crawl future Iceberg tables in Snowflake: To crawl Iceberg catalog metadata for Iceberg tables in Snowflake: You must first grant permissions to crawl existing Iceberg tables for this permission to work on catalogs. You must also grant permissions to all the catalogs you want to crawl in Atlan individually.


Set up Snowflake | Atlan Documentation

(Optional) To crawl Snowflake stages Atlan supports crawling metadata for Snowflake stages using the USAGE and READ privileges. For more information, see the Snowflake documentation for INFORMATION_SCHEMA.STAGES.


Set up Snowflake | Atlan Documentation

To crawl stages from Snowflake: Grant USAGE and READ privileges on all existing stages at the database level: Replace with the name of your Snowflake database Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Replace with the role you've granted Atlan to use for crawling.


Set up Snowflake | Atlan Documentation

Grant USAGE and READ privileges on all future stages at the database level: Grant USAGE and READ privileges on all future stages at the database level: Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Allowlist the Atlan IP If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist.


Set up Snowflake | Atlan Documentation

Please raise a support ticket from within Atlan, or submit a request. (If you aren't using the IP allowlist in your Snowflake instance, you can skip this step.) Create user and role in Snowflake Choose metadata fetching method Grant permissions for account usage method Grant permissions for information schema method Allowlist the Atlan IP


Set up Snowflake | Atlan Documentation

You need your Snowflake administrator to run these commands - you may not have access yourself. Create user and role in Snowflake Create a role and user in Snowflake using the following commands: Create role Create a role in Snowflake using the following commands: Replace with the default warehouse to use when running the Snowflake crawler.


Set up Snowflake | Atlan Documentation

Atlan requires the following privileges to: OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped. USAGE enables Atlan to show or list metadata from Snowflake.


Set up Snowflake | Atlan Documentation

This in turn enables the Snowflake crawler to run the SHOW query. Create a user Create a separate user to integrate into Atlan, using one of the following 3 options: See Snowflake's official guide for details on generating an RSA key-pair.


Set up Snowflake | Atlan Documentation

To create a user with a key-pair, replace the value for rsa_public_key with the public key and run the following: Learn more about the SERVICE type property in Snowflake documentation. Atlan only supports encrypted private keys with a non-empty passphrase - generally recommended as more secure.


Set up Snowflake | Atlan Documentation

An empty passphrase results in workflow failures. To generate an encrypted private key, omit the -nocrypt option.


Set up Snowflake | Atlan Documentation

Refer to Snowflake documentation to learn more. Snowflake recommends transitioning away from basic authentication using username and password.


Set up Snowflake | Atlan Documentation

Change to key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.