Set up Snowflake | Atlan Documentation

To create a user with a password, replace and run the following: Learn more about the LEGACY_SERVICE type property in Snowflake documentation. This method is currently only available if Okta is your IdP (Snowflake supports) authenticating natively through Okta : Create a user in your identity provider (IdP) and use federated authentication in Snowflake.


Set up Snowflake | Atlan Documentation

The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled. Grant role to user To grant the atlan_user_role to the new user: Configure OAuth (client credentials flow) with Microsoft Entra ID To configure OAuth authentication using Microsoft Entra ID (formerly Azure AD) with the client credentials flow: Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions In Snowflake, create a security integration using the following: CREATE SECURITY INTEGRATION external_oauth_azure_ad TYPE = external_oauth ENABLED = true EXTERNAL_OAUTH_TYPE = azure EXTERNAL_OAUTH_ISSUER = '\ ' EXTERNAL_OAUTH_JWS_KEYS_URL = '\ ' EXTERNAL_OAUTH_AUDIENCE_LIST = ( '\ ' ) EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub' EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name' ; Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app In Snowflake, create a security integration using the following: Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: CREATE USER oauth_svc_user WITH LOGIN_NAME = '\ ' -- Use Azure client OBJECT ID DEFAULT_ROLE = \ DEFAULT_WAREHOUSE = \ ; Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: Grant the configured role to this user: GRANT ROLE \ TO USER oauth_svc_user ; Grant the configured role to this user: Choose metadata fetching method Atlan supports two methods for fetching metadata from Snowflake - account usage and information schema.


Set up Snowflake | Atlan Documentation

You should choose one of these two methods to set up Snowflake: Grant permissions for account usage method If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.


Set up Snowflake | Atlan Documentation

This method uses the views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch the metadata from Snowflake into Atlan. You can be more granular with permissions using this method, but there are limitations with this approach.


Set up Snowflake | Atlan Documentation

To crawl assets, generate lineage, and import tags If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

If you're using the account usage method to crawl metadata in Atlan or you have configured the Snowflake miner , you need to grant the same permissions to import tags as required for crawling Snowflake assets. Note that object tagging in Snowflake currently requires Enterprise Edition or higher.


Set up Snowflake | Atlan Documentation

To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name. Replace with the copied Snowflake ACCOUNT_USAGE schema name.


Set up Snowflake | Atlan Documentation

The grants for the copied version can't be used on the original SNOWFLAKE database. This is because Snowflake produces an error that granular grants can't be given to imported databases.


Set up Snowflake | Atlan Documentation

When using a cloned or copied version, verify that the table or view definition remains unchanged as in your SNOWFLAKE database. If the format is different.


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. To crawl streams To crawl streams, provide the following permissions: To crawl current streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the Snowflake database name. To crawl future streams: To crawl future streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

(Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions.


Set up Snowflake | Atlan Documentation

Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead. Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. Grant permissions for information schema method This method uses views in the INFORMATION_SCHEMA schema in Snowflake databases to fetch metadata.


Set up Snowflake | Atlan Documentation

You still need to grant specific permissions to enable Atlan to crawl metadata, preview data, and query data with this method. To crawl existing assets Grant these permissions to crawl assets that already exist in Snowflake.


Set up Snowflake | Atlan Documentation

If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Grant permissions to crawl existing assets: Replace with the database you want to be available in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to integrate into Atlan.) Grant permissions to crawl functions: Replace with the database you want to be available in Atlan. (Repeat the statements for every database you wish to integrate into Atlan.) For secure user-defined functions (UDFs), grant OWNERSHIP permissions to retrieve metadata: Replace the placeholders with the appropriate values: : The name of the schema that contains the user-defined function (UDF).


Set up Snowflake | Atlan Documentation

: The name of the secure UDF that requires ownership permissions. : The role that gets assigned ownership of the secure UDF.


Set up Snowflake | Atlan Documentation

The statements given on this page apply to all schemas, tables, and views in a database in Snowflake. If you want to limit access to only certain objects, you can instead specify the exact objects individually as well.


Set up Snowflake | Atlan Documentation

To crawl future assets To crawl assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

To grant permissions at a database level: Replace with the database you want to crawl in Atlan. (Repeat the statements for every database you want to integrate into Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to integrate into Atlan.) To mine query history for lineage To also mine Snowflake's query history (for lineage), add these permissions. You can use either option: To mine query history direct from Snowflake's internal tables: To mine query history from a cloned or copied set of tables, where you can also remove any sensitive data: Replace with the name of the cloned database, and with the name of the cloned schema containing account usage details.


Set up Snowflake | Atlan Documentation


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. (Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you want to preview and query in Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. (Optional) To import Snowflake tags Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

Note that object tagging in Snowflake currently requires Enterprise Edition or higher. To import tags from Snowflake , grant these permissions: To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the copied Snowflake ACCOUNT_USAGE schema name. The grants for the copied version can't be used on the original SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

This is because Snowflake produces an error that granular grants can't be given to imported databases. (Optional) To push updated tags to Snowflake To push tags updated for assets in Atlan to Snowflake , grant these permissions: You can learn more about tag privileges from Snowflake documentation.


Set up Snowflake | Atlan Documentation

(Optional) To crawl dynamic tables Atlan currently supports fetching metadata for dynamic tables using the MONITOR privilege. Refer to Snowflake documentation to learn more.


Set up Snowflake | Atlan Documentation

To crawl existing dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: To crawl future dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan. (Repeat the statements for every database and schema you want to integrate into Atlan.) (Optional) To crawl Iceberg tables Atlan currently supports fetching metadata for Iceberg tables only for the information schema extraction method.


Set up Snowflake | Atlan Documentation

To crawl Iceberg tables from Snowflake, grant the following permissions: To crawl existing Iceberg tables in Snowflake: To crawl future Iceberg tables in Snowflake: To crawl Iceberg catalog metadata for Iceberg tables in Snowflake: You must first grant permissions to crawl existing Iceberg tables for this permission to work on catalogs. You must also grant permissions to all the catalogs you want to crawl in Atlan individually.


Set up Snowflake | Atlan Documentation

(Optional) To crawl Snowflake stages Atlan supports crawling metadata for Snowflake stages using the USAGE and READ privileges. For more information, see the Snowflake documentation for INFORMATION_SCHEMA.STAGES.


Set up Snowflake | Atlan Documentation

To crawl stages from Snowflake: Grant USAGE and READ privileges on all existing stages at the database level: Replace with the name of your Snowflake database Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Replace with the role you've granted Atlan to use for crawling.


Set up Snowflake | Atlan Documentation

Grant USAGE and READ privileges on all future stages at the database level: Grant USAGE and READ privileges on all future stages at the database level: Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Allowlist the Atlan IP If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist.


Set up Snowflake | Atlan Documentation

Please raise a support ticket from within Atlan, or submit a request. (If you aren't using the IP allowlist in your Snowflake instance, you can skip this step.) Create user and role in Snowflake Choose metadata fetching method Grant permissions for account usage method Grant permissions for information schema method Allowlist the Atlan IP


Set up Snowflake | Atlan Documentation

You need your Snowflake administrator to run these commands - you may not have access yourself. Create user and role in Snowflake Create a role and user in Snowflake using the following commands: Create role Create a role in Snowflake using the following commands: Replace with the default warehouse to use when running the Snowflake crawler.


Set up Snowflake | Atlan Documentation

Atlan requires the following privileges to: OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped. USAGE enables Atlan to show or list metadata from Snowflake.


Set up Snowflake | Atlan Documentation

This in turn enables the Snowflake crawler to run the SHOW query. Create a user Create a separate user to integrate into Atlan, using one of the following 3 options: See Snowflake's official guide for details on generating an RSA key-pair.


Set up Snowflake | Atlan Documentation

To create a user with a key-pair, replace the value for rsa_public_key with the public key and run the following: Learn more about the SERVICE type property in Snowflake documentation. Atlan only supports encrypted private keys with a non-empty passphrase - generally recommended as more secure.


Set up Snowflake | Atlan Documentation

An empty passphrase results in workflow failures. To generate an encrypted private key, omit the -nocrypt option.


Set up Snowflake | Atlan Documentation

Refer to Snowflake documentation to learn more. Snowflake recommends transitioning away from basic authentication using username and password.


Set up Snowflake | Atlan Documentation

Change to key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.


Set up Snowflake | Atlan Documentation

To create a user with a password, replace and run the following: Learn more about the LEGACY_SERVICE type property in Snowflake documentation. This method is currently only available if Okta is your IdP (Snowflake supports) authenticating natively through Okta : Create a user in your identity provider (IdP) and use federated authentication in Snowflake.


Set up Snowflake | Atlan Documentation

The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled. Grant role to user To grant the atlan_user_role to the new user: Configure OAuth (client credentials flow) with Microsoft Entra ID To configure OAuth authentication using Microsoft Entra ID (formerly Azure AD) with the client credentials flow: Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions In Snowflake, create a security integration using the following: CREATE SECURITY INTEGRATION external_oauth_azure_ad TYPE = external_oauth ENABLED = true EXTERNAL_OAUTH_TYPE = azure EXTERNAL_OAUTH_ISSUER = '\ ' EXTERNAL_OAUTH_JWS_KEYS_URL = '\ ' EXTERNAL_OAUTH_AUDIENCE_LIST = ( '\ ' ) EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub' EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name' ; Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app In Snowflake, create a security integration using the following: Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: CREATE USER oauth_svc_user WITH LOGIN_NAME = '\ ' -- Use Azure client OBJECT ID DEFAULT_ROLE = \ DEFAULT_WAREHOUSE = \ ; Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: Grant the configured role to this user: GRANT ROLE \ TO USER oauth_svc_user ; Grant the configured role to this user: Choose metadata fetching method Atlan supports two methods for fetching metadata from Snowflake - account usage and information schema.


Set up Snowflake | Atlan Documentation

You should choose one of these two methods to set up Snowflake: Grant permissions for account usage method If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.


Set up Snowflake | Atlan Documentation

This method uses the views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch the metadata from Snowflake into Atlan. You can be more granular with permissions using this method, but there are limitations with this approach.


Set up Snowflake | Atlan Documentation

To crawl assets, generate lineage, and import tags If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

If you're using the account usage method to crawl metadata in Atlan or you have configured the Snowflake miner , you need to grant the same permissions to import tags as required for crawling Snowflake assets. Note that object tagging in Snowflake currently requires Enterprise Edition or higher.


Set up Snowflake | Atlan Documentation

To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name. Replace with the copied Snowflake ACCOUNT_USAGE schema name.


Set up Snowflake | Atlan Documentation

The grants for the copied version can't be used on the original SNOWFLAKE database. This is because Snowflake produces an error that granular grants can't be given to imported databases.


Set up Snowflake | Atlan Documentation

When using a cloned or copied version, verify that the table or view definition remains unchanged as in your SNOWFLAKE database. If the format is different.


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. To crawl streams To crawl streams, provide the following permissions: To crawl current streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the Snowflake database name. To crawl future streams: To crawl future streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

(Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions.


Set up Snowflake | Atlan Documentation

Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead. Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. Grant permissions for information schema method This method uses views in the INFORMATION_SCHEMA schema in Snowflake databases to fetch metadata.


Set up Snowflake | Atlan Documentation

You still need to grant specific permissions to enable Atlan to crawl metadata, preview data, and query data with this method. To crawl existing assets Grant these permissions to crawl assets that already exist in Snowflake.


Set up Snowflake | Atlan Documentation

If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Grant permissions to crawl existing assets: Replace with the database you want to be available in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to integrate into Atlan.) Grant permissions to crawl functions: Replace with the database you want to be available in Atlan. (Repeat the statements for every database you wish to integrate into Atlan.) For secure user-defined functions (UDFs), grant OWNERSHIP permissions to retrieve metadata: Replace the placeholders with the appropriate values: : The name of the schema that contains the user-defined function (UDF).


Set up Snowflake | Atlan Documentation

: The name of the secure UDF that requires ownership permissions. : The role that gets assigned ownership of the secure UDF.


Set up Snowflake | Atlan Documentation

The statements given on this page apply to all schemas, tables, and views in a database in Snowflake. If you want to limit access to only certain objects, you can instead specify the exact objects individually as well.


Set up Snowflake | Atlan Documentation

To crawl future assets To crawl assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

To grant permissions at a database level: Replace with the database you want to crawl in Atlan. (Repeat the statements for every database you want to integrate into Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to integrate into Atlan.) To mine query history for lineage To also mine Snowflake's query history (for lineage), add these permissions. You can use either option: To mine query history direct from Snowflake's internal tables: To mine query history from a cloned or copied set of tables, where you can also remove any sensitive data: Replace with the name of the cloned database, and with the name of the cloned schema containing account usage details.


Set up Snowflake | Atlan Documentation


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. (Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you want to preview and query in Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. (Optional) To import Snowflake tags Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

Note that object tagging in Snowflake currently requires Enterprise Edition or higher. To import tags from Snowflake , grant these permissions: To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the copied Snowflake ACCOUNT_USAGE schema name. The grants for the copied version can't be used on the original SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

This is because Snowflake produces an error that granular grants can't be given to imported databases. (Optional) To push updated tags to Snowflake To push tags updated for assets in Atlan to Snowflake , grant these permissions: You can learn more about tag privileges from Snowflake documentation.


Set up Snowflake | Atlan Documentation

(Optional) To crawl dynamic tables Atlan currently supports fetching metadata for dynamic tables using the MONITOR privilege. Refer to Snowflake documentation to learn more.


Set up Snowflake | Atlan Documentation

To crawl existing dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: To crawl future dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan. (Repeat the statements for every database and schema you want to integrate into Atlan.) (Optional) To crawl Iceberg tables Atlan currently supports fetching metadata for Iceberg tables only for the information schema extraction method.


Set up Snowflake | Atlan Documentation

To crawl Iceberg tables from Snowflake, grant the following permissions: To crawl existing Iceberg tables in Snowflake: To crawl future Iceberg tables in Snowflake: To crawl Iceberg catalog metadata for Iceberg tables in Snowflake: You must first grant permissions to crawl existing Iceberg tables for this permission to work on catalogs. You must also grant permissions to all the catalogs you want to crawl in Atlan individually.


Set up Snowflake | Atlan Documentation

(Optional) To crawl Snowflake stages Atlan supports crawling metadata for Snowflake stages using the USAGE and READ privileges. For more information, see the Snowflake documentation for INFORMATION_SCHEMA.STAGES.


Set up Snowflake | Atlan Documentation

To crawl stages from Snowflake: Grant USAGE and READ privileges on all existing stages at the database level: Replace with the name of your Snowflake database Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Replace with the role you've granted Atlan to use for crawling.


Set up Snowflake | Atlan Documentation

Grant USAGE and READ privileges on all future stages at the database level: Grant USAGE and READ privileges on all future stages at the database level: Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Allowlist the Atlan IP If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist.


Set up Snowflake | Atlan Documentation

Please raise a support ticket from within Atlan, or submit a request. (If you aren't using the IP allowlist in your Snowflake instance, you can skip this step.) Create user and role in Snowflake Choose metadata fetching method Grant permissions for account usage method Grant permissions for information schema method Allowlist the Atlan IP


Troubleshooting Snowflake connectivity | Atlan Documentation

Missing warehouse grants The user doesn t have USAGE and OPERATE grants on a warehouse. Grant warehouse access to the role : GRANT OPERATE , USAGE ON WAREHOUSE " " TO ROLE atlan_user_role ; Grant warehouse access to the role : Then, ensure that you grant the role to the new user : GRANT ROLE atlan_user_role TO USER atlan_user ; Then, ensure that you grant the role to the new user : Missing authorized access to SNOWFLAKE.ACCOUNT_USAGE schema The user doesn t have authorized access to the SNOWFLAKE.ACCOUNT_USAGE database Reach out to your account admin to grant imported privileges on the Snowflake database to the role: USE ROLE ACCOUNTADMIN ; GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE TO ROLE atlan_user_role ; Reach out to your account admin to grant imported privileges on the Snowflake database to the role: If using a copied database , you'll need to grant the following permissions: GRANT USAGE ON DATABASE " " TO ROLE atlan_user_role ; GRANT USAGE ON SCHEMA " " IN DATABASE " " TO ROLE atlan_user_role ; GRANT REFERENCES ON ALL VIEWS IN DATABASE " " TO ROLE atlan_user_role ; If using a copied database , you'll need to grant the following permissions: Missing usage grants on databases and/or schemas The user doesn't have usage grants to the databases ` $missingDatabases ` and schemas ` $missingSchemas Grant missing permissions listed here for information schema extraction method.


Atlan IP not allowlisted Atlan's current location or network isn't recognized by Snowflake's security settings. This can happen if Atlan's IP address isn't on the list of allowed addresses in Snowflake's network policies.


If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist. Contact Atlan support to obtain Atlan's IP addresses.


The username or the password provided to connect to the Snowflake account is incorrect. Sign into the Snowflake account for the specified host and verify that the username and password are correct.


You can also create a new user, if required, by following the steps here. Missing or unauthorized role The role specified in your connection configuration doesn't exist in Snowflake or your user account doesn't have grant to use this role.


If the role does not exist or is missing the required grants, create a role and then grant the role to the user. User account locked The user account you're using to connect to Snowflake has been locked temporarily because of multiple incorrect login attempts.


Wait for the user account to unlock or create a different user account to continue. Missing or unauthorized warehouse The warehouse specified in your connection configuration doesn't exist in Snowflake or your user account doesn't have grant to use this warehouse.


Ensure that the warehouse name is configured correctly. Ensure that the warehouse name is configured correctly.


Update the warehouse name in the configuration if your account is using a different warehouse. Create a role and then grant the role to the user for the updated warehouse.


Missing access to non-system databases or schemas The configured user doesn't have usage grants to any database or schema. or The configured user doesn't have usage grants to any non-system database or schema.


This pertains to the information schema method of fetching metadata. Ensure that the user has authorized access to the databases and schemas to be crawled.


Grant the requisite permissions as outlined here. Check the grants on the role attached to the user defined for the crawler.


Ensure the missing database or schema is present in these grants. SHOW GRANTS TO ROLE atlan_user_role ; Check the grants on the role attached to the user defined for the crawler.


Ensure the missing database or schema is present in these grants. When using incremental extraction, consider running a one-time full extraction to capture any newly introduced metadata.


When using incremental extraction, consider running a one-time full extraction to capture any newly introduced metadata. Make sure the role attached to the user defined for the crawler has grants for future tables and views being created in the database: GRANT USAGE ON FUTURE SCHEMAS IN DATABASE " " TO ROLE atlan_user_role ; GRANT REFERENCES ON FUTURE TABLES IN DATABASE " " TO ROLE atlan_user_role ; GRANT REFERENCES ON FUTURE VIEWS IN DATABASE " " TO ROLE atlan_user_role ; GRANT REFERENCES ON FUTURE EXTERNAL TABLES IN DATABASE " " TO ROLE atlan_user_role ; Make sure the role attached to the user defined for the crawler has grants for future tables and views being created in the database: Make sure you run the below commands as well so that new tables and views you've created in-between are also visible to the user: GRANT USAGE ON ALL SCHEMAS IN DATABASE " " TO role atlan_user_role ; GRANT REFERENCES ON ALL TABLES IN DATABASE " " TO role atlan_user_role ; GRANT REFERENCES ON ALL EXTERNAL TABLES IN DATABASE " " TO atlan_user_role ; GRANT REFERENCES ON ALL VIEWS IN DATABASE " " TO role atlan_user_role ; Make sure you run the below commands as well so that new tables and views you've created in-between are also visible to the user: The query miner only mines query history for up to the previous two weeks.


The miner will not mine any queries that ran before that time window. If the queries that created your assets ran before that time window, lineage for those assets will not be present.


To mine more than the previous two weeks of query history, either use S3-based query mining or contact Atlan support. Note that Snowflake itself only retains query history for so long as well, though.


Once Snowflake itself no longer contains the query history we will be unable to mine it for lineage. Lineage is unsupported for parameterized queries.


Snowflake currently does not resolve values for parameterized queries before logging them in query history. This limits Atlan from generating lineage in such cases.


When using the account usage extraction method, there are currently some limitations. We are working with Snowflake to find workarounds for crawling the following: External table location data Procedures Primary key designation External table location data Primary key designation Furthermore, only database-level filtering is currently possible.


When using the account usage method for fetching metadata, Atlan requires access to the following views in Snowflake: For the crawler: DATABASES , SCHEMATA , TABLES , VIEWS , COLUMNS , and PIPES For the miner and popularity metrics : QUERY_HISTORY , ACCESS_HISTORY , and SESSIONS This error can occur when you're connecting to Snowflake through Okta SSO and enter the URL of your Snowflake instance in a format different from the one used in Okta. Snowflake follows two URL formats: Legacy format -.


.snowflakecomputing.com or. .


.snowflakecomputing.com New URL format - - .snowflakecomputing.com Ensure that you're using the same Snowflake URL format in Snowflake and Okta. Refer to Snowflake documentation to learn more.


If you're getting the following error messages - java.net.UnknownHostException and Name or service not known - this is a known error for users who have upgraded to the Snowflake JDBC driver version 3.13.25., have underscores in their account name, and connect to their Snowflake accounts over private link (for example, https://my_account.us-west-2.privatelink.snowflakecomputing.com ). If your Snowflake account name has an underscore - for example, my_account - the updated JDBC driver will automatically convert underscores to dashes or hyphens -.


This does not affect normal URLs because Snowflake accepts URLs with both hyphens and underscores. For private link users, however, the JDBC driver will return an error if there are underscores present in the account name and the connection will fail.


To troubleshoot further, refer to Snowflake documentation .


Set up Snowflake | Atlan Documentation

You need your Snowflake administrator to run these commands - you may not have access yourself. Create user and role in Snowflake Create a role and user in Snowflake using the following commands: Create role Create a role in Snowflake using the following commands: Replace with the default warehouse to use when running the Snowflake crawler.


Set up Snowflake | Atlan Documentation

Atlan requires the following privileges to: OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped. USAGE enables Atlan to show or list metadata from Snowflake.


Set up Snowflake | Atlan Documentation

This in turn enables the Snowflake crawler to run the SHOW query. Create a user Create a separate user to integrate into Atlan, using one of the following 3 options: See Snowflake's official guide for details on generating an RSA key-pair.


Set up Snowflake | Atlan Documentation

To create a user with a key-pair, replace the value for rsa_public_key with the public key and run the following: Learn more about the SERVICE type property in Snowflake documentation. Atlan only supports encrypted private keys with a non-empty passphrase - generally recommended as more secure.


Set up Snowflake | Atlan Documentation

An empty passphrase results in workflow failures. To generate an encrypted private key, omit the -nocrypt option.


Set up Snowflake | Atlan Documentation

Refer to Snowflake documentation to learn more. Snowflake recommends transitioning away from basic authentication using username and password.


Set up Snowflake | Atlan Documentation

Change to key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.


Set up Snowflake | Atlan Documentation

To create a user with a password, replace and run the following: Learn more about the LEGACY_SERVICE type property in Snowflake documentation. This method is currently only available if Okta is your IdP (Snowflake supports) authenticating natively through Okta : Create a user in your identity provider (IdP) and use federated authentication in Snowflake.


Set up Snowflake | Atlan Documentation

The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled. Grant role to user To grant the atlan_user_role to the new user: Configure OAuth (client credentials flow) with Microsoft Entra ID To configure OAuth authentication using Microsoft Entra ID (formerly Azure AD) with the client credentials flow: Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions In Snowflake, create a security integration using the following: CREATE SECURITY INTEGRATION external_oauth_azure_ad TYPE = external_oauth ENABLED = true EXTERNAL_OAUTH_TYPE = azure EXTERNAL_OAUTH_ISSUER = '\ ' EXTERNAL_OAUTH_JWS_KEYS_URL = '\ ' EXTERNAL_OAUTH_AUDIENCE_LIST = ( '\ ' ) EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub' EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name' ; Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app In Snowflake, create a security integration using the following: Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: CREATE USER oauth_svc_user WITH LOGIN_NAME = '\ ' -- Use Azure client OBJECT ID DEFAULT_ROLE = \ DEFAULT_WAREHOUSE = \ ; Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: Grant the configured role to this user: GRANT ROLE \ TO USER oauth_svc_user ; Grant the configured role to this user: Choose metadata fetching method Atlan supports two methods for fetching metadata from Snowflake - account usage and information schema.


Set up Snowflake | Atlan Documentation

You should choose one of these two methods to set up Snowflake: Grant permissions for account usage method If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.


Set up Snowflake | Atlan Documentation

This method uses the views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch the metadata from Snowflake into Atlan. You can be more granular with permissions using this method, but there are limitations with this approach.


Set up Snowflake | Atlan Documentation

To crawl assets, generate lineage, and import tags If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

If you're using the account usage method to crawl metadata in Atlan or you have configured the Snowflake miner , you need to grant the same permissions to import tags as required for crawling Snowflake assets. Note that object tagging in Snowflake currently requires Enterprise Edition or higher.


Set up Snowflake | Atlan Documentation

To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name. Replace with the copied Snowflake ACCOUNT_USAGE schema name.


Set up Snowflake | Atlan Documentation

The grants for the copied version can't be used on the original SNOWFLAKE database. This is because Snowflake produces an error that granular grants can't be given to imported databases.


Set up Snowflake | Atlan Documentation

When using a cloned or copied version, verify that the table or view definition remains unchanged as in your SNOWFLAKE database. If the format is different.


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. To crawl streams To crawl streams, provide the following permissions: To crawl current streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the Snowflake database name. To crawl future streams: To crawl future streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

(Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions.


Set up Snowflake | Atlan Documentation

Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead. Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. Grant permissions for information schema method This method uses views in the INFORMATION_SCHEMA schema in Snowflake databases to fetch metadata.


Set up Snowflake | Atlan Documentation

You still need to grant specific permissions to enable Atlan to crawl metadata, preview data, and query data with this method. To crawl existing assets Grant these permissions to crawl assets that already exist in Snowflake.


Set up Snowflake | Atlan Documentation

If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Grant permissions to crawl existing assets: Replace with the database you want to be available in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to integrate into Atlan.) Grant permissions to crawl functions: Replace with the database you want to be available in Atlan. (Repeat the statements for every database you wish to integrate into Atlan.) For secure user-defined functions (UDFs), grant OWNERSHIP permissions to retrieve metadata: Replace the placeholders with the appropriate values: : The name of the schema that contains the user-defined function (UDF).


Set up Snowflake | Atlan Documentation

: The name of the secure UDF that requires ownership permissions. : The role that gets assigned ownership of the secure UDF.


Set up Snowflake | Atlan Documentation

The statements given on this page apply to all schemas, tables, and views in a database in Snowflake. If you want to limit access to only certain objects, you can instead specify the exact objects individually as well.


Set up Snowflake | Atlan Documentation

To crawl future assets To crawl assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

To grant permissions at a database level: Replace with the database you want to crawl in Atlan. (Repeat the statements for every database you want to integrate into Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to integrate into Atlan.) To mine query history for lineage To also mine Snowflake's query history (for lineage), add these permissions. You can use either option: To mine query history direct from Snowflake's internal tables: To mine query history from a cloned or copied set of tables, where you can also remove any sensitive data: Replace with the name of the cloned database, and with the name of the cloned schema containing account usage details.


Set up Snowflake | Atlan Documentation


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. (Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you want to preview and query in Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. (Optional) To import Snowflake tags Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

Note that object tagging in Snowflake currently requires Enterprise Edition or higher. To import tags from Snowflake , grant these permissions: To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the copied Snowflake ACCOUNT_USAGE schema name. The grants for the copied version can't be used on the original SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

This is because Snowflake produces an error that granular grants can't be given to imported databases. (Optional) To push updated tags to Snowflake To push tags updated for assets in Atlan to Snowflake , grant these permissions: You can learn more about tag privileges from Snowflake documentation.


Set up Snowflake | Atlan Documentation

(Optional) To crawl dynamic tables Atlan currently supports fetching metadata for dynamic tables using the MONITOR privilege. Refer to Snowflake documentation to learn more.


Set up Snowflake | Atlan Documentation

To crawl existing dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: To crawl future dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan. (Repeat the statements for every database and schema you want to integrate into Atlan.) (Optional) To crawl Iceberg tables Atlan currently supports fetching metadata for Iceberg tables only for the information schema extraction method.


Set up Snowflake | Atlan Documentation

To crawl Iceberg tables from Snowflake, grant the following permissions: To crawl existing Iceberg tables in Snowflake: To crawl future Iceberg tables in Snowflake: To crawl Iceberg catalog metadata for Iceberg tables in Snowflake: You must first grant permissions to crawl existing Iceberg tables for this permission to work on catalogs. You must also grant permissions to all the catalogs you want to crawl in Atlan individually.


Set up Snowflake | Atlan Documentation

(Optional) To crawl Snowflake stages Atlan supports crawling metadata for Snowflake stages using the USAGE and READ privileges. For more information, see the Snowflake documentation for INFORMATION_SCHEMA.STAGES.


Set up Snowflake | Atlan Documentation

To crawl stages from Snowflake: Grant USAGE and READ privileges on all existing stages at the database level: Replace with the name of your Snowflake database Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Replace with the role you've granted Atlan to use for crawling.


Set up Snowflake | Atlan Documentation

Grant USAGE and READ privileges on all future stages at the database level: Grant USAGE and READ privileges on all future stages at the database level: Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Allowlist the Atlan IP If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist.


Set up Snowflake | Atlan Documentation

Please raise a support ticket from within Atlan, or submit a request. (If you aren't using the IP allowlist in your Snowflake instance, you can skip this step.) Create user and role in Snowflake Choose metadata fetching method Grant permissions for account usage method Grant permissions for information schema method Allowlist the Atlan IP


Mine Snowflake | Atlan Documentation

Once you have crawled assets from Snowflake , you can mine its query history to construct lineage. To mine lineage from Snowflake, review the order of operations and then complete the following steps.


Mine Snowflake | Atlan Documentation

Select the miner To select the Snowflake miner: In the top right of any screen, navigate to New and then click New Workflow. From the filters along the top, click Miner.


Mine Snowflake | Atlan Documentation

From the list of packages, select Snowflake Miner and then click Setup Workflow. Configure the miner To configure the Snowflake miner: For Connection , select the connection to mine.


Mine Snowflake | Atlan Documentation

(To select a connection, the crawler must have already run.) For Connection , select the connection to mine. (To select a connection, the crawler must have already run.) For Miner Extraction Method , select Source , Agent , or see the separate instructions for the S3 miner.


Mine Snowflake | Atlan Documentation

For Miner Extraction Method , select Source , Agent , or see the separate instructions for the S3 miner. For Snowflake Database : If the connection is configured with access to the snowflake database , choose Default.


Mine Snowflake | Atlan Documentation

If the connection can only access a separate cloned database , choose Cloned Database. For Snowflake Database : If the connection is configured with access to the snowflake database , choose Default.


Mine Snowflake | Atlan Documentation

If the connection can only access a separate cloned database , choose Cloned Database. If you are using a cloned database, enter the name of the cloned database in Database Name and the name of the cloned schema in Schema Name.


Mine Snowflake | Atlan Documentation

If you are using a cloned database, enter the name of the cloned database in Database Name and the name of the cloned schema in Schema Name. For Start time , choose the earliest date from which to mine query history.


Mine Snowflake | Atlan Documentation

info ð ª Did you know? The miner restricts you to only querying the past two weeks of query history.


Mine Snowflake | Atlan Documentation

If you need to query more history, for example in an initial load, consider using the S3 miner first. After the initial load, you can modify the miner's configuration to use query history extraction.


Mine Snowflake | Atlan Documentation

For Start time , choose the earliest date from which to mine query history. ð ª Did you know?


Mine Snowflake | Atlan Documentation

The miner restricts you to only querying the past two weeks of query history. If you need to query more history, for example in an initial load, consider using the S3 miner first.


Mine Snowflake | Atlan Documentation

After the initial load, you can modify the miner's configuration to use query history extraction. To check for any permissions or other configuration issues before running the miner, click Preflight checks.


Mine Snowflake | Atlan Documentation

To check for any permissions or other configuration issues before running the miner, click Preflight checks. At the bottom of the screen, click Next to proceed.


Mine Snowflake | Atlan Documentation

At the bottom of the screen, click Next to proceed. Agent extraction method Atlan supports using a Secure Agent for mining query history from Snowflake.


Mine Snowflake | Atlan Documentation

To use a Secure Agent, follow these steps: Query redaction is a compute-intensive operation and can impact workflow performance. To use this feature effectively, assign at least 4 CPU cores to the agent.


Mine Snowflake | Atlan Documentation

Select the Agent tab. Configure Query Redaction : By default, Query Redaction is turned off.


Mine Snowflake | Atlan Documentation

You may choose to configure query redaction: Set Enable Query Redaction flag to true if you want to redact PII data from query history before ingesting it to Atlan. Configure PII Patterns for Query Redaction : Define patterns to identify and redact sensitive information using the following JSON format: { "pii_patterns" : [ { "name" : "email" , "regex" : "\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b" , "replacement" : "[EMAIL]" } ] } Set Enable Query Redaction flag to true if you want to redact PII data from query history before ingesting it to Atlan.


Mine Snowflake | Atlan Documentation

Configure PII Patterns for Query Redaction : Define patterns to identify and redact sensitive information using the following JSON format: { "pii_patterns" : [ { "name" : "email" , "regex" : "\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b" , "replacement" : "[EMAIL]" } ] } Configure the Snowflake data source by adding the secret keys for your secret store. For details on the required fields, refer to the connection configuration used when crawling Snowflake.


Mine Snowflake | Atlan Documentation

Complete the Secure Agent configuration by following the instructions in the How to configure Secure Agent for workflow execution guide. Click Next after completing the configuration.


Mine Snowflake | Atlan Documentation

If running the miner for the first time, Atlan recommends setting a start date around three days prior to the current date and then scheduling it daily to build up to two weeks of query history. Mining two weeks of query history on the first miner run may cause delays.


Mine Snowflake | Atlan Documentation

For all subsequent runs, Atlan requires a minimum lag of 24 to 48 hours to capture all the relevant transformations that were part of a session. Learn more about the miner logic here.


Mine Snowflake | Atlan Documentation

Configure the miner behavior To configure the Snowflake miner behavior: (Optional) For Calculate popularity , keep True to retrieve usage and popularity metrics for your Snowflake assets from query history. For Excluded Users , type the names of users to be excluded while calculating usage metrics for Snowflake assets.


Mine Snowflake | Atlan Documentation

Press Enter after each name to add more names. For Excluded Users , type the names of users to be excluded while calculating usage metrics for Snowflake assets.


Mine Snowflake | Atlan Documentation

Press Enter after each name to add more names. (Optional) For Advanced Config , keep Default for the default configuration or click Custom to configure the miner: If Atlan support has provided you with a custom control configuration, enter the configuration into the Custom Config box.


Mine Snowflake | Atlan Documentation

You can also enter { ignore-all-case : true} to enable crawling assets with case-sensitive identifiers. For Popularity Window (days) , 90 days is the maximum limit.


Mine Snowflake | Atlan Documentation

You can set a shorter popularity window of less than 90 days. If Atlan support has provided you with a custom control configuration, enter the configuration into the Custom Config box.


Mine Snowflake | Atlan Documentation


Mine Snowflake | Atlan Documentation

You can set a shorter popularity window of less than 90 days. Run the miner To run the Snowflake miner, after completing the configuration steps: To run the miner once immediately, at the bottom of the screen, click the Run button.


Mine Snowflake | Atlan Documentation

To schedule the miner to run hourly, daily, weekly, or monthly, at the bottom of the screen, click the Schedule & Run button. Once the miner has completed running, you can see lineage for Snowflake assets that were created in Snowflake between the start time and when the miner ran!


Mine Snowflake | Atlan Documentation

ð Select the miner Configure the miner Configure the miner behavior Run the miner


Manage Snowflake tags | Atlan Documentation

Note that object tagging in Snowflake currently requires Enterprise Edition or higher. Atlan enables you to import your Snowflake tags , update your Snowflake assets with the imported tags, and push the tag updates back to Snowflake: Import tags - crawl Snowflake tags from Snowflake to Atlan Reverse sync - sync Snowflake tag updates from Atlan to Snowflake Once you've imported your Snowflake tags to Atlan: Your Snowflake assets in Atlan are automatically enriched with their Snowflake tags.


Imported Snowflake tags are mapped to corresponding Atlan tags through case-insensitive name match - multiple Snowflake tags can be matched to a single tag in Atlan. You can also attach Snowflake tags , including tag values, to your Snowflake assets in Atlan - allowing you to categorize your assets at a more granular level.


Atlan supports: Allowed values : attach an allowed value from a predefined list of values imported from Snowflake. Tag values: enter any value in Atlan while attaching or editing imported Snowflake tags on an asset.


Allowed values : attach an allowed value from a predefined list of values imported from Snowflake. Tag values: enter any value in Atlan while attaching or editing imported Snowflake tags on an asset.


You can enable reverse sync to push any tag updates for your Snowflake assets back to Snowflake - including allowed and tag values added to assets in Atlan. You can filter your assets by Snowflake tags and tag and allowed values.


Enabling reverse sync only updates existing tags in Snowflake. It neither creates nor deletes any tags in Snowflake.


Additional privileges are only required when using the information schema method for fetching metadata. This is because Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


If you're using the account usage method to crawl metadata in Atlan or you have configured the Snowflake miner , any permissions required are already set. Account usage method Before you can import tags from Snowflake, you need to do the following: Create tags or have existing tags in Snowflake.


Grant the same permissions as required for crawling Snowflake assets to import tags and push updated tags to Snowflake. Information schema method Before you can import tags from Snowflake, you need to do the following: Create tags or have existing tags in Snowflake.


Grant additional permissions to import tags from Snowflake. Grant additional permissions to push updated tags to Snowflake.


Import Snowflake tags to Atlan You need to be an admin user in Atlan to import Snowflake tags to Atlan. You also need to work with your Snowflake administrator to grant additional permissions to import tags from Snowflake - you may not have access yourself.


You can import your Snowflake tags to Atlan through one-way tag sync. The synced Snowflake tags are matched to corresponding tags in Atlan through case-insensitive name match and your Snowflake assets are enriched with their synced tags from Snowflake.


To import Snowflake tags to Atlan, you can either: Create a new Snowflake workflow and configure the crawler to import tags. Modify the crawler's configuration for an existing Snowflake workflow to change Import Tags to Yes.


If you subsequently modify the workflow to disable tag import, for any tags already imported, Atlan preserves those tags. Once the crawler has completed running, tags imported from Snowflake are available to use for tagging assets!


ð View Snowflake tags in Atlan Once you've imported your Snowflake tags, you can view and manage your Snowflake tags in Atlan. To view Snowflake tags: From the left menu of any screen, click Governance.


Under the Governance heading of the _Governance cente_r, click Tags. (Optional) Under Tags , click the funnel icon to filter tags by source type.


Click Snowflake to filter for tags imported from Snowflake. From the left menu under Tags , select a synced tag - synced tags display the Snowflake ï¸ icon next to the tag name.


(Optional) Click the Linked assets tab to view linked assets for your Snowflake tag. (Optional) In the top right, click the pencil icon to add a description and change the tag icon.


You can't rename tags synced from Snowflake. Push tag updates to Snowflake Any admin or member user in Atlan can configure reverse sync for tag updates to Snowflake.


You also need to work with your Snowflake administrator to grant additional permissions to push updates - you may not have access yourself. Reverse sync is currently only available for imported Snowflake tags in Atlan.


The imported tags display a Snowflake ï¸ icon next to the tag name. If using the account usage method , expect a data latency of up to 3 hours for reverse tag sync to be successful.


You can enable reverse sync for your imported Snowflake tags in Atlan and push all tag updates for your Snowflake assets back to source. Once you have enabled reverse sync, any Snowflake assets with tags updated in Atlan are also updated in Snowflake.


To enable reverse sync for imported Snowflake tags: From the left menu of any screen, click Governance. Under the Governance heading of the _Governance cente_r, click Tags.


(Optional) Under Tags , click the funnel icon to filter tags by source type. Click Snowflake to filter for tags imported from Snowflake.


In the left menu under Tags , select a synced Snowflake tag - synced tags display the Snowflake ï¸ icon next to the tag name. Under Synced tags , in the upper right, turn on Enable reverse sync to synchronize tag updates from Atlan to Snowflake.


In the advanced settings, you can also enable concatenation to support multiple tag values for a single column. For detailed information about multiple tag values and concatenation, see Multiple tag values and concatenation.


In the corresponding confirmation dialog, click Yes, enable it to enable reverse tag sync or click Cancel. Now when you attach Snowflake tags to your Snowflake assets in Atlan, these tag updates are also pushed to Snowflake!


ð Enabling reverse sync won't trigger any updates in Snowflake until synced tags are attached to Snowflake assets in Atlan. For any questions about managing Snowflake tags, head over here.


Import Snowflake tags to Atlan View Snowflake tags in Atlan Push tag updates to Snowflake


Set up Snowflake | Atlan Documentation

You need your Snowflake administrator to run these commands - you may not have access yourself. Create user and role in Snowflake Create a role and user in Snowflake using the following commands: Create role Create a role in Snowflake using the following commands: Replace with the default warehouse to use when running the Snowflake crawler.


Set up Snowflake | Atlan Documentation

Atlan requires the following privileges to: OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped. USAGE enables Atlan to show or list metadata from Snowflake.


Set up Snowflake | Atlan Documentation

This in turn enables the Snowflake crawler to run the SHOW query. Create a user Create a separate user to integrate into Atlan, using one of the following 3 options: See Snowflake's official guide for details on generating an RSA key-pair.


Set up Snowflake | Atlan Documentation

To create a user with a key-pair, replace the value for rsa_public_key with the public key and run the following: Learn more about the SERVICE type property in Snowflake documentation. Atlan only supports encrypted private keys with a non-empty passphrase - generally recommended as more secure.


Set up Snowflake | Atlan Documentation

An empty passphrase results in workflow failures. To generate an encrypted private key, omit the -nocrypt option.


Set up Snowflake | Atlan Documentation

Refer to Snowflake documentation to learn more. Snowflake recommends transitioning away from basic authentication using username and password.


Set up Snowflake | Atlan Documentation

Change to key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.


Set up Snowflake | Atlan Documentation

To create a user with a password, replace and run the following: Learn more about the LEGACY_SERVICE type property in Snowflake documentation. This method is currently only available if Okta is your IdP (Snowflake supports) authenticating natively through Okta : Create a user in your identity provider (IdP) and use federated authentication in Snowflake.


Set up Snowflake | Atlan Documentation

The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled. Grant role to user To grant the atlan_user_role to the new user: Configure OAuth (client credentials flow) with Microsoft Entra ID To configure OAuth authentication using Microsoft Entra ID (formerly Azure AD) with the client credentials flow: Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions In Snowflake, create a security integration using the following: CREATE SECURITY INTEGRATION external_oauth_azure_ad TYPE = external_oauth ENABLED = true EXTERNAL_OAUTH_TYPE = azure EXTERNAL_OAUTH_ISSUER = '\ ' EXTERNAL_OAUTH_JWS_KEYS_URL = '\ ' EXTERNAL_OAUTH_AUDIENCE_LIST = ( '\ ' ) EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub' EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name' ; Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app In Snowflake, create a security integration using the following: Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: CREATE USER oauth_svc_user WITH LOGIN_NAME = '\ ' -- Use Azure client OBJECT ID DEFAULT_ROLE = \ DEFAULT_WAREHOUSE = \ ; Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: Grant the configured role to this user: GRANT ROLE \ TO USER oauth_svc_user ; Grant the configured role to this user: Choose metadata fetching method Atlan supports two methods for fetching metadata from Snowflake - account usage and information schema.


Set up Snowflake | Atlan Documentation

You should choose one of these two methods to set up Snowflake: Grant permissions for account usage method If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.


Set up Snowflake | Atlan Documentation

This method uses the views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch the metadata from Snowflake into Atlan. You can be more granular with permissions using this method, but there are limitations with this approach.


Set up Snowflake | Atlan Documentation

To crawl assets, generate lineage, and import tags If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

If you're using the account usage method to crawl metadata in Atlan or you have configured the Snowflake miner , you need to grant the same permissions to import tags as required for crawling Snowflake assets. Note that object tagging in Snowflake currently requires Enterprise Edition or higher.


Set up Snowflake | Atlan Documentation

To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database. To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles.


Set up Snowflake | Atlan Documentation

To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name. Replace with the copied Snowflake ACCOUNT_USAGE schema name.


Set up Snowflake | Atlan Documentation

The grants for the copied version can't be used on the original SNOWFLAKE database. This is because Snowflake produces an error that granular grants can't be given to imported databases.


Set up Snowflake | Atlan Documentation

When using a cloned or copied version, verify that the table or view definition remains unchanged as in your SNOWFLAKE database. If the format is different.


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. To crawl streams To crawl streams, provide the following permissions: To crawl current streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the Snowflake database name. To crawl future streams: To crawl future streams: Replace with the Snowflake database name.


Set up Snowflake | Atlan Documentation

(Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions.


Set up Snowflake | Atlan Documentation

Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead. Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. Grant permissions for information schema method This method uses views in the INFORMATION_SCHEMA schema in Snowflake databases to fetch metadata.


Set up Snowflake | Atlan Documentation

You still need to grant specific permissions to enable Atlan to crawl metadata, preview data, and query data with this method. To crawl existing assets Grant these permissions to crawl assets that already exist in Snowflake.


Set up Snowflake | Atlan Documentation

If you also want to be able to preview and query the data, you can use the preview and query existing assets permissions instead. Grant permissions to crawl existing assets: Replace with the database you want to be available in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to integrate into Atlan.) Grant permissions to crawl functions: Replace with the database you want to be available in Atlan. (Repeat the statements for every database you wish to integrate into Atlan.) For secure user-defined functions (UDFs), grant OWNERSHIP permissions to retrieve metadata: Replace the placeholders with the appropriate values: : The name of the schema that contains the user-defined function (UDF).


Set up Snowflake | Atlan Documentation

: The name of the secure UDF that requires ownership permissions. : The role that gets assigned ownership of the secure UDF.


Set up Snowflake | Atlan Documentation

The statements given on this page apply to all schemas, tables, and views in a database in Snowflake. If you want to limit access to only certain objects, you can instead specify the exact objects individually as well.


Set up Snowflake | Atlan Documentation

To crawl future assets To crawl assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

To grant permissions at a database level: Replace with the database you want to crawl in Atlan. (Repeat the statements for every database you want to integrate into Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to integrate into Atlan.) To mine query history for lineage To also mine Snowflake's query history (for lineage), add these permissions. You can use either option: To mine query history direct from Snowflake's internal tables: To mine query history from a cloned or copied set of tables, where you can also remove any sensitive data: Replace with the name of the cloned database, and with the name of the cloned schema containing account usage details.


Set up Snowflake | Atlan Documentation


Set up Snowflake | Atlan Documentation

For example, a column is missing and it no longer qualifies as a clone. (Optional) To preview and query existing assets To query and preview data within assets that already exist in Snowflake, add these permissions: Replace with the database you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database you wish to preview and query in Atlan.) (Optional) To preview and query future assets To query and preview data within assets that may be created in the future in Snowflake, add these permissions. Again, if you want to also be able to preview and query the data for future assets, you can add the preview and query future assets permissions instead.


Set up Snowflake | Atlan Documentation

Replace with the database you want to be able to preview and query in Atlan. (Repeat the statements for every database you want to preview and query in Atlan.) For any future grants defined at a schema level to a different role, the schema-level grants take precedence over the database-level grants and any future grants defined at a database level to the Atlan role get ignored.


Set up Snowflake | Atlan Documentation

To learn more, refer to Snowflake documentation. To grant permissions at a schema level: Replace with the database and with the schema you want to be able to preview and query in Atlan.


Set up Snowflake | Atlan Documentation

(Repeat the statements for every database and schema you want to preview and query in Atlan.) Verify that all the assets you'd like to crawl are present in these grants by checking the grants on the user role defined for the crawler. (Optional) To import Snowflake tags Snowflake stores all tag objects in the ACCOUNT_USAGE schema.


Set up Snowflake | Atlan Documentation

Note that object tagging in Snowflake currently requires Enterprise Edition or higher. To import tags from Snowflake , grant these permissions: To use the default SNOWFLAKE database and ACCOUNT_USAGE schema and also mine Snowflake's query history (for lineage), grant these permissions: The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. The ACCOUNTADMIN role is required to grant privileges on the SNOWFLAKE database due to the following reasons: By default, only the ACCOUNTADMIN role can access the SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

To enable other roles to access the database and schemas and query the views, a user with the ACCOUNTADMIN role needs to grant IMPORTED PRIVILEGES on the SNOWFLAKE database to the desired roles. To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: To use a copied or cloned version of this default schema, where you can also remove any sensitive data for security purposes, grant these permissions: Replace with the copied Snowflake database name.


Set up Snowflake | Atlan Documentation

Replace with the copied Snowflake ACCOUNT_USAGE schema name. The grants for the copied version can't be used on the original SNOWFLAKE database.


Set up Snowflake | Atlan Documentation

This is because Snowflake produces an error that granular grants can't be given to imported databases. (Optional) To push updated tags to Snowflake To push tags updated for assets in Atlan to Snowflake , grant these permissions: You can learn more about tag privileges from Snowflake documentation.


Set up Snowflake | Atlan Documentation

(Optional) To crawl dynamic tables Atlan currently supports fetching metadata for dynamic tables using the MONITOR privilege. Refer to Snowflake documentation to learn more.


Set up Snowflake | Atlan Documentation

To crawl existing dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: To crawl future dynamic tables from Snowflake: Grant permissions at a database level: Grant permissions at a schema level: Replace with the database and with the schema you want to crawl in Atlan. (Repeat the statements for every database and schema you want to integrate into Atlan.) (Optional) To crawl Iceberg tables Atlan currently supports fetching metadata for Iceberg tables only for the information schema extraction method.


Set up Snowflake | Atlan Documentation

To crawl Iceberg tables from Snowflake, grant the following permissions: To crawl existing Iceberg tables in Snowflake: To crawl future Iceberg tables in Snowflake: To crawl Iceberg catalog metadata for Iceberg tables in Snowflake: You must first grant permissions to crawl existing Iceberg tables for this permission to work on catalogs. You must also grant permissions to all the catalogs you want to crawl in Atlan individually.


Set up Snowflake | Atlan Documentation

(Optional) To crawl Snowflake stages Atlan supports crawling metadata for Snowflake stages using the USAGE and READ privileges. For more information, see the Snowflake documentation for INFORMATION_SCHEMA.STAGES.


Set up Snowflake | Atlan Documentation

To crawl stages from Snowflake: Grant USAGE and READ privileges on all existing stages at the database level: Replace with the name of your Snowflake database Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Replace with the role you've granted Atlan to use for crawling.


Set up Snowflake | Atlan Documentation

Grant USAGE and READ privileges on all future stages at the database level: Grant USAGE and READ privileges on all future stages at the database level: Replace with the name of your Snowflake database Replace with the role you've granted Atlan to use for crawling. Allowlist the Atlan IP If you are using the IP allowlist in your Snowflake instance, you must add the Atlan IP to the allowlist.


Set up Snowflake | Atlan Documentation

Please raise a support ticket from within Atlan, or submit a request. (If you aren't using the IP allowlist in your Snowflake instance, you can skip this step.) Create user and role in Snowflake Choose metadata fetching method Grant permissions for account usage method Grant permissions for information schema method Allowlist the Atlan IP


Set up Snowflake | Atlan Documentation

You need your Snowflake administrator to run these commands - you may not have access yourself. Create user and role in Snowflake Create a role and user in Snowflake using the following commands: Create role Create a role in Snowflake using the following commands: Replace with the default warehouse to use when running the Snowflake crawler.


Set up Snowflake | Atlan Documentation

Atlan requires the following privileges to: OPERATE enables Atlan to start the virtual warehouse to fetch metadata if the warehouse has stopped. USAGE enables Atlan to show or list metadata from Snowflake.


Set up Snowflake | Atlan Documentation

This in turn enables the Snowflake crawler to run the SHOW query. Create a user Create a separate user to integrate into Atlan, using one of the following 3 options: See Snowflake's official guide for details on generating an RSA key-pair.


Set up Snowflake | Atlan Documentation

To create a user with a key-pair, replace the value for rsa_public_key with the public key and run the following: Learn more about the SERVICE type property in Snowflake documentation. Atlan only supports encrypted private keys with a non-empty passphrase - generally recommended as more secure.


Set up Snowflake | Atlan Documentation

An empty passphrase results in workflow failures. To generate an encrypted private key, omit the -nocrypt option.


Set up Snowflake | Atlan Documentation

Refer to Snowflake documentation to learn more. Snowflake recommends transitioning away from basic authentication using username and password.


Set up Snowflake | Atlan Documentation

Change to key-pair authentication for enhanced security. For any existing Snowflake workflows, you can modify the crawler configuration to update the authentication method.


Set up Snowflake | Atlan Documentation

To create a user with a password, replace and run the following: Learn more about the LEGACY_SERVICE type property in Snowflake documentation. This method is currently only available if Okta is your IdP (Snowflake supports) authenticating natively through Okta : Create a user in your identity provider (IdP) and use federated authentication in Snowflake.


Set up Snowflake | Atlan Documentation

The password for this user must be maintained solely in the IdP and multi-factor authentication (MFA) must be disabled. Grant role to user To grant the atlan_user_role to the new user: Configure OAuth (client credentials flow) with Microsoft Entra ID To configure OAuth authentication using Microsoft Entra ID (formerly Azure AD) with the client credentials flow: Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions Follow Snowflake's documentation to: Register a new application in Microsoft Entra ID Collect the client ID , tenant ID , and client secret Add the required API permissions In Snowflake, create a security integration using the following: CREATE SECURITY INTEGRATION external_oauth_azure_ad TYPE = external_oauth ENABLED = true EXTERNAL_OAUTH_TYPE = azure EXTERNAL_OAUTH_ISSUER = '\ ' EXTERNAL_OAUTH_JWS_KEYS_URL = '\ ' EXTERNAL_OAUTH_AUDIENCE_LIST = ( '\ ' ) EXTERNAL_OAUTH_TOKEN_USER_MAPPING_CLAIM = 'sub' EXTERNAL_OAUTH_SNOWFLAKE_USER_MAPPING_ATTRIBUTE = 'login_name' ; Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app In Snowflake, create a security integration using the following: Replace the placeholders with actual values from your Azure AD app: Your tenant's OAuth 2.0 issuer URL Azure JWKs URI Application ID URI of the Azure app Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: CREATE USER oauth_svc_user WITH LOGIN_NAME = '\ ' -- Use Azure client OBJECT ID DEFAULT_ROLE = \ DEFAULT_WAREHOUSE = \ ; Create a Snowflake user with a login name that exactly matches the Azure AD client object ID: Grant the configured role to this user: GRANT ROLE \ TO USER oauth_svc_user ; Grant the configured role to this user: Choose metadata fetching method Atlan supports two methods for fetching metadata from Snowflake - account usage and information schema.


Set up Snowflake | Atlan Documentation

You should choose one of these two methods to set up Snowflake: Grant permissions for account usage method If you want to set warehouse timeouts when using this method, set a large value initially for the workflow to succeed. Once the workflow has succeeded, adjust the value to be twice the extraction time.


Set up Snowflake | Atlan Documentation

This method uses the views in SNOWFLAKE.ACCOUNT_USAGE (or a copied version of this schema) to fetch the metadata from Snowflake into Atlan. You can be more granular with permissions using this method, but there are limitations with this approach.